I have posted another thread that I am hoping someone can help me with, but I was curious if anyone has gotten any RAT client to work in a Virtualbox window?
I want to do this as my notebook is used for work and dont want to mix business with personal stuff. Also, I am a bit paranoid about backdoored RATs so I want to try in a safe environment.
Does anyone else do this or am I alone on a ledge all by myself? If so, anything special you have to worry about to get it to work?
thanks
Unless the RAT has anti-vm, I don't see why it wouldn't work.
thanks for the quick reply but I meant the client....not the server
I have seen the antivm option in setups for servers but I was wondering about the actual client
Yeah, the same rule applies. Unless it's been back doored with anti-vm you should be fine.
If virtual machine take connection from main machine it could be a problem for port forward. When I port forward i'm asked to put the local ip that must have the port open (192.168.0.2 for example) But if VM take connection from main machine it's like a LAN into another LAN and port won't be open there. Instead if you run connection directly from VM there should be no problem
I am just using usb flash drive i keep all there and run client from there
hmmmm
I cant seem to get it work.
The program works but I just cant seem to get a connection with my test PC.
Tried different settings but it still doesnt get a connection. So I thought there might be a problem with the infected pc trying to communicate back with the client running in the virtualbox window
DO NOT DEAL WITH THIS MEMBER
Give the VPC / VM a static internal IP from your router.. Port forwarding should then work fine from there on ..
ok. so the the VM has a static ip now. tested it. I can ping between my host os and the Virtualbox os.
I create the server and I put in my static ip and port 8003. This port is forwarded to my static ip of the VM.
Is this correct?
hmmmm.....just tried that and it didnt work
Is no one working with type of setup?
Can anyone help?
Ok, I've literally JUST solved the same problem for myself lol. Forward your ports to your Host OS(Your physical, non virtual system), just like normal. Then, setup a bridged connection.
Now, on Linux, there are some Terminal commands to add "HostPort", "GuestPort", and Protocol. I will get into that later, once I fully test how to do it with a Windows host. I did it in Linux.
But just forwarding to your actual physical system and then setting the connection to "bridged" should suffice.
DO NOT DEAL WITH THIS MEMBER
(Jan 23, 2010 11:38 AM)bcb038 Wrote: ok. so the the VM has a static ip now. tested it. I can ping between my host os and the Virtualbox os.
I create the server and I put in my static ip and port 8003. This port is forwarded to my static ip of the VM.
Is this correct?
hmmmm.....just tried that and it didnt work
No, you are not correct...
First, does both your host and your VM have a 192.168.x.x IP ???
Next, do you have a static external public IP ?? If yes, you have to use THAT IP. Else, when creating your server, use your DNS (no-ip or dyndns) address...
Then, go to your router, and forward port 8003 to the static internal IP that you gave your VM...
Hope this helps...
I can setup for you..I did the same thing a week ago
(Jan 23, 2010 09:28 PM)Carb0n F1ber Wrote: No, you are not correct...
First, does both your host and your VM have a 192.168.x.x IP ???
Next, do you have a static external public IP ?? If yes, you have to use THAT IP. Else, when creating your server, use your DNS (no-ip or dyndns) address...
Then, go to your router, and forward port 8003 to the static internal IP that you gave your VM...
Hope this helps... Actually, I'd recommend port 2222. Least chance of conflicts etc.
DO NOT DEAL WITH THIS MEMBER
(Jan 24, 2010 12:12 AM)Riverthief Wrote: Actually, I'd recommend port 2222. Least chance of conflicts etc.
The OP had already done his settings with 8003, hence i used the same...
If you ask me, a not so fancy, random 4 or 5-digit port will not create suspicion ... If I see 2222 on a netstat command, it will surely raise my suspicion..
But if I see something like 15963 ( Turkojans default port), an average computer user will simply ignore it...
|
