[bzrΚ]

Notorious - RAT Helpdesk


Turn your face to the sun and the shadows fall behind you.

Welcome to the Notorious helpdesk.

Having a problem with your RAT? Need some extra support?

We're here to help.

Our support members:

bzrK
Armada
Alexishay
JaGLY
RAT Support

If you're just starting out, you're in the right place. Below you'll find the most reliable current offerings, paid and free.

Reliable RAT(s) (free):

njRAT - .Net 2.0 - Download

Babylon - Native - Download

Quasar - .Net 4.0 (open-source) - GitHub

Reliable RAT(s) (paid):

Imminent Monitor - starting at $25 (1 license) - Thread link

LuminosityLink Workstation - $40 (1 license) - Thread link

Orcus Remote Administrator - $40 (1 license) Thread link

---

Reliable VPN solutions:

Cryptic VPN - starting at $.99 (1 day) - Thread link

PhyberVPN - starting at $.70 (1 day) - Thread link

---

Reliable DNS Solutions (free)

Dynu - free (includes Windows client) - Website link

Reliable DNS Solutions (paid)

Armada's Secure DNS Service - starting at $30 (1 year) - Thread link

NameCheap - starting at $.99 (1 year) - Website link

---

Reliable crypter solutions:

CyberSeal - starting at $40 (3 months) - Thread link

Static Crypt - $30 (45 days) - Thread link

DataProtector - starting at $35.50 (45 days) - Thread Link

---

Reliable crypter solutions for Java RATs:

jFuzzle - Starting at $13.99 (31 days) - Thread Link

---

Reliable scanning solutions:

pscan.xyz - free - No Distribution - Website link

Majyx Scanner - free - No Distribution - Website link

Chk4Run - Runtime scan detection - Paid (starting at $5/day or 0.002 BTC / ~$2 per scan) - Thread Link

---

Useful threads by members of Notorious

Remote Admin Tool 101 Course - Written By: Armada

[UPD: 10/04] [Massive Guide] So you want to RAT? Let me help you mate! [Full Version]

[Notorious] Ultimate DNS Guide for beginners

{TuT}{Pics}How to setup a Windows Virtual Machine - Noob friendly!!{Pics}{TuT}

Still need some help? No problem.

Post below with any questions or problems you have and we are happy to help.

[TheChiеf]

We hope that our member(s) can help the community with their queries. 🤝

[VirtualMon3y]

Vouch for Op. He knows his stuff!

Seriously tho mate, fair play for taking this step and providing this service. It is a big commitment. Good luck with it.

[bzrΚ]

Vouch for Op. He knows his stuff!

Seriously tho mate, fair play for taking this step and providing this service. It is a big commitment. Good luck with it.

Been here long enough...bout time I stepped my game up.

Thanks for the support bro.

[Nutrition]

Hey, so I currently have IM, with Cyber Seal along side armada's DNS service. I've been able to create a few stubs, finally got a final product after some settings tinkering, but seems whenever I do test installs the client doesn't come in through IM. I have the ports listening, and forwarded. I am unsure what my issue is. Any help is appreciated. :D

[Purple Kief]

Hey, so I currently have IM, with Cyber Seal along side armada's DNS service. I've been able to create a few stubs, finally got a final product after some settings tinkering, but seems whenever I do test installs the client doesn't come in through IM. I have the ports listening, and forwarded. I am unsure what my issue is. Any help is appreciated. :D

I have already answered your question here: https://hackforums.net/showthread.php?ti...id53991751

[Nutrition]

I have already answered your question here: https://hackforums.net/showthread.php?ti...id53991751

Couldn't seem to fix it with those options.

[tcsh]

Well, guess I had the right thoughts on one of my previous posts...

pumped for this - good luck with the service guys :)

[urbandesi]

thanks for clearing everything :) (Y)

[JaGLY]

-snip

Awsome mate thanks for your service, this should help alot of people getting started 🤝

[bzrΚ]

Hey, so I currently have IM, with Cyber Seal along side armada's DNS service. I've been able to create a few stubs, finally got a final product after some settings tinkering, but seems whenever I do test installs the client doesn't come in through IM. I have the ports listening, and forwarded. I am unsure what my issue is. Any help is appreciated. :D

Did you ever test the client locally? And if you ping your DNS in cmd does the correct IP come back?

[Koopa.]

Vouch for OP's. Purple Kief's, and Armada's knowledge in this this topic. They are also very friendly and helpful.

[Armada]

Hey, so I currently have IM, with Cyber Seal along side armada's DNS service. I've been able to create a few stubs, finally got a final product after some settings tinkering, but seems whenever I do test installs the client doesn't come in through IM. I have the ports listening, and forwarded. I am unsure what my issue is. Any help is appreciated. :D

Couldn't seem to fix it with those options.

Did you ever test the client locally? And if you ping your DNS in cmd does the correct IP come back?

As both noted before hand, the first test is to determine how and where your problem is happening.

My first course of action, as the others are attempting to determine is how and where your routing is going wrong.
If you utilize my DNS service, the DNS instructions are straight forward.
Update using the site with your credentials and the new IP#.

Assuming when you PING your host name it pings to the IP# you have pointed it to that portion is considered RESOLVED.

Plese read and follow the following from my RAT 101 guide.

Introduction:
When we discuss Networking and Network topologies on a Remote Administration and associated technology level. A new array of problems and configuration concerns must not only be met, but also carefully configured to not compromise security to the designated user. This being said, we need to look at and approach networking in a different perspective to start. Where most users when they begin in the network security field believe they already have a good understanding of basic networking because they can hook up a cable modem and wireless router without issue. Remote Administrative tools require special and unique network configurations to ensure correct and proper communication.

The Basics, without being so basic.
Spoiler (Click to View)
Figure 1 – 2 Computers in Communication.



In this model we have the simplest figure of computer networking. 2 machines in direct communication using a form of networking protocol (Likely IPv4 or IPv6). In this model the computers are shown with no protective measures, firewalls or anti-virus/security protection software elements in place. – A scenario now a days which is highly unlikely.

Figure 2 – 2 Computers in Communication with Firewall/Security in Place.



In Figure 2 we examine a more likely scenario where a computer has running security provisions in place. – In this example a firewall is in place on machine #1 – This scenario allows for machine #1 to accept requested information, send information outbound, however restrict unauthorized communication from machine #2, or other machines which may attempt communication.

Understanding your networks security provisions will greatly reduce troubleshooting of connectivity problems later on.
Every layer in the network has the potential to have another form of network security in place. It is highly recommended before attempting to start use of Remote Administrative tools the user sit down and plan the networks design and strategy out beforehand. Use of Microsoft Visio is a fantastic resource for such network planning.

Figure 3 – A Typical Home Network Design



In Figure 3 we have a Typical Home Network design, with common elements of network connectivity. A Cable Modem (Or DSL) which provides the network gateway and hardware interface for the communication. The Wireless Router which provides resource sharing of the modems internet connectivity, and the various devices used to access the network.
However, there are hidden or less known layers which also exist within even the simplest of networks such as detailed in figure 3.

 
Figure 4 – Detailed Typical Home Network Design



In Figure 4 we examine a more detailed, but “same” network configuration. Just with a more accurate view of possible network boundaries.
Each device presents its own unique security boundaries and configurations. Workstation and Laptop terminals employ software/OS firewall security and likely Anti-viral software. Network peripherals such as Routers and Modems (or Combo devices) also present firewalls which are hardware based and accessed through the devices interface (Likely a web browser accessible configuration page). Each and Every device and security measure along the network path/route from the Internet WAN to the device being used by the user to access such Remote Administrative tasks MUST BE CORRECTLY configured to allow the network traffic to pass. In more complex networks, this can become especially tricky for some users if they do not have the correct network privileges or rights to modify the required settings.

Network Exercise:
Spoiler (Click to View)
Creating a basic network flow/layout.

Users are encouraged to sit down, and record each and every device connecting their network together. This includes finding the make and model of every network peripheral included.
Although this varies from ISP and network configuration greatly, it is in general safe to assume a user with High speed internet will have the following:
Cable Modem: (Make/Model)
Wireless/Wired Router: (Make/Model)
Various Terminals/Computers: (Make/Model/OS Version/Security In Place)

Record each devices model and serial and find on the manufacturers website is that devices model enforces security measures.
For Modems and Routers firewall configurations are essential to PORT FORWARDING.
Routers being the general devices to provide resource sharing across a network will be the Default Gateway for most devices (and thus easily accessed by using gateways IP# in the browser to access the configuration page) It is important to understand that every devices layout and options will vary to a degree from model to model. So it is highly recommended to sit down, record your settings for each device and familiarize yourself with the configurations layout and settings pages are, and where features are located.

Finding your default gateway:
In Windows Navigate to your Command Prompt
Start > Run > type “cmd”
In Command Prompt type “ipconfig”. The user will be prompted with a similar dialog reply:
C:\>ipconfig
Windows IP Configuration
Wireless LAN adapter Wi-Fi:
Connection-specific DNS Suffix . : Home
Link-local IPv6 Address . . . . . :
IPv4 Address. . . . . . . : 192.168.1.50
Subnet Mask . . . . . . : 255.255.255.0
Default Gateway . . . . . . : 192.168.1.1

The listed Default Gateway will likely be your internal Routers IP#. And also the network address in which the Routers configuration page and settings can be accessed (Through web browser interface).

// End Exercise


Port Forwarding:
Spoiler (Click to View)
Majority of times more than others, the usual reason for a RAT failing to "work correctly" with new users is incorrect port forwarding rules. Without going in to too much detail, the simplest way to explain port forwarding is, within the network a user generally has 2 IP#'s. One Internet based IP# (Which is the users physical address on the internet) and a local LAN IP# (usually named 192.168.*.* or similar depending on router model.) When a user opens a port for external network communication from the internet, the port must then be pointed to the correct Local Area Network IP# (The 192.168.*.*) For this reason a user who is dealing with port forwarding is recommended to make the machines local IP# static to it does not change within the local area network, and prevents further problems with port forwarding.

This can be accomplished by accessing the Local area connection in the Control Panel of Windows > Network and Sharing Section > Change Adapter Settings.

Right clicking on the active adapter and selecting Properties > Internet Protocol version 4 > Properties.

"Use the following IP address"
- Specify a valid local subnet IP# (I recommend something like 192.168.1.121, .121 as it is high enough in the IP# pool to not be assigned on a regular basis by dynamically addressed devices.)
Subnet mask can almost always be left as the default.
Default Gateway is the Routers IP#. (If you are a 192.168.1. IP#, Router is usually 192.168.1.1 )
Primary DNS server is ALSO the routers IP#.

- If configuration does not work, or internet connectivity is lost after attempting these steps, reassign IP# to "Obtain IP address automatically" to restore connectivity.

Verification of active R.A.T. port:
A simple way to verify the service has been executed successfully on the machine to be the slave is to run the netstat command from the terminals command line and look for the defined port in the listing.
Local Address - Is the local loopback (127.0.0.1 and the port number active from obviously, the local machine.
Foreign Address - Is the remote machine in which the connection is taking place with. (Command and Control, for example)

If you do not actively see the R.A.T.s defined port either communicating out, or alternatively (Command and Control Side) actively listening on the port, communication between client and server will fail.

Router Configuration for Port Forwarding:
Spoiler (Click to View)
Router configurations vary in layout, but all routers contain a feature for "Port Forwarding". This i where you can tell the routers hardware firewall to allow remote connectivity in to your network. this is essential for ANY R.A.T. or software with "Call home" functionality. Within the routers configuration you must locate the Port forwarding section and add a exception for the Port number you assigned in your R.A.T.s configuration. This port must then be forwarded to a local IP# within your network (The workstations IP# you will be using the command and control from)

[align=center]RAT101 1.1 - v.1

If this is a continuous problem, please send back ALL results you have for further trouble shooting.

[Nutrition]

As both noted before hand, the first test is to determine how and where your problem is happening.

My first course of action, as the others are attempting to determine is how and where your routing is going wrong.
If you utilize my DNS service, the DNS instructions are straight forward.
Update using the site with your credentials and the new IP#.

Assuming when you PING your host name it pings to the IP# you have pointed it to that portion is considered RESOLVED.

Plese read and follow the following from my RAT 101 guide.




If this is a continuous problem, please send back ALL results you have for further trouble shooting.

Yes, it pings back with 0 packets lost, but should the ping statistics be 127.. or my port forwarded IP?

"Ping statistics for 127.0.0.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms"

[bzrΚ]

Yes, it pings back with 0 packets lost, but should the ping statistics be 127.. or my port forwarded IP?

"Ping statistics for 127.0.0.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms"

127.0.0.1 is your local IP and useless in the real world. You need to perform the same test but using your dns or external IP that you use when RATing.