+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Remote Administration Tools (https://hackforums.net/forumdisplay.php?fid=114)
+---- Thread: Whats the difference between a server on a clients pc vs client on client pc ? (/showthread.php?tid=5491354)
Whats the difference between a server on a clients pc vs client on client pc ? - DaftHacker - Dec 11, 2016
What is the difference between a person having the server socket and you have the client socket for your controller application compared to a person having the client socket and you having the server socket for your controller program. Can anyone tell me the difference ?
* - Viska - Dec 11, 2016
(Dec 11, 2016 08:09 PM)DaftHacker Wrote: I'm trying to learn more about rats and im in the process of building my own and i never understood what rats meant by build server because i always thought the client was running your rats client. Can anyone tell me the difference ?
Server is what your clients connect to. Without a server your clients would have nothing to send and receive signals from ultimately making the RAT useless.
* - DaftHacker - Dec 11, 2016
(Dec 11, 2016 08:18 PM)raider_pride179 Wrote: Server is what your clients connect to. Without a server your clients would have nothing to send and receive signals from ultimately making the RAT useless.I don't think you really know what i'm asking, maybe i should have worded it more technically. I'm asking what is the difference between a person having the server socket and you have the client socket for your controller application compared to a person having the client socket and you having the server socket for your controller program.
* - Kisame - Dec 12, 2016
When you use a RAT, you have an interface on your own PC. This is where you can see all the people that are running your RAT in the background.
The one who is infected with the RAT will probably not notice this and it will run in the background silently sending data. We call this one the >client<
The one who spread the RAT and has total control over the computers of the infected clients by using a RAT with a GUI is what we call the >server<.
Some people call the file which gets created by the RAT-user a ''server''. Others call is a stub, a bin, binary, virus, trojan, executable, .exe, etc.
So the thing confusing you is that people call the generated .exe which is made with the purpose of infecting people a ''server'', and call the thing running on the RAT spreaders' PC also a ''server''.
Just call the thing you send to others the 'stub' and the thing running on your own pc to monitor 'server'. Fixed.
* - licker98 - Dec 12, 2016
I always thought that, because RATs used reverse TCP, the controller is the client and then binary is the server.
* - DaftHacker - Dec 12, 2016
(Dec 12, 2016 06:23 AM)licker98 Wrote: I always thought that, because RATs used reverse TCP, the controller is the client and then binary is the server.Yes i am of course talking about a reverse connection, do you know what the differences are compared to a regular connection ?
* - licker98 - Dec 12, 2016
(Dec 12, 2016 11:40 AM)DaftHacker Wrote: Yes i am of course talking about a reverse connection, do you know what the differences are compared to a regular connection ?
Yes.
* - DaftHacker - Dec 12, 2016
(Dec 12, 2016 12:39 PM)licker98 Wrote: Yes.k
Maybe some who isn't autistic could explain the differences between a regular connection (Me having the server socket) and a reverse connection (Client having the server socket) ? I know lots of rats use a reverse connection like DarkComet. On the DarkComet wikipedia there is a section that notes: DarkComet, like many other RATs, use a reverse-connecting architecture. The client is the system which is not infected with DarkComet. The client is the system with the GUI which controls the servers. The servers are all the infected systems. The servers do not contain a GUI.
* - LanMan - Dec 12, 2016
(Dec 12, 2016 02:13 PM)DaftHacker Wrote: k
Maybe some who isn't autistic could explain the differences between a regular connection (Me having the server socket) and a reverse connection (Client having the server socket) ? I know lots of rats use a reverse connection like DarkComet. On the DarkComet wikipedia there is a section that notes: DarkComet, like many other RATs, use a reverse-connecting architecture. The client is the system which is not infected with DarkComet. The client is the system with the GUI which controls the servers. The servers are all the infected systems. The servers do not contain a GUI.
It's the way the handshake is made, normal connection go: client contacting the server => server responding => blablabla
A reverse connection is the server initiate the connection and not the client, so: server contacting the client => client responding => blablabla
Same for proxy, socks, RDP etc
* - Ainaj - Dec 12, 2016
You = Server
Client = Client