hi
sorry to ask
i have use rat on vps windows and noip dns , and i catch about 10 victim stable
but dont know why ? after i restart vps windows
only 2 victim back , and lost all , 😖😖😖😖
i have checked my noip its still working well , refresh DUC my victim rest still not back
its really nonsence, i dont know cause from my vps or from DUC noip
could you please suggest me somethings to fix ? i know this matter not from victim , i guess somethings block it , or somethings make my victim cannot connect back to my panel
pls suggest for me ,thank you so much
I disagree about the problem not being client-side. If you had clients, the server is fine. Was there any kind of persistence enabled?
(Dec 20, 2025 12:42 PM)DramaKing Wrote: I disagree about the problem not being client-side. If you had clients, the server is fine. Was there any kind of persistence enabled?
hi
thank for your reply
yes its not matter from client ( victim) , and i dont have any backup
i dont know why ,after i have restart vps , i lost 8 client , its not connection to my panel RAT again , only 2 client connect again
dont know reason from vps or from dns
please suggest somethings help me
thank you so much
(Dec 20, 2025 12:54 PM)vira Wrote: hi
thank for your reply
yes its not matter from client ( victim) , and i dont have any backup
i dont know why ,after i have restart vps , i lost 8 client , its not connection to my panel RAT again , only 2 client connect again
dont know reason from vps or from dns
please suggest somethings help me
thank you so much
If you're not going to address what I posted, I'm done. Maybe your RAT doesn't reconnect.
Hard to tell, maybe if it's some glitchy RAT then clients might've crashed when server suddenly stopped connection with clients when you restarted, and it will come back when persistence is triggered again. Also what DramaKing says might be - that it's not coded to have repeat connection attempts after first connection ends, that's not unprecedented, iirc Metasploit's reverse shells work like that. Maybe the code related to ending a connection and attempting reconnection got detected by AV behaviourally. Maybe Windows networking settings on your server changed due to the restart. Do some tests that'd recreate the situation, but so that you control both environments and can analyse more thoroughly.
thank for DramaKing and possessed-client ,suggest for me
i have research many days , and still dont understand why its disappear like that, maybe i must start beginer
thank for your time so much
|
