Hack Forums
Tutorial | How To Test Your RAT | Sandboxie/Anubis | 2 methods - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Remote Administration Tools (https://hackforums.net/forumdisplay.php?fid=114)
+---- Thread: Tutorial | How To Test Your RAT | Sandboxie/Anubis | 2 methods (/showthread.php?tid=3265218)

Pages: Pages 1 2 3 4

Tutorial | How To Test Your RAT | Sandboxie/Anubis | 2 methods - Phoeni✘ - Feb 17, 2013

So recently I saw a h3ll lot of guys making thread asking for a test install in order to check the working for their RAT,
I would like to show you how you can test you RAT on yourself Using "Sandboxie" and Anubis.


NOTE: I am assuming that you already know how to set-up a RAT that includes Port-Forwarding etc

Method 1: (Sandboxie):

Introducing Sandboxie


[img]http://www.freakitude.com/images/2007/sandboxie-logo.png[/img]


Sandboxie runs your programs in an isolated space which prevents them from making permanent changes to other programs and data in your computer.

[img]http://www.sandboxie.com/img/FrontPage/FrontPageAnimation.gif[/img]


[img]http://www.sandboxie.com/img/FrontPage/FrontPageLegend.png[/img]


The red arrows indicate changes flowing from a running program into your computer. The box labeled Hard disk (no sandbox) shows changes by a program running normally. The box labeled Hard disk (with sandbox) shows changes by a program running under Sandboxie. The animation illustrates that Sandboxie is able to intercept the changes and isolate them within a sandbox, depicted as a yellow rectangle. It also illustrates that grouping the changes together makes it easy to delete all of them at once.

Step 1.
Download Sandboxie from HERE

Spoiler (Click to View)

Step 2.
While creating a stub from you RAT client use 127.0.0.1 (this is your computer's personal IP ) Instead of your No-Ip Host.

NOTE:IF your Router support NAT LOOPBACK then you can use No-Ip


Spoiler (Click to View)

Step3.
Edit the required settings then build the stub,

Step 4.
Right click on your Stub.
Click "Run Sandboxed".

Step 5.
You will know if your server is working without harming your machine.
Spoiler (Click to View)

When you don't show up when you test it on yourself then you're probably using your external address when testing, (Eg, your WAN IP, or your No-ip DNS) and most likely your router/gateway/modem doesn't have NAT loopback support. Nothing to worry about, just when you test within your network use internal addresses, (eg, if your testing on the computer that is running the client use 127.0.0.1, if you're testing within your network on a different computer use the address of the computer hosting the client).

Then you are Good to go, again make the Stub from you rat client, this time using your "No-Ip" Host, and get them slaves 👍



Method 2: (Anubis):

[Image: 2UqV0.png]


Note: This method will also work if your router doesn't support NAT loopback.
Important : DO NOT UPLOAD CRYPTED SERVERS ON ANUBIS, Because it distributes samples, and most of the times crypted server doesn't work

[b]Step 1.:
Make a stub using No-Ip host from your RAT client.

Step 2.
Visit this site http://anubis.iseclab.org/

Step 3.
Follow the steps given in the picture below
[Image: 2Ur6B.jpg]

Step 4. Wait for Anubis to complete the Analysis.

Step 5. If you get a random/unknown slave on your RAT client, then your rat is working just Fine. Congratulations.

Tip: Now when you Crypt your rat for spreading, add "Startup" function only from the Crypter.

Regards,

note :This Tutorial is for Educational Purposes only, use the information at your own risk! I am not responsible if you use this knowledge for unethical purposes.

* - Revcode - Feb 17, 2013

Nice and very helpful tutorial. Great job!

* - Phoeni✘ - Feb 17, 2013

(Feb 17, 2013 04:22 AM)jebemtihljeb Wrote:  Nice and very helpful tutorial. Great job!

thanks :)
I hope this helps people who are desperate to test their RAT

* - Snoopy - Feb 17, 2013

I tried this and still fail to show up in my client, any help?

* - Phoeni✘ - Feb 17, 2013

(Feb 17, 2013 04:50 AM)tahir. Wrote:  I tried this and still fail to show up in my client, any help?

yes sure, what error are you getting while running your server under sandboxie ?

* - 1CE™ - Feb 17, 2013

good tutorial dear..you look, when i check my ports, all of my ports including 80 is always closed..when i did your tutorial, i get myself as slave..so does this mean if i infect others, i will get them as my slaves even though canyouseeme.org shows that my ports are closed?

* - Phoeni✘ - Feb 17, 2013

(Feb 17, 2013 04:56 AM)1CE.CODER Wrote:  good tutorial dear..you look, when i check my ports, all of my ports including 80 is always closed..when i did your tutorial, i get myself as slave..so does this mean if i infect others, i will get them as my slaves even though canyouseeme.org shows that my ports are closed?

If you can't see your Ports Opened on "canyouseeme.org" you won't be able to get slaves mate,

Quote: NOTE: I am assuming that you already know how to set-up a RAT that includes Port-Forwarding etc

😊

* - Snoopy - Feb 17, 2013

(Feb 17, 2013 04:55 AM)Phoeni✘ Wrote:  yes sure, what error are you getting while running your server under sandboxie ?

I run the server in Sandbox and I get the error message that is supposed to show up, then the AVG detection shows up but I don't remove the threat yet. And then the Sandbox recover file thing shows up.

* - 1CE™ - Feb 17, 2013

(Feb 17, 2013 04:59 AM)Phoeni✘ Wrote:  If you can't see your Ports Opened on "canyouseeme.org" you won't be able to get slaves mate,

😊
yup i know all that..the weird thing is when i did your tutorial, i checked my port on canyouseme and it says closed..but i still get myself as slave..weird huh?
the most weird thing is port 80 must always be open to have access http(internet), but my port 80 is always closed, yet now i am using internet and replying to your quote..:)

* - Phoeni✘ - Feb 17, 2013

Quote: I run the server in Sandbox and I get the error message that is supposed to show up, then the AVG detection shows up but I don't remove the threat yet. And then the Sandbox recover file thing shows up.


Try disabling you AV
and if it still doesn't work try running sandboxie as an Administrator

(Feb 17, 2013 05:02 AM)1CE.CODER Wrote:  yup i know all that..the weird thing is when i did your tutorial, i checked my port on canyouseme and it says closed..but i still get myself as slave..weird huh?
the most weird thing is port 80 must always be open to have access http(internet), but my port 80 is always closed, yet now i am using internet and replying with your quote..:)

Yes, the firewall/AV of your PC may be blocking the ports,
or it may be closed because you may be using 2 routers,

* - Snoopy - Feb 17, 2013

(Feb 17, 2013 05:05 AM)Phoeni✘ Wrote:  Try disabling you AV
and if it still doesn't work try running sandboxie as an Administrator

Yes, the firewall/AV of your PC may be blocking the ports,
or it may be closed because you may be using 2 routers,

OK, I ran it with UAC and AVG disabled and I appeared in my client but I got this.

[Image: 430bb5c8bf8459a06035d3956f1f634d.png]

I think that means it didn't run on Sandbox?

* - #Skyline - Feb 17, 2013

Ok what if your router doesn't support NAT loopback. What happens then?

* - Phoeni✘ - Feb 17, 2013

(Feb 17, 2013 05:17 AM)#Skyline Wrote:  Ok what if your router doesn't support NAT loopback. What happens then?

If a router supports NAT loopback then running the server with sandboxy on your machine with No-Ip would work
but if the router doesn't support that 127.0.0.1 will always work 😉

(Feb 17, 2013 05:15 AM)tahir. Wrote:  OK, I ran it with UAC and AVG disabled and I appeared in my client but I got this.

[Image: 430bb5c8bf8459a06035d3956f1f634d.png]

I think that means it didn't run on Sandbox?
Ya I think it wasn't running on sandboxy

* - 1CE™ - Feb 17, 2013

(Feb 17, 2013 05:05 AM)Phoeni✘ Wrote:  Try disabling you AV
and if it still doesn't work try running sandboxie as an Administrator

Yes, the firewall/AV of your PC may be blocking the ports,
or it may be closed because you may be using 2 routers,

okay..final question, if let say i use 82 as port, when i tested on sandbox and it works on myself, so if i infect others by changing 127.0.0.1 to no-ip, will i get some slaves for sure?

* - Phoeni✘ - Feb 17, 2013

(Feb 17, 2013 05:23 AM)1CE.CODER Wrote:  okay..final question, if let say i use 82 as port, when i tested on sandbox and it works on myself, so if i infect others by changing 127.0.0.1 to no-ip, will i get some slaves for sure?
127.0.0.1 is internal IP of any PC,
but to have external connections one must have specific ports opened
if you can't see ports open in canyouseeme.org you won't be able to get connections from your slaves.