+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C#] SimpleRAT [FUD OUTPUT] (/showthread.php?tid=4078860)
SimpleRAT [FUD OUTPUT] - Tostig - Feb 23, 2014
GIVE CREDITS TO MERCURY IF YOU USE IT! I DID NOT MAKE THIS!
Features:
Almost FUD Server
7KB Server
Open Webpage
Send Messagebox
Insta-connect
Stable
Screenshot:
![[Image: 23b98143f517de7d305668d931214cad.png]](https://gyazo.com/23b98143f517de7d305668d931214cad.png)
![[Image: a8734d27518e67d30c08ceeec8eaf2a7.png]](https://gyazo.com/a8734d27518e67d30c08ceeec8eaf2a7.png)
Scans:
CLIENT SCAN
File Name: SimpleRAT.exe
File Size: 26.5 KB
Scan Date: 2014-02-23
Scan Result: 0/34
MD5: a761d7f410fe942eb9f55aaaf88a0f1e
Verified By NoDistribute: http://NoDistribute.com/result/jsReQ0AmCGvZMKzh
AVG Free: Clean
ArcaVir: Clean
Avast: Clean
AntiVir (Avira): Clean
BitDefender: Clean
VirusBuster Internet Security: Clean
Clam Antivirus: Clean
COMODO Internet Security: Clean
Dr.Web: Clean
eTrust-Vet: Clean
F-PROT Antivirus: Clean
F-Secure Internet Security: Clean
G Data: Clean
IKARUS Security: Clean
Kaspersky Antivirus: Clean
McAfee: Clean
MS Security Essentials: Clean
ESET NOD32: Clean
Norman: Clean
Norton Antivirus: Clean
Panda Security: Clean
A-Squared: Clean
Quick Heal Antivirus: Clean
Solo Antivirus: Clean
Sophos: Clean
Trend Micro Internet Security: Clean
VBA32 Antivirus: Clean
Zoner AntiVirus: Clean
Ad-Aware: Clean
BullGuard: Clean
Immunet Antivirus: Clean
K7 Ultimate: Clean
Panda CommandLine: Clean
VIPRE: Clean
SERVER SCAN
File Name: server.exe
File Size: 7 KB
Scan Date: 2014-02-23
Scan Result: 1/34
MD5: cc6e7c0270a307d24b0f8486811ca465
Verified By NoDistribute: http://NoDistribute.com/result/tO0y1dgiNKGF
AVG Free:Trojan horse Dropper.Msil.M
ArcaVir: Clean
Avast: Clean
AntiVir (Avira): Clean
BitDefender: Clean
VirusBuster Internet Security: Clean
Clam Antivirus: Clean
COMODO Internet Security: Clean
Dr.Web: Clean
eTrust-Vet: Clean
F-PROT Antivirus: Clean
F-Secure Internet Security: Clean
G Data: Clean
IKARUS Security: Clean
Kaspersky Antivirus: Clean
McAfee: Clean
MS Security Essentials: Clean
ESET NOD32: Clean
Norman: Clean
Norton Antivirus: Clean
Panda Security: Clean
A-Squared: Clean
Quick Heal Antivirus: Clean
Solo Antivirus: Clean
Sophos: Clean
Trend Micro Internet Security: Clean
VBA32 Antivirus: Clean
Zoner AntiVirus: Clean
Ad-Aware: Clean
BullGuard: Clean
Immunet Antivirus: Clean
K7 Ultimate: Clean
Panda CommandLine: Clean
VIPRE: Clean
Download: http://www.mediafire.com/download/eurnghhdg7r1eoo/SimpleRAT.rar
* - Light Yagami - Feb 23, 2014
wow sick!
I haven't looked enough in to encryptions...
let me have a look now once and for all :)!
* - Tostig - Feb 23, 2014
(Feb 23, 2014 02:08 PM)EquivalentExchange Wrote: wow sick!
I haven't looked enough in to encryptions...
let me have a look now once and for all :)!
http://crypo.in.ua/tools/
Use that to decrypt.
* - Light Yagami - Feb 23, 2014
(Feb 23, 2014 02:09 PM)YouHackIt Wrote: http://crypo.in.ua/tools/
Use that to decrypt.
Thanks a lot!
I'll have a look
Peace out
DONE !!
That was freaking awesome, thanks a lot mate, I'll use this 100% for sure, might adjust it a bit :)
* - Vuln - Feb 23, 2014
Took a quick look at the source.
You really shouldn't send encoded delimited string commands. It's slow and messy when you're going to add more features. Send integers (ushort's prolly) as command ID's instead. You shouldn't use fixed-size buffers either. Oh, and it's "almost FUD" because it doesn't do anything harmful :)
Nice basic example though. Good job.
(Feb 23, 2014 02:12 PM)EquivalentExchange Wrote: ...might adjust it a bit :)
You'd better... enough C&P RATs around already :P
* - Tostig - Feb 23, 2014
(Feb 23, 2014 03:39 PM)[He]isenberg Wrote: Took a quick look at the source.
You really shouldn't send encoded delimited string commands. It's slow and messy when you're going to add more features. Send integers (ushort's prolly) as command ID's instead. You shouldn't use fixed-size buffers either. Oh, and it's "almost FUD" because it doesn't do anything harmful :)
Nice basic example though. Good job.
Thanks for the feedback, trade me some blue for a really good source?
* - Vuln - Feb 23, 2014
(Feb 23, 2014 03:40 PM)YouHackIt Wrote: Thanks for the feedback, trade me some blue for a really good source?
I use blue food coloring... don't tell anyone. Anyway, you might enjoy some of xSilent's tutorials, either on HF or on his YouTube channel: http://www.youtube.com/user/xSilentCoding/videos
* - NETExplorer - Feb 23, 2014
(Feb 23, 2014 03:39 PM)[He]isenberg Wrote: Took a quick look at the source.
You really shouldn't send encoded delimited string commands. It's slow and messy when you're going to add more features. Send integers (ushort's prolly) as command ID's instead. You shouldn't use fixed-size buffers either. Oh, and it's "almost FUD" because it doesn't do anything harmful :)
Nice basic example though. Good job.
You'd better... enough C&P RATs around already :P
Don't pass int's for command ids, just serialize your data (in this case I would use an array)
Also, using int's to represent some sort of value (as in: 0 = Open MessageBox, 1 = Open CMD) is a bad practice. You should use enums whenever you can in situations like above
* - Dark_Noodles - Feb 23, 2014
This looks a bit similar to this RAT, doesn't it?
http://www.ubers.org/Thread-Release-Source-Simple-Remote-Administration-Tool
EDIT: Seems like the Ubers website doesn't work. Replace HackForums.net with Ubers.org
* - Tostig - Feb 23, 2014
(Feb 23, 2014 06:34 PM)Dark_Noodles Wrote: This looks a bit similar to this RAT, doesn't it?
https://hackforums.net/Thread-Release-Source-Simple-Remote-Administration-Tool
EDIT: Seems like the Ubers website doesn't work. Replace HackForums.net with hackforums.net
I can't see the screenshots. I made this today.
* - iVision - Feb 24, 2014
(Feb 23, 2014 06:17 PM)PatPositron Wrote: Don't pass int's for command ids, just serialize your data (in this case I would use an array)
Also, using int's to represent some sort of value (as in: 0 = Open MessageBox, 1 = Open CMD) is a bad practice. You should use enums whenever you can in situations like above
That is serializing? Although an integer is overdoing it for a packet id, I use a byte. But yes structure your things in packets so easier to modify, read, use, understand (OOP)
If you have no idea:
Spoiler (Click to View)
* - Vuln - Feb 24, 2014
(Feb 23, 2014 06:17 PM)PatPositron Wrote: Don't pass int's for command ids, just serialize your data (in this case I would use an array)
I didn't mention binary serialization as it looks like it was meant to be a simple example, but anyway, how does serializing your data not require a packet identifier anymore?
(Feb 23, 2014 06:17 PM)PatPositron Wrote: Also, using int's to represent some sort of value (as in: 0 = Open MessageBox, 1 = Open CMD) is a bad practice. You should use enums whenever you can in situations like above
OOP is always a good idea, but I'm not following you here either. You do realise the default underlying type of enum is Int32 right? Hence I suggested to use a smaller integral type like ushort. Or byte like iVision mentioned, which would be perfect for a simple example like this.
* - Vuln - Feb 24, 2014
(Feb 24, 2014 03:54 AM)Visual Basic. Wrote: I'm pretty sure enums are compatible with char, a signed integer type, or an unsigned integer type.
It can be of any integral type (which is what I meant) except from char, but Int32 is its default type.
* - Vuln - Feb 24, 2014
(Feb 24, 2014 04:49 AM)Visual Basic. Wrote: Well yeah that is true, So you will be doing the same as with an INT but more organized.
I didn't disagree with the use of enums, it's what I would do too. I just don't understand why he said I was wrong and was talking about int's for some reason. And whether or not you're using enums, you're still going to send the same data type... which is the only thing I was suggesting in the first place. I never said anything about code organization.
* - ident - Feb 24, 2014
with out the pointless im cool crypted url http://www.filedropper.com/showdownload.php/simplerat
static int RemotePort = int.Parse("1997");
Interesting approach ...