SharpCovertTube is a program created to control Windows systems remotely by uploading videos to Youtube. The program monitors a Youtube channel until a video is uploaded, decodes the QR code from the thumbnail of the uploaded video and executes a command. The QR codes in the videos can use cleartext or AES-encrypted values. It has two versions, binary and service binary, and it includes a Python script to generate the malicious videos. Its purpose is to serve as a persistence method using only web requests to the Google API. Usage Run the listener in your Windows system: It will check the Youtube channel every a specific amount of time (10 minutes by default) until a new video is uploaded. In this case, we upload "whoami.avi" from the folder example-videos: After finding there is a new video in the channel, it decodes the QR code from the video thumbnail, executes the command and the response is base64-encoded and exfiltrated using DNS: This works also for QR codes with AES-encrypted payloads and longer command responses. In this example, the file "dirtemp_aes.avi" from example-videos is uploaded and the content of c:temp is exfiltrated using several DNS queries: Logging to a file is optional but you must check the folder for that file exists in the system, the default value is "c:temp.sharpcoverttube.log". DNS exfiltration is also optional and can be tested using Burp's collaborator: As an alternative, I created this repository with scripts to monitor and parse…Read More
SharpCovertTube – Youtube As Covert-Channel – Control Windows Systems Remotely And Execute Commands By Uploading Videos To Youtube
