Source: amazon-inspector (ebce016051a9e9cb604067185042ce49c7426aa1ac01aa606e430c4d1120eec7)
Package implements a Telegram-bot-driven remote administration tool that gives whoever holds the configured bot token full control of the installer's host. A polling loop calls the Telegram getUpdates API and dispatches received messages as shell commands through subprocess.run (SystemAnalyzer.execute_analysis), exposing a documented run command to execute arbitrary system commands. Additional handlers (findbot/getallbots) walk the filesystem (/, /home, /root, /etc, /var/www, /opt, /usr/local, /tmp, Windows drive roots and user profile directories), read.py/.json/.conf/.cfg/.env/.ini files, and regex-extract third-party Telegram bot tokens (BOT_TOKEN, API_TOKEN, TELEGRAM_TOKEN, [0-9]+:[A-Za-z0-9_-]+), returning them to the remote operator. File and credential exfiltration handlers (getfile, getdir, findget, getsystem, getconfig, getpasswords, getsshkeys, rdpall) read arbitrary installer paths — including SSH keys and stored credentials — and upload them to the operator's Telegram chat via requests.post to api.telegram.org sendDocument. The package advertises itself as a 'Complete VPS Control System' with 168+ admin commands including user creation and firewall modification.
Credit: OpenSSF (source)
References
Source: amazon-inspector (ebce016051a9e9cb604067185042ce49c7426aa1ac01aa606e430c4d1120eec7)
Package implements a Telegram-bot-driven remote administration tool that gives whoever holds the configured bot token full control of the installer's host. A polling loop calls the Telegram getUpdates API and dispatches received messages as shell commands through subprocess.run (SystemAnalyzer.execute_analysis), exposing a documented
runcommand to execute arbitrary system commands. Additional handlers (findbot/getallbots) walk the filesystem (/,/home,/root,/etc,/var/www,/opt,/usr/local,/tmp, Windows drive roots and user profile directories), read.py/.json/.conf/.cfg/.env/.ini files, and regex-extract third-party Telegram bot tokens (BOT_TOKEN,API_TOKEN,TELEGRAM_TOKEN,[0-9]+:[A-Za-z0-9_-]+), returning them to the remote operator. File and credential exfiltration handlers (getfile,getdir,findget,getsystem,getconfig,getpasswords,getsshkeys,rdpall) read arbitrary installer paths — including SSH keys and stored credentials — and upload them to the operator's Telegram chat via requests.post to api.telegram.org sendDocument. The package advertises itself as a 'Complete VPS Control System' with 168+ admin commands including user creation and firewall modification.Credit: OpenSSF (source)
References