Hack Forums
RATs: How to cloudflare your RATs DNS ? Will this work - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Remote Administration Tools (https://hackforums.net/forumdisplay.php?fid=114)
+---- Thread: RATs: How to cloudflare your RATs DNS ? Will this work (/showthread.php?tid=5503544)

Pages: Pages 1 2

RATs: How to cloudflare your RATs DNS ? Will this work - cashf - Dec 24, 2016

Hey guys...

I am wondering: Is this possible ??

Point is: You can hide your websites IP so that noone finds your IP. Just setup a proper Cloudflare or Incapsula setup and there you go.

My idea is: Why don't we do this for a RATs DNS, too. Say for example:

1) I register 2 cheap domains and point them to my VPSs IP, there my RAT has his C&C.
2) Now I put both domains to Cloudflare/Incapsula. Now my 2 domains DNS point to a cloudflare/incapsula IP. Now all my slaves can only see the cloudflare/incapsula IP, but not the real C&C IP. Therefore my C&C IP is much more protected and they cannot find the hosting of my C&C.
3) Now only Cloudflare/Incapsula know my real VPS IP (my RATs C&C). So they forward all the traffic between my slaves and my C&C.

It would look like that:

Slaves <-> Cloudflare/Incapsula <-> my C&C

Question: WOULD THIS WORK ? Did anyone try such a setup before?

Or will Cloudflare/Incapsula block the necessary ports and limit the traffic forwarding to some port80 shit ??

Thanks a lot for your ideas and discussion..

cashf 🎉

Have a great Christmas guys 👍

* - Lucrid - Dec 24, 2016

I highly doubt this would work, cloud flare is just for web services if I'm not mistaken.

* - SIM-2053312 - Dec 24, 2016

I don't think this would work but if they did , your cloud flare would probably be banned since a lot of reports would be to that ip

* - Ainaj - Dec 24, 2016

CF just proxies HTTP content.

* - Maxie - Dec 24, 2016

I think it would be possible if you did this:
HTTP server that commands the bots (by sending simple commands in HTTP headers/echos it on the page)
hosted on cloudflare
create a rat that can read commands from a server and execute them
link to cloudflare

But if you don't have any coding experience, I guess this suddenly turns pretty impossible.

Edit: You could also make a program that runs on your VPS that reads from the server -> executes the command on the rat.
But it would still require some programming and eventual injection into the rat client.

* - cashf - Dec 24, 2016

Yeah.... thanks guys... I also found this info support.cloudflare.com/hc/en-us/articles/200169156-Which-ports-will-CloudFlare-work-with-

Looks that the ports that Cloudflare forwards are pretty limited :(

* - Nickname. - Dec 26, 2016

(Dec 24, 2016 07:25 PM)CesarVB Wrote:  CF just proxies HTTP content.

Wrong!

* - QU⚡CKSILVER - Dec 26, 2016

This will not work, as bots will still have a direct connection to you. IP address will still be revealed.

* - #Skyline - Dec 26, 2016

(Dec 26, 2016 04:03 PM)QU⚡CKSILVER Wrote:  This will not work, as bots will still have a direct connection to you. IP address will still be revealed.

It will work.
The TCP connection will point to cloudflare DNS, whilst routing all traffic to the original host.

* - QU⚡CKSILVER - Dec 26, 2016

(Dec 26, 2016 04:11 PM)#Skyline‌ Wrote:  It will work.
The TCP connection will point to cloudflare DNS, whilst routing all traffic to the original host.

Cloudflare needs to act as a TCP proxy in order for this to happen, not just a connection forwarder, which I really doubt they do.

* - cashf - Dec 26, 2016

Well, quite a discussion here. I would say 80% that it will not work, but I never tried. Anyone wants to test it out?

* - Ainaj - Dec 26, 2016

(Dec 26, 2016 09:21 PM)cashf Wrote:  Well, quite a discussion here. I would say 80% that it will not work, but I never tried. Anyone wants to test it out?

It just wont work, cloudflare proxies HTTP data. The dns resolves to one of their IPs, and depending on the HOST header provided it'll go to the origin web server.

This wont work for a rat since it they use raw tcp/udp packets, not http packets (which contain a HOST header).


But sure, lets test it.
[Image: g2QU9Hk.png]

104.27.176.251 is not my IP address, it's one of cloudflares proxy servers. Now since it's not a valid HTTP request, cloudflare ignores it, so no connection is made.

However, if I run a webserver on the same port it works since your browser sends the HOST header (your dns/domain in this instance) and cloudflare knows what to do with it.

If you want this to work you will have to use a rat that is designed around the HTTP protocol, it is completely possible, but completely stupid.

[Image: RmMlpY0.png]

* - KN. Strike - Dec 26, 2016

(Dec 24, 2016 07:25 PM)CesarVB Wrote:  CF just proxies HTTP content.
You can put crypted contents into HTTP content, which will make it go through CF without CF being able to see what the content uncrypted.
You can put any protocol(or substitute) into a HTTP, just need to know how to do it. Need a program on your server to interpret it too

* - Ainaj - Dec 26, 2016

(Dec 26, 2016 09:43 PM)KN. Strike Wrote:  You can put crypted contents into HTTP content, which will make it go through CF without CF being able to see what the content uncrypted.
You can put any protocol(or substitute) into a HTTP, just need to know how to do it. Need a program on your server to interpret it too

Pretty sure I covered that in my post, just add the HEAD header (which would mean make your packets valid HTTP packets).
(Dec 26, 2016 09:46 PM)Yani Wrote:  Please enlighten us.

As far as I know even websockets don't work with cloudflare.

Even webrequests use sockets, it'll work with enough know-how.

* - KN. Strike - Dec 26, 2016

(Dec 26, 2016 09:46 PM)Yani Wrote:  Please enlighten us.

As far as I know even websockets don't work with cloudflare.

I think you don't see what I mean. The R.A.T. get all information about a slave, he puts them into a http file and send it to the master. The master then send all informations he has to send through HTTP too to the R.A.T. program. Just need both program to know how to interpret the informations they get through the HTTP files.

You don't send commands directly to the slave, you send informations to the R.A.T. that then will take actions.
In theory that's possible, I've talked about it with my teacher in programmation. I started IT school 2 weeks ago and had a similar question ^^

- All informations sent must be crypted before being put in the HTTP file, so Cloudflare will not in the future be able to decrypt it.