[img]http://dl.dropbox.com/u/19745684/Tips%20and%20Tricks%20RATS.png[/img]
IF YOU ARE READING THIS PLEASE READ MY SIGNATURE!
Hello fellow HF members, I'm here to present you a brand new , noob-friendly, weekly guide. I'm here representing The RAT's Crew, and for next weeks will be covering multiple subjects on R.A.T.ing and all that it involves. This will not be some regular thread. We will provide extensively detailed information on every subject.
- For our first week we are going to cover the basis of R.A.Ting which is:
- Simple explanation on what R.A.T's are and what they do.
- List of RAT's + Download link.
- Choosing the RAT that suits the readers.
- Pointing out the pros and cons.
- How to Port-Forward.
- Extensive version. Multiple known and private methods.
What's a R.A.T.?
First of all, R.A.T stands for Remote Administration Tool.
In an illegal way [as in without permission] they are used to connect and control one or multiple computers at a time, whatever their locations are.
[There are also LEGAL R.A.T.'s that you might have heard of like: TeamViewer, UltraVNC , Etc.]
In order to infect a computer he will need to run a specific executable, your server. Meaning you'll have to SPREAD it. (There are multiple techniques, in the next week we will be covering that and will let you know the best public and private methods.(
You can build your server.exe inside your R.A.T.
What can I do once I sucessfully install my server on some one's computer?
Well, here is what every basic R.A.T. should be able to do:
(If yours do not have some of these options, don't use/buy it.)
- File management: Move, Browse, Download, Upload, Run, Replace, Rename, Delete.
- Windows/Processes Control: Start, End, Pause.
- Remote Desktop.
- Webcam and ScreenShots Capture.
- Get system informations: Such as OS, RAM, CPU, A-V Brand, PC's name, location.
- Control Keyboard and Mouse.
- Control Web Browser: Open page, Change HomePage, Re-Direct.
Ok, but how do they connect?
Well as they are used illegaly in this case, they'll need to work in a special way in order to stay unnoticed.
To acomplish such your server will connect itself using Reverse Connection, that bypasses both Router and Windows Firewall security restrictions. Meaning, after they are infected, your victims will connect to your client, as the router doesn't control outgoing traffic it will be unnoticed.
You can read more about it HERE.
Here's a simple image that might clear your mind.
[img=400x150]http://dl.dropbox.com/u/19745684/reverseconn.JPG[/img]
But specifying a bit.
There are 2 types of R.A.T's. Ones using Ports, such as TCP Sockets and UDP Sockets, and others that DO NOT require port to be open, PHP.
Some say UDP (User Datagram Protocol) is "safer" for the Hacker side, as it doesn't require any "handshaking", meaning it doesn't need to stablish a connection, it might be a bit hard to understand but it's easier than it looks. Using UDP ports the client will only send a Data Request and the server will then send a Data Response. I'll latter on this thread provide an image where you can see how it works and the difference between TCP and UDP.
R.A.T's that connect using a TCP (Transmition Control Protocol) initiate themselves with a "3-way handshake". (Firstly you'll need an open TCP Port on your Router.. We will let you know how to open ports latter in this TuT.) Meaning:
- First a SYN packet will be sent to the server once the .exe is ran.
- Secondly a SYN/ACK packet.
- Third and last, a ACK packet is returned to the client. Once this ACK packet goes through the TCP port the connection is considered STABLISHED.
Once the connection is stablished data can be transfered freely.
Here's two images. The first is a squeme of the TCP connection.
On the second one you can see the difference between UDP and TCP, and what it involves.
[img]http://dl.dropbox.com/u/19745684/TCP_UDP.png[/img]
Here are some R.A.T.s Sources for you to study if you want to learn more about how they work:
Sources:
Spoiler (Click to View)
Now the PHP R.A.T.s are even easier to understand.
First of all you'll need to host your PHP files. You can use some free hosting websites, google them and they will show up.
It does simply THREE things:
- Once the server is executed all the information will be added to the active users list you just hosted, which your client will read.
- A new connection on your client will appear.
- Now you can send a command. It will be in a form of a string. The server will check every 5 secs to see if you have sent any command. If a command was sent then it will download the string, which was sent your hosted files, then will divide it by arrays and check if the command was sent to this particular server, by confirming the username + OS + other things. If not that string will be simply ignored and the log will be dumped. IF yes then it will execute the said command.
(Not sure if every PHP RATs checks every 5secs. At least mine does.)
- Download Links
Some famous free R.A.T.'s
Spoiler (Click to View)
Now to what's needed.
How to Setup + PortForward
Things you'll need:
- Attention.
- A little amount of brains.
- STEP ONE: NO-IP DNS
(Pics are self-explanatory.)
Spoiler (Click to View)
- STEP TWO: PortForwarding.
Using a D-Link Router.Spoiler (Click to View) and IPv4 Address[img]http://img15.imageshack.us/img15/2232/ipconfigk.png[/img]
- 3. Open your default Browser. Type in your Default Gateway, Press Enter.
[img]http://img836.imageshack.us/img836/5919/logindg.png[/img]
- 4. Login. If you don't know the password try: Admin Admin.
If it doesnt work check this website containing a full list of passes for all the routers. Click HERE or HERE.
- 5.Go to Port Forward tab. Then: Advanced>Virtual Server. Virtual Server works well for portforwarding.
[img]http://img707.imageshack.us/img707/9672/virtualserver.png[/img]
- Fill in information
Name > You choose.
IP Address> The one found on CMD.exe
Public> Port you want to forward.
Protocol> Both, do TCP would do it.
Schedule> Always
Private> Same as Public
Make sure it's checked then click save
[img]http://img5.imageshack.us/img5/6247/setupen.png[/img]
- 7. You're DONE!
In order to check IF your Ports are indeed OPEN download this: PFPortCheck Program
(To read more about the program visit here)
Then enter your desired port and test.
Make sure you HAVE your FIREWALL DISABLED, otherwise it could conflict with the programm.
Don't use canyouseeme.com, I've tried it many times and always failed to really check. Yet with that other program I successfuly checked.
ALSO, if your router has it enabled, DISABLE Block Random Ping Request
- TIPS:
- Using other Routers you should mainly look out for the following:
- Port Mapping
- Virtual Servers
- Games & Applications
- Port Forwarding
- Port Mapping
- Using other Routers you should mainly look out for the following:
- Open more than one port. Why? Well, some times you may infect someone you consider a V.I.P, therefore you DO NOT want to lose the connection. Explaining it simple: Once building your server.exe you'll have to choose a port on which it will stablish connection. You might know start thinking on using TWO R.A.T.'s at a time. Build the other server.exe with the other open port you got yourself a double connection :3 You can use as many R.A.T's at the same time as you want.
(You can't, if you can it is not recommended to, use the same ports for two different programs)
- TRICKS:
- IF your Router enabled uPnP (Plug 'n Play) some R.A.T.s/Programs can automaticaly open ports. Example: Albertino Advanced R.A.T.; uTorrent [Open your uTorrent Client>Option>Preferences>Connection> Tick "Enable UPnP port mapping > in "Port Used for incoming connections:" type the port your want to open> voilá it's open!]
- Routers, some times, can be a true pain in the arse right? Well for months I've had problems with mine (a Thomson TG784), couldn't get it to open ports, and after a lot of hard thinking I've figured something out:
- IF there are already some default Games or Applications you can asign to your network device and they DO work, what if I just re-configure those Applications and re-choose the ports I want OPEN?
Well I tried it and it WORKED.
So in those kinky Thomsons you should do this:- Toolbox > Game & Application Sharing > On the bottom you'll see "Pick a task..". Choose the last option which is: Modify a game or application > pick a RANDOM application and click EDIT. > DELETE the existing port options and create new ones > Now again look at the bottom click "Assign a game or application to a local network device" > Now chose the application you modded, activate it and DONE!
- This should work with all Routers.
- Toolbox > Game & Application Sharing > On the bottom you'll see "Pick a task..". Choose the last option which is: Modify a game or application > pick a RANDOM application and click EDIT. > DELETE the existing port options and create new ones > Now again look at the bottom click "Assign a game or application to a local network device" > Now chose the application you modded, activate it and DONE!
- There are also plenty of programs made to open the ports for you. An example is: Simple Port Forwarding. You can find a TuT on using it HERE
- IF there are already some default Games or Applications you can asign to your network device and they DO work, what if I just re-configure those Applications and re-choose the ports I want OPEN?
- IF your Router enabled uPnP (Plug 'n Play) some R.A.T.s/Programs can automaticaly open ports. Example: Albertino Advanced R.A.T.; uTorrent [Open your uTorrent Client>Option>Preferences>Connection> Tick "Enable UPnP port mapping > in "Port Used for incoming connections:" type the port your want to open> voilá it's open!]
I will not cover how to "Setup" your R.A.T.s. Well to be honest the main reason is that you require no trick to set it all up. There's nothing as simple as inserting your no-ip address, typing the open ports and building you server. And there's TO many different R.A.T.s for me to post all their ways to setup.
Maybe next week. Who knows?
Oh and... You might be thinking: OHMAGAD, there's almost nothing to know about RAT's than what has just been posted.
You're wrong sir. Expect us next week to suprise you once more.
Thus ends our first week edition of: The RAT's Crew - Tips 'n Tricks.
My goal is to instruct every single HackForums member abot every single aspect of a R.A.T. and the art of RATing.
I hope you guys have enjoyed it.
Thanks for taking time to read it.
CREDITS
- Zach, /lXdJBH]Zɛus, Qwazz, /jsma2A]S70N3R : RAT's Leaders. <3
- KillαMuvz : Design; R.A.T.'s explanation; Tips; Tricks; Sources; Download Links; Effort.
- Baked : No-Ip Tut; Tips; Download Links; Support; Effort.
- Boss. : PortForward Tut.
- Codad Law : List of router's passwords.
- Joey Tribbiani : A great friend; Lots of support / help.
- BlackChaos : Simple Port Fowarding Tut (program)
Untill next week.
Regards,
KillaMuvZ
The RATs Crew.
![[Image: ROhN4bs.png]](https://i.imgur.com/ROhN4bs.png)