I highly recommend you use Netwire RAT because of its stability, cross-platform functionality, and because it has NO dependencies.
What you need
- An idle slave
- Teamviewer, MSRA, RDC, or VNC.
- Remote Administration Enabled In The Remote Router (Achievable using Remote Desktop, etc)
First wait until the slave is idle/afk. Some RAT's have a function to show how long the computer has been idle, some others do not. If your RAT doesn't have an idle function then wait until the active window is blank, or says Start or Program Manager. Idk why, but some slaves show "Program Manager" as the active window when they are idle.
Once you have a idle slave, you will need to run a VNC server on their machine. I like to use MSRA (Microsoft Remote Assistance) because all you have to do is goto start, type MSRA and push enter.
Once your in their MSRA click "Invite someone you trust to help you" as show in the spoiler below
Spoiler (Click to View)
Now click "Save this invitation as file" as show in the spoiler below.
Spoiler (Click to View)
Save the invitation to the victims desktop or documents (documents is more discreet, as its not in plain view.) We will remove the invitation from the victims machine later
If the person is using Windows XP, you will be asked to enter a password (or use no password) before saving the invitation file.
Once you have saved the invitation file, use your RATs file manager to download it to your computer & execute it.
If you set a password you will be asked to enter it.
Now you will need to "Request Control" request it and accept it with your RAT.
Good job! Your now controlling their machine.
The procedure above was for a faster connection.
Now open their router. The IP should be something like 192.168.1.1.
Try some default logins. Here are a few.
- admin:admin
- admin:password
- BLANK:password
- BLANK:admin
If these don't work, google the default username and password for the router your trying to login too.
Once in their router, enable remote administration like so.
Spoiler (Click to View)
ENABLE remote administration and make sure you remember the port you used.
THIS IS IMPORTANT:
If your victim has a netgear router, go down to the bottom left and click "Logout". Its not that hard, so there is no need for a screenshot.
There. You now have remote access to their router, simple, eh?
Just type their IP followed by the port into your web browser.
Like this IP:PORT. You will be prompted to login, use the same details as you did with Teamviewer, RDC, MSRA, or VNC.
Don't close Teamviewer, RDC, MSRA, or VNC Yet!
We are not done! Make sure that the victims firewall is disabled, else this will not work at all.
If you are 100% sure that their firewall is disabled, close all the windows you have opened on their machine and exit Teamviewer, RDC, MSRA, or VNC.
Now login to their router using your web browser and create a portforward.
Spoiler (Click to View)
Just add a portforward for any port and make sure it goes to the victims LAN IP. This can be found in your RAT and will often begin with a prefix like 192.168.1.***
Your almost done!
Open your RAT, then open the socks4 proxy on the victim
For BlackShades, right click on the slave and goto Network > Proxy Manager. Then right click and hit "start socks" and enter the port you forwarded earlier. Done! Just use the victims IP and port as a socks proxy :)
DarkComet RAT also has this feature, and I believe Cybergate does too.
Tip
If you don't want to wait until they are afk, use your RATs chat feature to chat with them. Here is an example of what I said to some kid last night.
Me: "Your system has been compromised. Do not power off your computer nor disconnect from the internet or I will render your computer inoperable. This will only take a moment, I need access to your router."
Him: "Who are you?!"
Me: "I just need into your router"
say something like that, then let them watch as you Teamview, RDC, MSRA, or VNC. From there just do the same thing as you would do if they were away from keyboard.
Configuration may be different for some other routers, I know. Just figure out how to portforward using your victims router model. For Linksys (a popular router) goto Applications & Gaming > Port forwarding. The Teamviewing part of this tutorial is not necessary, I just believe it is faster than using your RATs remote desktop/screenshot function.
Hope you enjoyed this tutorial
Hope you enjoyed this tutorial
