DamaneDz Config Grabber

DamaneDz Config Grabber is a 12 KB specialized post-compromise tool from the Algerian underground scene, watermarked “MaDe in AlGeria 2013.” It ships with zero authentication — no password, no session check, no access control. Anyone who reaches the URL has full access to the grabber’s functions.

Capabilities

The core function is a symlink-based config harvester targeting approximately 120 well-known CMS and billing platform configuration paths. The list covers WordPress, Joomla, WHMCS, vBulletin, Drupal, osCommerce, ZenCart, SMF, HostBills, and dozens of other platforms. For each path, the tool creates a symbolic link from the output directory to the target config file. On shared hosting where open_basedir would normally prevent cross-account reads, the symlink approach bypasses that restriction — the web server follows the symlink at the filesystem level, below PHP’s access control layer. A single compromised account yields database credentials, API keys, and admin passwords for every neighboring tenant that runs any of the targeted platforms.

The tool’s operating sequence is methodical. On execution, it creates an output directory with a hardcoded name, then drops a permissive .htaccess file inside that overrides whatever server-level access controls might be in place. This ensures the harvested config files are readable via HTTP regardless of the hosting provider’s default restrictions. The output directory name is a self-incriminating watermark — it uniquely identifies this tool family across any server it touches.

Unlike cpanel_cracker (which adds system-level enumeration via /etc/passwd and /etc/named.conf), DamaneDz stays purely at the application layer. No author email beacon, no phone-home, no external dependencies — the tool is entirely self-contained. The self-incriminating artifacts are limited to the page title, footer watermark, and the hardcoded output directory name.

Vulnerabilities

Detection Surface

File-system indicators

HTTP access-log indicators

YARA rule

rule tool_damanedz_grabber {
    meta:
        description = "DamaneDz Config Grabber — symlink credential harvester"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/damanedz-grabber/"
        status      = "validated"

    strings:
        $damanedz   = "DamaneDz" ascii nocase
        $algeria    = "AlGeria" ascii nocase
        $x00x_dir   = "x00x_configs" ascii
        $x00x_title = "x00x Config" ascii
        $symlink    = "symlink(" ascii
        $htaccess   = ".htaccess" ascii
        $follow     = "FollowSymLinks" ascii
        $satisfy    = "Satisfy Any" ascii

    condition:
        filesize < 20KB
        and (
            ($damanedz or $x00x_dir or $x00x_title or $algeria)
            or ($symlink and $htaccess and ($follow or $satisfy))
        )
}

MITRE ATT&CK

OHIIHO Threat Research.