[Nutrition]

127.0.0.1 is your local IP and useless in the real world. You need to perform the same test but using your dns or external IP that you use when RATing.

Yes, obviously..I ping the dns, that is the return. I figured the local IP should instead be the port forwarded VPN IP.

[bzrΚ]

Yes, obviously..I ping the dns, that is the return. I figured the local IP should instead be the port forwarded VPN IP.

Well if you're pinging the DNS and that's the return, you've setup your DNS settings incorrectly, you need to go back and double check on that front.

[Nutrition]

Well if you're pinging the DNS and that's the return, you've setup your DNS settings incorrectly, you need to go back and double check on that front.

Okay, I will remake a stub, recrypt it and see what the return in. Thank you.

[Armada]

Yes, it pings back with 0 packets lost, but should the ping statistics be 127.. or my port forwarded IP?

"Ping statistics for 127.0.0.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms"

No that most definitely is not right.

So, understanding your FLOW of connectivity is critical here.

From your RAT controller (Does not matter which one either) you input the DNS host address to your Binary configuration.

Crypt, do whatever else you want with the binary, but BEFORE doing that.
Follow these steps.

The flow of RAT network (For DNS and VPN routing)

{YOUR CONTROLLER} <> {ROUTER} <> {INTERNET} <> {VPN} < {DNS}

<> = 2 way connectivity
< = 1 way connectivity

So in this model, the first 3 are handled by connecting to your VPN service.
Lets assume Cryptic VPN.

From your VPN connection you go in to the VPN CP and open your ports to the VPN internally assigned IP# (ipconfig and the IP is usually something like 10.8.*.* )

Forward your designated ports, and then go get your external VPN IP# from whatismyip.com while connected to the VPN and THEN route your DNS to the VPN IP#.

Enable your controller to listen on the post and do the standard port testing at canyouseeme.org

If all of that check out, the port reports open and successful and you are in fact able to ping the correct IP# off of the Host name, you then turn focus to the binary.

Using a VM or external system of some kind, execute the NON crypted/ non manipulated binary on the machine and check for Binary/Client check in.

If that is successful, then proceed to crypting. If that fails, you need to go back and re-analyze all the variables.


Networking can be tricky AF, especially when we add on layer and layer of it on top of one another.

20+ years ago, Use of RATs was simpler, we did not use DNS or VPNs, just input our static IP# and the rest did the work.

Now security and internet and network spying has forced even the most legitimate of networking to be secured, encrypted and routed in much more complex methods.

It is unfortunate, but a fact of modern technology.

[7]

Good luck with this guys, but how come Orcus isn't up as a recommended paid rat considering Armada is on the team.
All these guys are great people other than Purple Kief who is an arrogant fuck boi..

But to the rest of you good luck and great service

[bzrΚ]

Good luck with this guys, but how come Orcus isn't up as a recommended paid rat considering Armada is on the team.

I love Orcus, but it isn't as beginner friendly as the two I've mentioned, I might add it in as a rat for people with more experience, we'll see.

[Kodaz]

Vouch for this :)
Great work Notorious.

[bzrΚ]

Vouch for this :)
Great work Notorious.

Thanks.

Lil' update, added a couple more options for RAT's in the OP.

[+] Quasar RAT
[+] Orcus RAT

Any questions shoot.


Just gonna quickly add in some personal opinions here -- My personal favourite is Orcus, for many reasons, but honestly, all the RAT's currently on offer around here are great, and I'd include them all if I could, but 1) That wouldn't make it any easier for people choosing their tools, which is one aim of this thread and 2) The reason NanoCore isn't included is because I have never personally used it so despite all the good feedback I have heard about it I can't honestly recommend it to people on my behalf.

[Purple Kief]

snip

You should mention the advanced setup of Orcus on the thread.
People that come to this thread generally won't know how to set up a RAT. Orcus is way out of the league. 😝

[Armada]

Good luck with this guys, but how come Orcus isn't up as a recommended paid rat considering Armada is on the team.
All these guys are great people other than Purple Kief who is an arrogant fuck boi..

But to the rest of you good luck and great service

@NullDB

I would respectfully request you refrain from this type of flaming.
You know me, freedom of opinion is all cool, but not in these threads please. 🤝

[Nutrition]

No that most definitely is not right.

So, understanding your FLOW of connectivity is critical here.

From your RAT controller (Does not matter which one either) you input the DNS host address to your Binary configuration.

Crypt, do whatever else you want with the binary, but BEFORE doing that.
Follow these steps.

The flow of RAT network (For DNS and VPN routing)

{YOUR CONTROLLER} <> {ROUTER} <> {INTERNET} <> {VPN} < {DNS}

<> = 2 way connectivity
< = 1 way connectivity

So in this model, the first 3 are handled by connecting to your VPN service.
Lets assume Cryptic VPN.

From your VPN connection you go in to the VPN CP and open your ports to the VPN internally assigned IP# (ipconfig and the IP is usually something like 10.8.*.* )

Forward your designated ports, and then go get your external VPN IP# from whatismyip.com while connected to the VPN and THEN route your DNS to the VPN IP#.

Enable your controller to listen on the post and do the standard port testing at canyouseeme.org

If all of that check out, the port reports open and successful and you are in fact able to ping the correct IP# off of the Host name, you then turn focus to the binary.

Using a VM or external system of some kind, execute the NON crypted/ non manipulated binary on the machine and check for Binary/Client check in.

If that is successful, then proceed to crypting. If that fails, you need to go back and re-analyze all the variables.


Networking can be tricky AF, especially when we add on layer and layer of it on top of one another.

20+ years ago, Use of RATs was simpler, we did not use DNS or VPNs, just input our static IP# and the rest did the work.

Now security and internet and network spying has forced even the most legitimate of networking to be secured, encrypted and routed in much more complex methods.

It is unfortunate, but a fact of modern technology.

Thanks for this post, I know I'm replying a bit late, but been busy lately. When I get back home tonight, going to try everything you suggested. Thanks so much for the help, I'll update you tonight. :D

[XXXfranky]

What's another alternative free DNS that is safe to use?

[bzrΚ]

What's another alternative free DNS that is safe to use?

Read here : https://hackforums.net/showthread.php?tid=5535456

[The One Who Knocks]

Alright, so portforwarding with CrypticVPN

Opened a port and added 2 rules to both inbound and outbound rules in my firewall

still cant see it, what am I missing?


Thanks in advance

[Purple Kief]

Alright, so portforwarding with CrypticVPN

Opened a port and added 2 rules to both inbound and outbound rules in my firewall

still cant see it, what am I missing?


Thanks in advance

You are missing the listening to the port inside of your RAT part.

All these guys are great people other than Purple Kief who is an arrogant fuck boi..

Stay salty ol' pal, stay salty.