[Armada]

So, I got some time on my hands tonight, and have decided to write something up for clarification and general informational uses to all members involved in the RAT community.

This document is not meant to "Break your understanding" of Remote Administrative Tools. But to correct some typical misconceptions associated to this type of software.

Lets dive right in

Firstly, the history.
- Remote Administrative Tools (Legit or otherwise) are as the description states, software designed to remotely administrate another machine across the network (internet).

- Origins of this type of technology go back to some of the earlist of computer networking. There was a need to access and issue commands and code to servers and services without the administrator having to get off their fat ass to actually physically go input the command line. Thus the advent of remote admin concept.

Trojan/Backdoor/RAT Basics:
R.A.Ts or Trojan viruses are nothing more than a client/server application suite.
Its pretty basic in technical standards really.

Lets take a look at figure 1 here.


Figure 1 demonstrates the most simplistic form of client/server communication.
The Client will connect to the server for its services.

Now, this same theory "Back in my day" (Damn I feel older and older everytime I say this one) We distributed "Servers"

- And I say "Servers" in the sense the Hackers terminal HAD to remotely establish a connection the the infected machine as per Figure 1.

Lets go more complex a little more, and assume Hacker has more than a single infected machine. Figure 2


In figure 2 we clearly see the Hacker has access to numerous infected terminals, However the Hackers terminal MUST connect to the infected slaves.


Armada, your talking gibberish, it doesn't work that way!

- Absolutely correct. NOW.
That last part was a History lesson for the new comers.

NOW
- Here is where the technical misconception stands.
Where Figure 1 and 2 the Hacker connected to the infected machines. This is clearly no longer the case. With the advent of Firewall technology and anti viral/internet protective suites, hackers had to find another method to success.

Fire walls block incomming connections be default, hindering the "Old style" trojan/RAT software obsolete. If the end Admin(Hacker) can not connect to the machine, whats the use, right?

Thus later revisions of the software started to instead of broadcasting the host IP# of the infected terminal, now "Calls home" - IE checks in to what is commonly called the "Client"

The TECHNICAL MISCONCEPTION.
Looking at figure 1 and 2 it should be apparent to anyone with a bit of networking knowledge. In this new scenario of Infected host calling home to the Hacker, the roles have now been reversed.

Figure 3 - Todays RAT networking topology


In this scenario, the infected machines(slaves) check in to the Command and Control Console (Hackers terminal).

This effectively by ALL NETWORKING DEFINITION makes the Hackers terminal now the server, and the infected slaves the clients.

Clients connect to servers for the associated services. NEVER the other way around.

Confused yet? 🎉

I dont blame you one bit. This is a technical aspect to backdoor administration that has long gone uncorrected, but has been incorrect since the day our infected terminals started calling home to us instead of us connecting to them.

And frankly, it bothers the hell out of me to see new users being taught improper networking under the guise of "Its easier to understand"
- Easier to understand is NOT technically correct and should under NO CIRCUMSTANCE be encouraged or enforced. (IMO)


So to recap or tl;dr
Binaries considered "Clients" are in fact the management servers
and the "servers" are technically the clients of the management server in question.

I tried to simplify as much as possible for the new users. 🤝
- Further note, I dont have any hope on this changing a damn thing, but the technical incorrectness has always bothered me on this one.

Cheers everyone. 😎

[Cheese]

Nice explanation, I'm sure this will give a lot of users an idea how this works.

Thanks for this 🤝

[KFC Watermelon]

The builder in Luminosity is called "Client Binary Builder". It clearly says client builder numerous times. People still save it as "Server.exe".

[Armada]

The builder in Luminosity is called "Client Binary Builder". It clearly says client builder numerous times. People still save it as "Server.exe".

The exact technical misconception I am attempting to address here!

Nice to see a actual software developer of these applications confirm my statements on this. Respect 🤝

[21st Century Schizoid Man]

Nice thread my friend! 🤝, It is really interesting to me how rats work.

[Mr. Dr. Prof. Patrick]

There is no misconception, and a reverse connection can be argued anyway a person see fit, though the Infected PCs connect to the the Hacker PC, Never Once does the Infected PCs make a request

the Binary accepts requests and answers accordingly - the exact definition of a server, it hardly matters who initiates the connection whether the server or the client.

So by definition calling the Stub/Binary/Infected PC a server is absolutely correct

[Armada]

There is no misconception, and a reverse connection can be argued anyway a person see fit, though the Infected PCs connect to the the Hacker PC, Never Once does the Infected PCs make a request

the Binary accepts requests and answers accordingly - the exact definition of a server, it hardly matters who initiates the connection whether the server or the client.

So by definition calling the Stub/Binary a server is absolutely correct

Absolutely Incorrect.
Client/Server communication is SIMPLISTIC
The fact the roles have been reversed changes nothing.

Infected terminal (CLIENTS) connect to the Master (Server) and await commands.

This is the literal definition of client/server communication.

The Programmer of one of the most popular R.A.T.s on the HF market confirms this exact principal in his OWN software.

[Bo Burnham]

This is great!

Hopefully this should clear it up for some people ^^

Thanks Armada :D

[Armada]

This is great!

Hopefully this should clear it up for some people ^^

Thanks Armada :D

Once in a while i try lolz :)

[Mr. Dr. Prof. Patrick]

server : https://en.wikipedia.org/?title=Server_(computing)
client-server: https://en.wikipedia.org/wiki/Client%E2%...rver_model

see this: "A client does not share any of its resources, but requests a server's content or service function."

NOWHERE does it say it matters who connects to who. funny how your argument is based on that

[Rikanono]

You are both right. you are just talking about 2 different things.

in OSI layer 4 the Server is the one that opens the port (hacker)
so if u talk about a "connection" hacker =Server slave=client

in OSI layer 7 the Server is the one that Servers you with data\information (slave)
so if you talk about an "application" hacker=client slave=Server

[Mr. Dr. Prof. Patrick]

You are both right. you are just talking about 2 different things.

in OSI layer 4 the Server is the one that opens the port (hacker)
so if u talk about a "connection" hacker =Server slave=client

in OSI layer 7 the Server is the one that Servers you with data\information (slave)
so if you talk about an "application" hacker=client slave=Server

The type of connection a R.A.T uses has already been classified as a reverse connection you can read more about it here:

https://help.gnome.org/users/vinagre/sta...se.html.en

the OP refuses to accept this and decided to bask in his own ignorance

[Vuln]

There are no misconceptions about how reverse connections work, only about the "official" client/server terminology. There are a lot of different yet widely accepted definions floating around, so I would like to know what your source is.

There's no point in arguing if you don't provide proof to back up your claims.

[Armada]

You are both right. you are just talking about 2 different things.

in OSI layer 4 the Server is the one that opens the port (hacker)
so if u talk about a "connection" hacker =Server slave=client

in OSI layer 7 the Server is the one that Servers you with data\information (slave)
so if you talk about an "application" hacker=client slave=Server

Facepalms

Honestly, What in the hell do the OSI layers have to do with people wrongly classifying Clients and servers?

And secondly, your incorrect.
The Infected machine does not serve the information to the Master host.(Hacker terminal) It connects and WAITS FOR COMMANDS.
Thus by literal network definition making it a Client machine.

This stuff is not rocket science, but simplistic networking.

[Rikanono]

*Facepalms*

Honestly, What in the hell do the OSI layers have to do with people wrongly classifying Clients and servers?

And secondly, your incorrect.
The Infected machine does not serve the information to the Master host.(Hacker terminal) It connects and WAITS FOR COMMANDS.
Thus by literal network definition making it a Client machine.

This stuff is not rocket science, but simplistic networking.

i am not incorrect.

http Webserver:

client connects to Server. Server Waits for Command. clients asks for a webpage. server servs this information.

RAT reverse connection:

slave connects to hacker. slave waits for command. hacker sends command (reqest screenshot). slave serves this information and sends the screenshot.

osi layer 4 the hacker is the server and serves the open port and waits for the connection

osi layer 7 the slaves is the server waits 4 commands and serves the requested information.

hope this clears things up now.

and i am sorry if you feel attackd by me, but i did not read your threads or posts. i just saw this thread here. so i just dont understand your reaction and why you are so pissed.