+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: Darkcomet Rat issue (/showthread.php?tid=3991887)
Darkcomet Rat issue - spawn303 - Jan 12, 2014
Hi All.
I used an crypted version of DarkComet RAT (I crypted it with and crypter I bought here). However I have the issue that my "victim" dont show.
I know the RAT is installed
I have forwarded port 1604 in victims router
I have done the same in my router
I have the no-ip DUC running and testet with canyouseeme.org
He still dont tick in, I'm sure it's not the RAT or crypter coz earlier I installed an hidden FTP server on his PC, I know it's allowed in his firewall
but after reboot it's nit running anymore.
He uses Avast for protecting his PC, I have the feeling that AVAST catches the startup and unathoirized connections, coz it keeps failing when I try to RAT his PC.
Im very sure the port farwarding is working okay.
Is there an other bulletproff RAT I can use instead?
Or does anyone has some experince with Avast?
* - Circle - Jan 12, 2014
Uhm I never seen this before man all my slaves / bots always work an like half of them use Avast.
* - Trending - Jan 12, 2014
While building your server, did you make sure to turn off all options? Also, did you make sure to enable start up and persistence on the CRYPTER when crypting the file?
If so, then the most likely issue (since it looks like you can see the slave online prior to a restart) is that Avast is finding and deleting your server and this would mean that your crypter is not FUD.
If you need further help, please feel free to PM me and I will be happy to help you over TV.
* - РlayStation - Jan 12, 2014
As above said, you cannot have any options enabled when creating your server - as it will corrupt it when you crypt it.
All you should do is put in your No-IP and Port & Build the server as UPX.
Then crypt it using the correct settings, Let me know if this works.
(Jan 12, 2014 05:32 AM)spawn303 Wrote: Hi All.
I used an crypted version of DarkComet RAT (I crypted it with and crypter I bought here). However I have the issue that my "victim" dont show.
I know the RAT is installed
I have forwarded port 1604 in victims router
I have done the same in my router
I have the no-ip DUC running and testet with canyouseeme.org
He still dont tick in, I'm sure it's not the RAT or crypter coz earlier I installed an hidden FTP server on his PC, I know it's allowed in his firewall
but after reboot it's nit running anymore.
He uses Avast for protecting his PC, I have the feeling that AVAST catches the startup and unathoirized connections, coz it keeps failing when I try to RAT his PC.
Im very sure the port farwarding is working okay.
Is there an other bulletproff RAT I can use instead?
Or does anyone has some experince with Avast?
* - spawn303 - Jan 12, 2014
I went over the settings again, Im sure I did it right.
The crypter handles all the persistence and startup, I left all this out in DC.
I'm 110% sure the port forwarding works - There must be something on target PC other than Avast then that blocks it.
I tested with avast just now on my test laptop, it sure is FUD, no problem there.
The more I test , the more sure am I that the RAT is fine and so is the crypter, coz I tried before to sneak in an FTP server
and that one got blocked too after he rebooted.
it's a windows 7 PC 64 bit, for what I know installed with Avast and stadard windows firewall.
it shouldnt be rocketscience - so that's why I'm sure there must be something else on that PC blocking
Is there a better RAT for the job ?