May 27, 2019 11:55 AM
(This post was last modified: May 27, 2019 11:59 AM by coh0rt.)
Let's pretend we have two people using a RAT, Bob and Alice. Bob wants to have his client connect back on port 7777, while Alice wants her client to connect on port 5555. The RAT can let the user pick which port the client connects back to. This can be done by creating a builder. A builder basically allows Bob and Alice to choose whatever settings they want. There can be Anti-VM, Persistence, and other settings. The RAT can then generate a new client based on the settings the user chooses. Every generated client has the settings the user picked, but everything else is the same. To do this, the RAT can have a blueprint of the client (the stub) and replace the ip, port, and other settings in that blueprint with whatever the user chooses. The final file generated with all of the user's settings is called the client.
Before we start, let's define some terms.
Builder - Provides the user a user interface to change settings. The builder changes variables in the stub and makes a new client with the settings. The stub and the client basically share the same code, the only thing that is different are the settings that the user chose.
Client - Executed on the victim's computer. Contains the settings (like ip and port) that the user chose in the builder.
Stub - The stub is nothing but a blueprint for the final client.
Let's start! To keep this post short, this is just going to be a POC. It will not be an actual RAT. Code will be written in C# inside of Visual Studio.
Start of by making two .NET framework console app projects. Name them StubProject and BuilderProject.
In StubProject, copy and paste this code in the Main function.
In a RAT, message would be one of the settings. It's current value is just a placeholder.
Our builder is going to replace the value of message with something else.
Switch to BuilderProject now. We are going to install Mono.Cecil, Visual Studio will automatically reference the DLL after your install it using NuGet Packet Manager Console.
In Visual Studio click "Tools" -> "NuGet Packet Manager" -> "Packet Manager Console"
Then type in "Install-Package Mono.Cecil -Version 0.10.3" and press enter.
Now that you have installed Mono.Cecil you can use it in your project. Add this code to your project.
Now we can use Mono.Cecil. We're going to read StubProject's .exe file and change the value of message.
Before we start, you need to run StubProject at least once so it's compiled into a .exe
Add the code below to your Main function.
First let's read the assembly,
Replace pathToFile with the path to StubProject's executable file.
Pay attention to the this next code because it's the main part. I've provided comments inside the code.
Now we just need to add one more line of code.
Change pathToWrite to whatever path you want (for example: C:/Users/YourName/Desktop/app.exe). A new .exe file with the new message (the client) will be created in that path.
If you plan on using this in an actual application make sure that the placeholder values in your stub is unique for each setting.
Congratulations! We're done. Run the generated .exe, you should see the message "It works!"
I'd love some feedback on how I can do better. Am I going about this in the right way? If I'm not what should I do instead? Don't just tell me that this isn't the right way to code it. Tell me WHY and how I could improve. Thanks!
Before we start, let's define some terms.
Builder - Provides the user a user interface to change settings. The builder changes variables in the stub and makes a new client with the settings. The stub and the client basically share the same code, the only thing that is different are the settings that the user chose.
Client - Executed on the victim's computer. Contains the settings (like ip and port) that the user chose in the builder.
Stub - The stub is nothing but a blueprint for the final client.
Let's start! To keep this post short, this is just going to be a POC. It will not be an actual RAT. Code will be written in C# inside of Visual Studio.
Start of by making two .NET framework console app projects. Name them StubProject and BuilderProject.
In StubProject, copy and paste this code in the Main function.
Code
string message = "Insert message here";
Console.WriteLine(message);
Console.ReadLine();In a RAT, message would be one of the settings. It's current value is just a placeholder.
Our builder is going to replace the value of message with something else.
Switch to BuilderProject now. We are going to install Mono.Cecil, Visual Studio will automatically reference the DLL after your install it using NuGet Packet Manager Console.
In Visual Studio click "Tools" -> "NuGet Packet Manager" -> "Packet Manager Console"
Then type in "Install-Package Mono.Cecil -Version 0.10.3" and press enter.
Now that you have installed Mono.Cecil you can use it in your project. Add this code to your project.
Code
using Mono.Cecil;Now we can use Mono.Cecil. We're going to read StubProject's .exe file and change the value of message.
Before we start, you need to run StubProject at least once so it's compiled into a .exe
Add the code below to your Main function.
First let's read the assembly,
Code
AssemblyDefinition module = AssemblyDefinition.ReadAssembly(pathToFile);Replace pathToFile with the path to StubProject's executable file.
Pay attention to the this next code because it's the main part. I've provided comments inside the code.
Code
foreach (TypeDefinition type in module.MainModule.Types)
{
// Iterate through each TypeDefinition, we only care about the Program type though.
if (type.ToString().Contains("Program"))
{
// Now we are in in the program type. Let's iterate through all of the
// methods until we get to the method we care about - in this case that's the
// Main method.
foreach (var method in type.Methods)
{
if (method.ToString().Contains("Main"))
{
// We found the main method.
foreach (var instruction in method.Body.Instructions)
{
// Iterating through method.Body.Intructions
// method.Body.Instructions basically contains the body of a method.\
// We are checking if the value of one of the instructions is a string and is the same placeholder value we gave message
// if it is then we change it to "It works!"
if (instruction.OpCode.ToString() == "ldstr" && instruction.Operand.ToString() == "Insert message here")
{
instruction.Operand = "It works!";
}
}
}
}
}
}Now we just need to add one more line of code.
Code
module.Write(pathToWrite);Change pathToWrite to whatever path you want (for example: C:/Users/YourName/Desktop/app.exe). A new .exe file with the new message (the client) will be created in that path.
If you plan on using this in an actual application make sure that the placeholder values in your stub is unique for each setting.
Congratulations! We're done. Run the generated .exe, you should see the message "It works!"
I'd love some feedback on how I can do better. Am I going about this in the right way? If I'm not what should I do instead? Don't just tell me that this isn't the right way to code it. Tell me WHY and how I could improve. Thanks!
![[Image: bitcoin.png]](https://hackforums.net/uploads/awards/bitcoin.png)
