CVE Mapping Reference

Note

This reference compiles all exploited vulnerabilities identified across the entire archived collection. Primary sources: rBot/rxBot research (Section 3), exploit pack research (Section A), Hydra research (Section B), and sdBot lineage research (Section 4).

Introduction

One of the most educational aspects of this collection is the clear mapping between publicly disclosed vulnerabilities (CVEs and Microsoft Security Bulletins) and their weaponization in botnet source code. This page provides a comprehensive reference of every exploit identified across all specimen families.

---

Master CVE Table - Bot Families

The following table documents all exploits found in the IRC bot families (sdBot, rBot, rxBot, NZM, 120-Series, and related variants), ordered chronologically by vulnerability disclosure date.

Exploit Module	CVE	MS Bulletin	Disclosure Date	Integration Window	Target Port	Description	Families Using It
UPnP	CVE-2001-0876	MS01-059	Dec 2001	~2 years (2004)	5000/UDP	Universal Plug and Play buffer overflow in Windows XP SSDP service	rBot, rxBot
MSSQL	CVE-2002-1123	MS02-056	Oct 2002	~18 months (Mar 2004)	1433/TCP	SQL Server resolution service buffer overflow; brute-force module also included	rBot, rxBot, 120-Series
WebDAV	CVE-2003-0109	MS03-007	Mar 2003	~12 months (Mar 2004)	80/TCP	IIS 5.0 WebDAV ntdll.dll buffer overflow	rBot, rxBot, NZM
DCOM	CVE-2003-0352	MS03-026	Jul 2003	Weeks (pre-Q1 2004)	135/TCP	RPC DCOM interface buffer overflow - the "Blaster" vulnerability; exploit code borrowed from Agobot	rBot, rxBot, sdBot mods, Phatbot, NZM
DCOM2	CVE-2003-0715	MS03-039	Sep 2003	~6 months (Mar 2004)	135/TCP	Second RPC DCOM wave; additional overflow vectors	rBot, rxBot
LSASS	CVE-2003-0533	MS04-011	Apr 2004	Days–Weeks (Apr 2004)	445/TCP	LSASS buffer overflow via SMB - the "Sasser" vulnerability	rBot, rxBot, NZM, 120-Series
IIS5 SSL/PCT	CVE-2003-0719	MS04-011	Apr 2004	Days–Weeks (Apr 2004)	443/TCP	IIS 5.0 SSL PCT overflow	rBot, rxBot
ASN.1	CVE-2003-0818	MS04-007	Feb 2004	~12 months (2005 NZM)	445/TCP	ASN.1 library parsing vulnerability in msasn1.dll	NZM, Urxbot
Workstation Service	CVE-2003-0812	MS03-049	Nov 2003	~18 months (2005 NZM)	445/TCP	Windows Workstation Service (WKSSVC) buffer overflow	NZM
DameWare	CVE-2003-1030	N/A	Dec 2003	~4 months (Apr 2004)	6129/TCP	DameWare Mini Remote Control pre-auth overflow	rBot, rxBot
PnP	CVE-2005-1983	MS05-039	Aug 2005	Days–Weeks (Aug 2005+)	445/TCP	Windows Plug and Play overflow - enabled the Zotob worm wave	NZM, 120-Series, late rxBot mods
NetAPI	CVE-2006-3439	MS06-040	Aug 2006	Months (2006–2007)	445/TCP	Server Service NetpwPathCanonicalize overflow	120-Series, late rxBot mods
Symantec	CVE-2006-2630	N/A	Jun 2006	Months (2006–2007)	2967/TCP	Symantec Client Security / Antivirus stack overflow	Urxbot, 120-Series

---

Exploit Pack CVEs

The commercial exploit kits in the collection targeted client-side vulnerabilities (browsers, document readers, plugins) rather than network services.

Kit	CVE	Target Software	Technique	Description
Fiesta3	CVE-2007-5659	Adobe Reader	Heap spray via PDF JavaScript	Collab​.collect​Email​Info vulnerability; dynamically generated PDF with /OpenAction JS trigger
IcePack	Multiple (modular)	IE 6/7, Firefox, Opera	Browser fingerprinting + targeted exploit delivery	12+ modular exploit files in exploits/ directory; exact CVEs vary by module configuration
Fragus	Multiple (8 exploits)	Browser + plugins	Drive-by download framework	Affiliate-tracked exploitation; exact CVEs configured per deployment
my_poly_sploit	Multiple	Multi-browser	Polymorphic shellcode	Novel: shellcode mutations per delivery to defeat signatures

Caution

Exploit kits were designed to be modular - operators could add or remove exploit modules based on available CVEs. The specific CVEs active in any deployment depended on the operator's configuration. The table above reflects what was found in the archived source code, not necessarily all CVEs these kits ever used.

---

IoT / Embedded Device Exploits

Specimen	CVE	Target	Attack Vector	Description
hydra-2008.1	N/A (default credentials)	D-Link routers (MIPSEL)	Telnet brute-force (port 23)	Dictionary of default/common credentials
hydra-2008.1	N/A (info disclosure)	D-Link web interface	HTTP POST to admin panel (port 80)	Information disclosure vulnerability leaking admin password from HTML page

Note

Hydra's attacks exploited design weaknesses (default credentials, information disclosure) rather than specific memory corruption CVEs. This pattern - targeting configuration errors rather than software bugs - became the dominant IoT attack vector, as later demonstrated by Mirai in 2016.

---

Additional Service Exploits (Non-CVE)

Several bot families included brute-force and exploitation modules targeting services without specific CVE associations:

Module	Target	Port	Method	Families
NetBIOS brute	Windows file shares	139, 445/TCP	~80+ password dictionary	sdBot, SpyBot, rBot, rxBot, all derivatives
VNC brute	VNC remote desktop	5900/TCP	Password brute-force	120-Series
MySQL brute + UDF	MySQL databases	3306/TCP	Credential brute-force → UDF injection for code execution	120-Series
MSSQL brute	Microsoft SQL Server	1433/TCP	SA password brute-force	rBot, rxBot, 120-Series
FTP brute	FTP servers	21/TCP	Credential brute-force	Multiple
Cisco scanner	Cisco routers	Various	SNMP/Telnet probing	120-Series, hdbotv0.2
RFI scanner	PHP web applications	80/TCP	Google dork-based remote file inclusion scanning	RFI scanner tool (Perl)

---

Exploit Integration Lag Analysis

One of the most valuable insights from this collection is the measurable time between public vulnerability disclosure and weaponization in botnet code.

Lag Time by Era

Era	Typical Lag	Example	Evidence
2001–2002 CVEs	1–2 years	UPnP (CVE-2001-0876): disclosed Dec 2001, integrated ~2004	Older vulns added retroactively when rBot codebase matured
2003 CVEs (early)	6–12 months	WebDAV (CVE-2003-0109): disclosed Mar 2003, integrated Mar 2004	Still significant delay for initial waves
2003 CVEs (late)	3–6 months	DameWare (CVE-2003-1030): disclosed Dec 2003, integrated Apr 2004	Lag shortening as exploit sharing improves
2004 CVEs	Days to weeks	LSASS (CVE-2003-0533, MS04-011): disclosed Apr 2004, integrated Apr 2004	rx_dev changelog shows near-simultaneous integration
2005 CVEs	Days to weeks	PnP (CVE-2005-1983, MS05-039): disclosed Aug 2005, weaponized immediately	Zotob worm used this within days
2006 CVEs	Weeks to months	NetAPI (CVE-2006-3439): integrated in 120-Series 2006–2007	Continued rapid adoption

Key Observations

1. Lag decreased dramatically from years (2001 CVEs) to days (2004–2005 CVEs) as the malware ecosystem matured
2. Cross-pollination accelerated integration - the DCOM exploit was shared from Agobot to rBot, documented in source comments
3. Standardized exploit frameworks (rBot's EXPLOIT structure array in advscan.cpp) made adding new exploits a matter of filling in a single array entry
4. Patch Tuesday became weaponization day - by 2005, bot authors were monitoring Microsoft Security Bulletins and integrating exploits before many organizations could deploy patches

---

Exploit Categories by Attack Surface

Network Service Exploits (Server-Side)

These exploits target running services on remote machines, enabling worm-like self-propagation:

Attack Surface	CVEs in Collection	Primary Families
RPC/DCOM (port 135)	CVE-2003-0352, CVE-2003-0715	rBot, rxBot, sdBot, Phatbot
SMB/CIFS (port 445)	CVE-2003-0533, CVE-2003-0812, CVE-2003-0818, CVE-2005-1983, CVE-2006-3439	All major families
IIS Web Server (port 80/443)	CVE-2003-0109, CVE-2003-0719	rBot, rxBot
SQL Server (port 1433)	CVE-2002-1123	rBot, rxBot, 120-Series
UPnP (port 5000)	CVE-2001-0876	rBot, rxBot
Third-party software	CVE-2003-1030 (DameWare), CVE-2006-2630 (Symantec)	rxBot, Urxbot, 120-Series

Client-Side Exploits (Browser/Document)

These exploits target end-user applications, delivered via drive-by download:

Attack Surface	CVEs in Collection	Delivery Kit
Adobe Reader (PDF)	CVE-2007-5659	Fiesta3
Internet Explorer	Multiple (modular)	IcePack, Fragus
Firefox	Multiple (modular)	IcePack
Flash Player (SWF)	Multiple	Fiesta3, my_poly_sploit
Java Runtime	Multiple (modular)	Fragus, IcePack

Credential/Configuration Exploits

These target weak or default credentials rather than software vulnerabilities:

Attack Surface	Method	Primary Specimens
Windows shares (NetBIOS)	Password dictionary (~80+ entries)	Nearly all IRC bots
Telnet (embedded devices)	Default credential lists	hydra-2008.1
VNC	Password brute-force	120-Series
MySQL	Root/weak password brute-force	120-Series
FTP	Credential brute-force	Multiple
MSSQL	SA password brute-force	rBot, 120-Series

---

Defensive Context

Patch Management Implications

The lag analysis above provides a clear lesson: the window between disclosure and weaponization shrank from years to days. By 2005, organizations that did not patch within the first week of a Microsoft Security Bulletin release were at significant risk of automated exploitation.

Vulnerability Prioritization

The exploits most widely adopted across bot families share common characteristics:

1. Remote, pre-authentication - No user interaction required
2. Common service - Target runs on most Windows installations (RPC, SMB, Workstation Service)
3. Reliable exploitation - Buffer overflows with consistent offsets across OS versions
4. Wormable - Exploit provides code execution, enabling autonomous propagation

These same prioritization criteria remain relevant for modern vulnerability management programs.

Tip

For the MITRE ATT&CK techniques enabled by these exploits, see MITRE ATT&CK Mapping. For the timeline of when each exploit entered the ecosystem, see Evolution Timeline.