A vulnerability exists in the Qbot botnet C2, in the code that performs the login. A remote attacker can exploit it to bypass the authentication, having the ability to control the botnet and perform action as an authenticated user, like taking control of the botnet.

This Botnet has a lot of variants, which makes it more difficult to categorize it in versions.

Hopefully, all the versions found out there are found to be vulnerable, just minor changes are required for the exploit to work. Most versions out there are vulnerable.

Usage: python exploit.py <ip> <port>

After the exploit performs the authentication bypass, a Telnet interactive communication will be opened to interact with the server administration command line.

All the Qbot botnet variants found has been detected to be vulnerable. Minor changes in the exploit are required for it to work.