rapid7/metasploit-framework — pull request #2973 by bwall (2014-02-10 22:02:37+00:00)
Title: Dexter panel (CasinoLoader) SQLi to PHP code exec - Initial

SQL injection in the panel used by the point of sale malware Dexter. Input into the gateway for bots to call home (gateway.php) is not sanitized, and can be exploited in quite a few ways. For this module, the exploit extracts credentials from the MySQL back end, uses those credentials to login then abuse the upload ability in the panel to upload our payload. The upload page gives a location for the upload folder, which gives us a detectable and reliable writable location. The payload could be written from just SQLi, but it would have been less reliable and require more information beforehand. No platform dependency has been seen for the exploit given that the panel is functional.

The source code for the panel has been leaked in various locations, this is one of them (for verification purposes): http://www.sendspace.com/file/pnxubv (password 'MalDev.net')