Apr 13, 2019 06:07 AM
(This post was last modified: Apr 13, 2019 09:30 AM by csprv.)
I wrote a program that lets you RAT safely without needing any port-forwarding or dynamic DNS. Basically it works like this:
1) The ratter (you ... duh) creates a Tor hidden service (you only need Tor for that) and configure it to forward data from the open HTTP port (80) to your RAT server (instead of a web server like you'd usually do).
2) The victim runs my program (I call it InfiltraTOR ... shut up, it's a great name) and it extracts the Tor client binaries and the RAT client to the victim's Temp folder.
3) InfiltraTOR starts TOR and starts a connection to your hidden service, connecting using Tor's SOCKS5 proxy.
4) InfiltraTOR starts a local TCP server and then starts the RAT client which connects to the TCP server (instead of a dynamic dns).
5) InfiltraTOR forwards data from the RAT client to Tor.
6) Your hidden service can now communicate with your RAT securely since it's been anonymized through Tor, and sends the data to your RAT server. Voila! You've now connected to your victim without needing to port-forward or get a dynamic DNS.
The downsides to this are that it adds 5MB of Tor binaries to the RAT client (or rather, the RAT client launcher) (this could be reduced to 50KB or even less, but I'm not smart enough to write my own Tor client), and also the Tor network can be kinda slow. Here is the source code ( pastebin.com/dmjitUdZ ). It's pretty hacky (it shows a console window ffs I'm still working on it. It's not good enough for real life ratting yet) but all you need to do is put it in a project, add the official Tor expert bundle zip file ( dist.torproject.org/torbrowser/8.0.8/tor-win32-0.3.5.8.zip ) as a resource named "tor", add your RAT client set up to connect to 127.0.0.1:1234 (1234 can be changed easily in the source code. There's a bunch of settings at the top, including the hidden service which you'll need to change to your hidden service) as a resource named "rat", build it, and send it to your victims (after creating a hidden service of course) aaand badabing badaboom you get a slave!
1) The ratter (you ... duh) creates a Tor hidden service (you only need Tor for that) and configure it to forward data from the open HTTP port (80) to your RAT server (instead of a web server like you'd usually do).
2) The victim runs my program (I call it InfiltraTOR ... shut up, it's a great name) and it extracts the Tor client binaries and the RAT client to the victim's Temp folder.
3) InfiltraTOR starts TOR and starts a connection to your hidden service, connecting using Tor's SOCKS5 proxy.
4) InfiltraTOR starts a local TCP server and then starts the RAT client which connects to the TCP server (instead of a dynamic dns).
5) InfiltraTOR forwards data from the RAT client to Tor.
6) Your hidden service can now communicate with your RAT securely since it's been anonymized through Tor, and sends the data to your RAT server. Voila! You've now connected to your victim without needing to port-forward or get a dynamic DNS.
The downsides to this are that it adds 5MB of Tor binaries to the RAT client (or rather, the RAT client launcher) (this could be reduced to 50KB or even less, but I'm not smart enough to write my own Tor client), and also the Tor network can be kinda slow. Here is the source code ( pastebin.com/dmjitUdZ ). It's pretty hacky (it shows a console window ffs I'm still working on it. It's not good enough for real life ratting yet) but all you need to do is put it in a project, add the official Tor expert bundle zip file ( dist.torproject.org/torbrowser/8.0.8/tor-win32-0.3.5.8.zip ) as a resource named "tor", add your RAT client set up to connect to 127.0.0.1:1234 (1234 can be changed easily in the source code. There's a bunch of settings at the top, including the hidden service which you'll need to change to your hidden service) as a resource named "rat", build it, and send it to your victims (after creating a hidden service of course) aaand badabing badaboom you get a slave!
