Hack Forums
[MUST SEE] The RAT's Crew [ Tips 'n Tricks ] || Week #1 - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Remote Administration Tools (https://hackforums.net/forumdisplay.php?fid=114)
+---- Thread: [MUST SEE] The RAT's Crew [ Tips 'n Tricks ] || Week #1 (/showthread.php?tid=1326112)

Pages: Pages 1 2 3 4 5 6 7 8 9 10 11 12 13 14

[MUST SEE] The RAT's Crew [ Tips 'n Tricks ] || Week #1 - KillαMuvz - May 27, 2011

[img]http://dl.dropbox.com/u/19745684/Tips%20and%20Tricks%20RATS.png[/img]

IF YOU ARE READING THIS PLEASE READ MY SIGNATURE!

Hello fellow HF members, I'm here to present you a brand new , noob-friendly, weekly guide. I'm here representing The RAT's Crew, and for next weeks will be covering multiple subjects on R.A.T.ing and all that it involves. This will not be some regular thread. We will provide extensively detailed information on every subject.



  • For our first week we are going to cover the basis of R.A.Ting which is:


    • Simple explanation on what R.A.T's are and what they do.

    • List of RAT's + Download link.

    • Choosing the RAT that suits the readers.

      • Pointing out the pros and cons.



    • How to Port-Forward.

      • Extensive version. Multiple known and private methods.







What's a R.A.T.?


First of all, R.A.T stands for Remote Administration Tool.
In an illegal way [as in without permission] they are used to connect and control one or multiple computers at a time, whatever their locations are.
[There are also LEGAL R.A.T.'s that you might have heard of like: TeamViewer, UltraVNC , Etc.]

In order to infect a computer he will need to run a specific executable, your server. Meaning you'll have to SPREAD it. (There are multiple techniques, in the next week we will be covering that and will let you know the best public and private methods.(
You can build your server.exe inside your R.A.T.

What can I do once I sucessfully install my server on some one's computer?

Well, here is what every basic R.A.T. should be able to do:
(If yours do not have some of these options, don't use/buy it.)
  • File management: Move, Browse, Download, Upload, Run, Replace, Rename, Delete.

  • Windows/Processes Control: Start, End, Pause.

  • Remote Desktop.

  • Webcam and ScreenShots Capture.

  • Get system informations: Such as OS, RAM, CPU, A-V Brand, PC's name, location.

  • Control Keyboard and Mouse.

  • Control Web Browser: Open page, Change HomePage, Re-Direct.



Ok, but how do they connect?

Well as they are used illegaly in this case, they'll need to work in a special way in order to stay unnoticed.
To acomplish such your server will connect itself using Reverse Connection, that bypasses both Router and Windows Firewall security restrictions. Meaning, after they are infected, your victims will connect to your client, as the router doesn't control outgoing traffic it will be unnoticed.
You can read more about it HERE.
Here's a simple image that might clear your mind.

[img=400x150]http://dl.dropbox.com/u/19745684/reverseconn.JPG[/img]


But specifying a bit.
There are 2 types of R.A.T's. Ones using Ports, such as TCP Sockets and UDP Sockets, and others that DO NOT require port to be open, PHP.

Some say UDP (User Datagram Protocol) is "safer" for the Hacker side, as it doesn't require any "handshaking", meaning it doesn't need to stablish a connection, it might be a bit hard to understand but it's easier than it looks. Using UDP ports the client will only send a Data Request and the server will then send a Data Response. I'll latter on this thread provide an image where you can see how it works and the difference between TCP and UDP.

R.A.T's that connect using a TCP (Transmition Control Protocol) initiate themselves with a "3-way handshake". (Firstly you'll need an open TCP Port on your Router.. We will let you know how to open ports latter in this TuT.) Meaning:
  • First a SYN packet will be sent to the server once the .exe is ran.

  • Secondly a SYN/ACK packet.

  • Third and last, a ACK packet is returned to the client. Once this ACK packet goes through the TCP port the connection is considered STABLISHED.


Once the connection is stablished data can be transfered freely.
Here's two images. The first is a squeme of the TCP connection.
On the second one you can see the difference between UDP and TCP, and what it involves.
[img]http://dl.dropbox.com/u/19745684/TCP_UDP.png[/img]


Here are some R.A.T.s Sources for you to study if you want to learn more about how they work:
Sources:
Spoiler (Click to View)

Now the PHP R.A.T.s are even easier to understand.
First of all you'll need to host your PHP files. You can use some free hosting websites, google them and they will show up.
It does simply THREE things:
  • Once the server is executed all the information will be added to the active users list you just hosted, which your client will read.

  • A new connection on your client will appear.

  • Now you can send a command. It will be in a form of a string. The server will check every 5 secs to see if you have sent any command. If a command was sent then it will download the string, which was sent your hosted files, then will divide it by arrays and check if the command was sent to this particular server, by confirming the username + OS + other things. If not that string will be simply ignored and the log will be dumped. IF yes then it will execute the said command.
    (Not sure if every PHP RATs checks every 5secs. At least mine does.)







Now to what's needed.

How to Setup + PortForward


Things you'll need:
  • Attention.

  • A little amount of brains.



  • STEP ONE: NO-IP DNS
    (Pics are self-explanatory.)

    Spoiler (Click to View)




  • STEP TWO: PortForwarding.
    Using a D-Link Router.Spoiler (Click to View)





In order to check IF your Ports are indeed OPEN download this: PFPortCheck Program
(To read more about the program visit here)
Then enter your desired port and test.
Make sure you HAVE your FIREWALL DISABLED, otherwise it could conflict with the programm.
Don't use canyouseeme.com, I've tried it many times and always failed to really check. Yet with that other program I successfuly checked.
ALSO, if your router has it enabled, DISABLE Block Random Ping Request



  • TIPS:
    • Using other Routers you should mainly look out for the following:
      • Port Mapping

      • Virtual Servers

      • Games & Applications

      • Port Forwarding





  • Open more than one port. Why? Well, some times you may infect someone you consider a V.I.P, therefore you DO NOT want to lose the connection. Explaining it simple: Once building your server.exe you'll have to choose a port on which it will stablish connection. You might know start thinking on using TWO R.A.T.'s at a time. Build the other server.exe with the other open port you got yourself a double connection :3 You can use as many R.A.T's at the same time as you want.
    (You can't, if you can it is not recommended to, use the same ports for two different programs)


  • TRICKS:
    • IF your Router enabled uPnP (Plug 'n Play) some R.A.T.s/Programs can automaticaly open ports. Example: Albertino Advanced R.A.T.; uTorrent [Open your uTorrent Client>Option>Preferences>Connection> Tick "Enable UPnP port mapping > in "Port Used for incoming connections:" type the port your want to open> voilá it's open!]

    • Routers, some times, can be a true pain in the arse right? Well for months I've had problems with mine (a Thomson TG784), couldn't get it to open ports, and after a lot of hard thinking I've figured something out:
      • IF there are already some default Games or Applications you can asign to your network device and they DO work, what if I just re-configure those Applications and re-choose the ports I want OPEN?
        Well I tried it and it WORKED.
        So in those kinky Thomsons you should do this:
        • Toolbox > Game & Application Sharing > On the bottom you'll see "Pick a task..". Choose the last option which is: Modify a game or application > pick a RANDOM application and click EDIT. > DELETE the existing port options and create new ones > Now again look at the bottom click "Assign a game or application to a local network device" > Now chose the application you modded, activate it and DONE!

        • This should work with all Routers.



      • There are also plenty of programs made to open the ports for you. An example is: Simple Port Forwarding. You can find a TuT on using it HERE








I will not cover how to "Setup" your R.A.T.s. Well to be honest the main reason is that you require no trick to set it all up. There's nothing as simple as inserting your no-ip address, typing the open ports and building you server. And there's TO many different R.A.T.s for me to post all their ways to setup.
Maybe next week. Who knows?
Oh and... You might be thinking: OHMAGAD, there's almost nothing to know about RAT's than what has just been posted.
You're wrong sir. Expect us next week to suprise you once more.


Thus ends our first week edition of: The RAT's Crew - Tips 'n Tricks.

My goal is to instruct every single HackForums member abot every single aspect of a R.A.T. and the art of RATing.
I hope you guys have enjoyed it.
Thanks for taking time to read it.

CREDITS


Untill next week.
Regards,
KillaMuvZ
The RATs Crew.


* - sh4rkbyt3 - May 27, 2011

Nice tut , will use it , maybe you can post a crypter , I'm in need of it .


* - Gook - May 27, 2011

Wow nice, Realy nice!

Thanks.
oNeiL

* - Quiet. - May 27, 2011

Just going to point a quick something out.

The RATS crew captain is not wearing the userbar?

* - ZeKiiTo - May 27, 2011

Realy nice THANKS
The best Crew ;D


* - pac - May 27, 2011

I would rep you, if i could... This is the truly best tutorial ive ever seen on hack forums

* - Blixx - May 27, 2011

Another great tutorial you made Bro. I vouch for you:D

* - Tartarus. - May 27, 2011

This is a really good detailed tutorial. Especially for the beginners.


* - KillαMuvz - May 27, 2011

(May 27, 2011 12:35 PM)Quiet Wrote:  Just going to point a quick something out.

The RATS crew captain is not wearing the userbar?

Thanks for noticing me, I really didn't remember changing it back to uber<3

(May 27, 2011 12:29 PM)sh4rkbyt3 Wrote:  Nice tut , will use it , maybe you can post a crypter , I'm in need of it .

This is for you : https://hackforums.net/showthread.php?tid=1301686

* - LeBron James™ - May 27, 2011

Wowowow verny nice informative thread!

* - LeBron James™ - May 27, 2011

Wowowow verny nice informative thread!

* - KillαMuvz - May 27, 2011

(May 27, 2011 12:45 PM)LeBron James™ Wrote:  Wowowow verny nice informative thread!

You're welcome, expect a better thread next week!

* - F4T4L 3RR0R - May 27, 2011

I love this idea, but all RAT clients are legal. It really depends on how you use them.

Remote Access Trojan = Illegal

Remote Administration Tool = Legal :)

* - KillαMuvz - May 27, 2011

(May 27, 2011 12:59 PM)The Russian Wrote:  I love this idea, but all RAT clients are legal. It really depends on how you use them.

Remote Access Trojan = Illegal

Remote Administration Tool = Legal :)

You got a point, I'll make it clearer.

Well I have it already cleared out: "In an illegal way [as in without permission]"

* - F4T4L 3RR0R - May 27, 2011

(May 27, 2011 01:07 PM)KillαMuvz Wrote:  You got a point, I'll make it clearer.

Well I have it already cleared out: "In an illegal way [as in without permission]"

:) Can't wait for these weekly threads!

Good work RATs Crew.