Author Topic: Development of Trojan RAT  (Read 3563 times)

0 Members and 1 Guest are viewing this topic.

Offline whitehathacker007

  • NULL
  • Posts: 1
  • Cookies: -2
    • View Profile
Development of Trojan RAT
« on: November 25, 2014, 01:48:34 am »
Hello buddies !! how are u all , i have some query!!!

I am a undergraduate student and i am going to develop a TROJAN RAT in c# kindly assist me would be it possible for me to develop it in less then 6 months. Because its my Final year project and i will dont have so much extra time.

And i am going to develop it using c# ,basic functionalities of my RAT will be.
Remotely Silent installing in Victims computer
Taking full remote control of victims computer(as his computer is at my desktop).
Keylogging
Making this RAT hidden in victims pc.
and some viral functionalities and other stuff.

Note: i am developing it as my final year project for learning purposes.it is not meant for any harmful activities..

So would be it possibe for me to develop it in 6 months...??
and also pay some light on basic components of RAT , BACKDOOR....

Offline Kulverstukas

  • Administrator
  • Zeus
  • *
  • Posts: 6627
  • Cookies: 542
  • Fascist dictator
    • View Profile
    • My blog
Re: Development of Trojan RAT
« Reply #1 on: November 25, 2014, 12:32:37 pm »
HOLY SHIT a rat in C#? yeah I don't think so. Unless you want to just show off, then I guess it fits. Otherwise it's useless in C#.

Is it possible in 6 months? yeah it's possible in 1 month too. It all goes down to amount of experience you have, which I can tell you don't have that much. If you did, you wouldn't be asking these questions.

Something tells me that you just want to do this to feel badass and to show off, or you can't think of something more practical to do. Either way it's a good idea for a project and I encourage you to do it, but you might get chewed up and shat on when you have to present it, so you'll have to be very careful to choose your wording, because obviously this is meant to cause harm and steal stuff - do bad things in other words.

Offline SanCliare

  • /dev/null
  • *
  • Posts: 9
  • Cookies: 2
    • View Profile
Re: Development of Trojan RAT
« Reply #2 on: November 25, 2014, 01:15:50 pm »
A lot of undergrads end up learning Java. You must have a good school if you're learning # as opposed to ++ (that was a general statement so CSes please don't kill me). I recommend python for RATs per the better interoperability should you decide to have a server/client on different systems or otherwise.
If you're dead set on # per school or whatever then 6 months should be more than enough time. Start gathering info on GitHub or stackoverflow. There are very seasoned developers there and I usually find my answers without even having to ask a question.

Backdoor should be easy on nix and win but depending on how fancy you want to get you may what to setup a ssh tunnel to obfuscate your IPs. Also, your rats signature will more than likely be picked up by a modern, updated virus scanner unless you're doing this in a controlled environment.

Keep us updated

Offline Deque

  • P.I.N.N.
  • Global Moderator
  • Overlord
  • *
  • Posts: 1203
  • Cookies: 518
  • Programmer, Malware Analyst
    • View Profile
Re: Development of Trojan RAT
« Reply #3 on: November 25, 2014, 01:24:08 pm »
I am not sure what the requirements of a final year project are, but we always had to do something, that is somewhat new.

As you don't seem to plan adding anything that hasn't been there before, I also question the benefit of it.
A white hat may create malware to prove a point, but those are usually not fully functional as they just have to show  that something specific works, a new spreading mechanism, a new persistance technique, a vulnerability or anything similar.

In your case you create a fully functional RAT with lots of features that possibly harm people and it will be hard to justify the purpose and the benefit in front of your supervisors or anyone you will defend your work against.
I work in that field, and that's really just well-meant advice: If you want to work in that field too and want to be recognized by other white hats, take care that you can ethically justify what you are doing.

Your time-frame is possible, depending on your programming skill and knowledge about operating systems and vulnerabilities. But in your case you can always cut down the number of features if you get into troubles.

Offline Xires

  • Noob Eater
  • Administrator
  • Knight
  • *
  • Posts: 379
  • Cookies: 149
    • View Profile
    • Feed The Trolls - Xires
Re: Development of Trojan RAT
« Reply #4 on: November 25, 2014, 10:22:28 pm »
A lot of undergrads end up learning Java.
Quite a few educational institutions have removed C# from the curriculum because Java is quite similar and far more useful to prospective graduates.  Someone well-versed in Java should have little to no issue working with C# and taking a job using the language.  There are still far more jobs available for Java developers than C# developers and it looks like the trend will continue in the near future so teaching C# seems wasteful.
You must have a good school if you're learning # as opposed to ++ (that was a general statement so CSes please don't kill me).
Okay, I won't kill you.  I tend to think the opposite(as do most well-versed coders).  C# is not a replacement for C++ and it is not even a 'C' language.  The syntax may seem similar but that is mostly because it is essentially copied from Java, which itself was created as an Object Oriented, C-style language.  Institutions teaching C# rather than C++ tend to output inferior programmers who are unable to cope with 'diversified development' or working with new and different languages.  Further, they tend to be unable to work with other platforms, which is increasingly becoming a problem.
I recommend python for RATs per the better interoperability should you decide to have a server/client on different systems or otherwise.
This doesn't make sense to me.  Why would you do this?  Can you provide an example of 'better interoperability'?  I'm not trying to troll or haze you, I truly am unsure as to what you're trying to say.
If you're dead set on # per school or whatever then 6 months should be more than enough time. Start gathering info on GitHub or stackoverflow. There are very seasoned developers there and I usually find my answers without even having to ask a question.
I have little issue with this though I think asking some questions on StackOverflow will probably not get the response the OP is hoping for.
Backdoor should be easy on nix and win but depending on how fancy you want to get you may what to setup a ssh tunnel to obfuscate your IPs.
It can, in fact, be far easier on Linux & UNIX but how useful a backdoor is might be extremely limited.  Variation between Linux & UNIX systems is pretty extreme, especially when compared to Windows systems.  At least if you have a viable RAT for Windows, it's likely to run on many hundreds of thousands of systems and provide the exact same results.  Such is not the case for Linux & UNIX.
Also, your rats signature will more than likely be picked up by a modern, updated virus scanner unless you're doing this in a controlled environment.
Okay, that is just undeniably true.  However, the term 'signature' is ambiguous and often difficult to understand.

For the OP; I strongly recommend that you research 'virus signature', 'heuristics scanning' and 'virus detection methodology' in depth.  Also, since it's inevitable, please understand that the concept of a 'crypter' is primarily shitty terminology.

I STRONGLY recommend that you take time to adequately research and explore programming deeper.  There is a great danger in such topics that often leads to skiddism.  For every tool that you find, try to remember that it is created by someone...and that means that you could create one too.  It would behoove you to learn how such technology works, and why, and experiment with creating your own tools over time.  It may take you a while, but it will be worth it.
-Xires

Spacecow

  • Guest
Re: Development of Trojan RAT
« Reply #5 on: November 26, 2014, 03:10:06 am »
Quite a few educational institutions have removed C# from the curriculum because Java is quite similar and far more useful to prospective graduates.  Someone well-versed in Java should have little to no issue working with C# and taking a job using the language.  There are still far more jobs available for Java developers than C# developers and it looks like the trend will continue in the near future so teaching C# seems wasteful.Okay, I won't kill you.  I tend to think the opposite(as do most well-versed coders).  C# is not a replacement for C++ and it is not even a 'C' language.  The syntax may seem similar but that is mostly because it is essentially copied from Java, which itself was created as an Object Oriented, C-style language.  Institutions teaching C# rather than C++ tend to output inferior programmers who are unable to cope with 'diversified development' or working with new and different languages.  Further, they tend to be unable to work with other platforms, which is increasingly becoming a problem.This doesn't make sense to me.  Why would you do this?  Can you provide an example of 'better interoperability'?  I'm not trying to troll or haze you, I truly am unsure as to what you're trying to say.I have little issue with this though I think asking some questions on StackOverflow will probably not get the response the OP is hoping for.It can, in fact, be far easier on Linux & UNIX but how useful a backdoor is might be extremely limited.  Variation between Linux & UNIX systems is pretty extreme, especially when compared to Windows systems.  At least if you have a viable RAT for Windows, it's likely to run on many hundreds of thousands of systems and provide the exact same results.  Such is not the case for Linux & UNIX.Okay, that is just undeniably true.  However, the term 'signature' is ambiguous and often difficult to understand.

For the OP; I strongly recommend that you research 'virus signature', 'heuristics scanning' and 'virus detection methodology' in depth.  Also, since it's inevitable, please understand that the concept of a 'crypter' is primarily shitty terminology.

I STRONGLY recommend that you take time to adequately research and explore programming deeper.  There is a great danger in such topics that often leads to skiddism.  For every tool that you find, try to remember that it is created by someone...and that means that you could create one too.  It would behoove you to learn how such technology works, and why, and experiment with creating your own tools over time.  It may take you a while, but it will be worth it.

Noob status: Eaten.

Offline HTH

  • Official EZ Slut
  • Administrator
  • Knight
  • *
  • Posts: 395
  • Cookies: 158
  • EZ Titan
    • View Profile
Re: Development of Trojan RAT
« Reply #6 on: November 26, 2014, 04:06:58 am »
may what to setup a ssh tunnel to obfuscate your IPs.

Thank you, I needed a good laugh

As for OP; on the subject of a fourth year project, developing malware is against my University Policy for Fourth Year Projects, unless one is in a malware-centric course. I doubt it's an odd policy either. If you were in such a course you would know quite a few better languages to go about it than C#, including ASM, and C(++). I will reserve passing judgement until you respond but I would strongly rethink this either way; if it is a RAT for a nefarious purpose, rethink your lifegoals, if its a RAT for a legitimate project, rethink your project goals.

EDIT: I did not mean to say that ASM would be a good language for developing a RAT in, more that it teaches lower level concepts that would be applicable to creating good(bad?) malware.

EDIT x2: I apologize for being slightly cunty there, it's just that SSH doesnt encrypt the IP headers. So, people can see your IP address, just not what you are saying.
« Last Edit: November 26, 2014, 04:13:27 am by HTH »
<ande> HTH is love, HTH is life
<TurboBorland> hth is the only person on this server I can say would successfully spitefuck peoples women

Offline SanCliare

  • /dev/null
  • *
  • Posts: 9
  • Cookies: 2
    • View Profile
Re: Development of Trojan RAT
« Reply #7 on: November 26, 2014, 04:41:24 am »
herpa derpa

Good advise to the OP but 90% was replied to me. Part of my field is forensics in which I find certain signature matches which tell me if a prog is malicious or not. The term signature is used quite a lot I agree.

Java is not better for prospective graduates. Java is widely used because it's easier to manage for beginners than C++ amongst other reasons. I don't agree with your opinion. Although, I do feel that Java is slowly becoming more popular than C++ as well as for business applications.  As for #, I've never used it so I can't comment on its similarities to Java.

I noticed my RAT comment, for some reason I was thinking of reverse TCP payloads being different for windows and nix. Hence, using a language that would offer easy ports to different systems. If you say otherwise then the OP should be set. I might be misunderstanding Python since it's the language I'm learning now.

snip snip

Ahh, I see what u meant. I've created tunnels to hide my IPs in the past. I honestly thought it was a well know procedure. Perhaps, it's I that should have the chuckle (no sarcasm intended). It's basically on similar principles as a VPN but whatever OP shouldn't need it for this project.

Staff note: double post MERGED
« Last Edit: November 26, 2014, 09:14:10 am by Kulverstukas »

Offline madf0x

  • Knight
  • **
  • Posts: 172
  • Cookies: 50
    • View Profile
Re: Development of Trojan RAT
« Reply #8 on: November 26, 2014, 04:55:40 am »

Ahh, I see what u meant. I've created tunnels to hide my IPs in the past. I honestly thought it was a well know procedure. Perhaps, it's I that should have the chuckle (no sarcasm intended). It's basically on similar principles as a VPN but whatever OP shouldn't need it for this project.

I know what youre referring to. Cases where you have ssh access on some box(legit or otherwise), and setup a ssh tunnel to forward your traffic.

You can even setup ssh into pretty much a vpn clone too(in terms of functionality) but that requires some more obscure options. Guides abound on the web for it though(or read the man pages)

Offline HTH

  • Official EZ Slut
  • Administrator
  • Knight
  • *
  • Posts: 395
  • Cookies: 158
  • EZ Titan
    • View Profile
Re: Development of Trojan RAT
« Reply #9 on: November 26, 2014, 05:05:11 am »

Ahh, I see what u meant. I've created tunnels to hide my IPs in the past. I honestly thought it was a well know procedure. Perhaps, it's I that should have the chuckle (no sarcasm intended). It's basically on similar principles as a VPN but whatever OP shouldn't need it for this project.

I shall assume you meant setting up a tunneling server on a rooted box(or hell even a legitimately owned VPS), very possible yes, but your passing comment didn't imply that at all. It seemed to imply you (incorrectly) thought that a SSH connection inherently hid your IP address.

And please remember that no many times you chain them together, there's at least one link that shows your correct IP address, and one link that has the correct server IP address plainly visible. Not really an issue unless you are being actively tracked ofc.

And yes, for a purely whitehat exercise as OP claims this is, he shouldn't need to hide his identity at all.
<ande> HTH is love, HTH is life
<TurboBorland> hth is the only person on this server I can say would successfully spitefuck peoples women

Offline DrFrankenstein

  • NULL
  • Posts: 1
  • Cookies: 0
  • successor to BCPL
    • View Profile
    • Matrix Computer
Re: Development of Trojan RAT
« Reply #10 on: November 26, 2014, 07:08:10 am »
Oh oh did someone say the "T" word? I remember my 1st experience with a Trojan. Along time ago in a galaxy far away I infected myself with sub7. Downloaded it and clicked on that thing called "server" Haha.

I can also remember the 1st Trojan I made in Visual Basic. It was buggy and clunky but it worked. I went to a site that had source codes, I downloaded a bunch of R.A.T. codes, took some of the good bits from each one. I slapped it together spending most of the time adding stuff to it and making the Server as small and invisible as I could.  I tested it on my friends computer, scanned it with anti-virus, anti-trojan software, and the piece of crap worked. I couldn't believe it and at the time I thought it was soo great. Now its something to laugh at. As retarded as it was I did learn some things. 

Its very possible in 6 months good for learning stuff...... but developing it as a final year project? I don't think thats the best idea.

Offline Xires

  • Noob Eater
  • Administrator
  • Knight
  • *
  • Posts: 379
  • Cookies: 149
    • View Profile
    • Feed The Trolls - Xires
Re: Development of Trojan RAT
« Reply #11 on: November 26, 2014, 09:04:15 am »
Good advise to the OP but 90% was replied to me.

Yes, that's true; 90% was replied to you, not the OP.  That's pretty common around here so until now I hadn't considered it rude.  I guess it kinda is, though.

@OP; hope you don't mind.

Part of my field is forensics in which I find certain signature matches which tell me if a prog is malicious or not. The term signature is used quite a lot I agree.

What type of 'signature' is it?  How do you define the signature?  Is it based upon a series of bytes found to be similar to known infections or is it more in-depth?  Binary pattern searches tend to yield lots of false-positives and are easily avoided with repackaging, which can be automated.  Other methods, often employed by intelligent 'real-time' protection processes, include API monitoring and memory scanning.  So, what other methods do you use?  Is your use of "signature" merely the binary pattern or is there more to it?

Java is not better for prospective graduates.

Many schools in Europe dropped C# courses, favouring Java instead.  The reason for this is not that Java is 'easier' than other languages but rather that there are more developer opportunities world-wide for Java developers than C#.  Also, because of the similarities between Java & C#, a student well-versed in Java can conceivably also get a job doing C# with little trouble.  In this way, Java is far more valuable in a student's arsenal than C#.  Java is supported on numerous platforms and by multiple operating systems.  C#, by comparison, has very little support.  Though the 'mono' project is attempting to bring .NET support to other platforms, it's not nearly as mature or featureful.  To be plain, Java is just 'better'; more flexible, more featureful, more capable, better support, more popular, etc.

It's vital for the future of an educational institution to be able to ensure viable employment for graduates.  Thus, because Java developers have far better employment possibilities, it's vital for them to teach Java.  Now you may wonder why they wouldn't teach both languages.  Well, teaching a language involves some cost for the institution and requires more of students.  Making both courses required would extend the number of courses, and thus the amount of time, to obtain a graduate degree.  After some deliberation, it was determined that the costs for teaching C# were higher than potential benefits.  The fact that Java developers could more easily adapt to a C# environment than vice-versa helps to illustrate that spending resources on teaching C# is effectively a waste, even with special support from Microsoft.  Do understand, however, that this was primarily in Europe(and potentially other areas).  In the US, an educational institution escaping Microsoft isn't really an option.

Java is widely used because it's easier to manage for beginners than C++ amongst other reasons. I don't agree with your opinion. Although, I do feel that Java is slowly becoming more popular than C++ as well as for business applications.  As for #, I've never used it so I can't comment on its similarities to Java.

Java sources are easier to deploy on multiple platforms than C++ simply because the sources compile for a virtual machine rather than depending upon specific features provided by the underlying system's C++-supporting implementation.  POSIX is pretty widely supported with the primary exception being Windows.  This one [very sad] fact means that porting C++ programs to and from Windows is made a bit more difficult than Java.

The .NET platform was created to utilize similar features as Java.  That is; code is 'compiled' to run within a supporting platform rather than running on the native system.  Java does this by porting the JVM to various systems and then code need only be compiled for the JVM..it never actually runs on the native system.  .NET then does the same, relying upon programs to provide support for the .NET framework.  Thus, in the same way, .NET code never actually runs on the native system.  However, .NET is heavily flawed as it is still designed with a heavy Windows prejudice.  This means that creating a proper port(aka 'mono project') is hindered because underlying systems adhere to actual standards established by parties outside of Microsoft.

My 'opinion' that educational institutions that teach or at least focus on C#/Java instead of C++ are crappier than those which provide adequate education of C, C++, and preferably ASM is largely due to the percentage of graduates that wouldn't properly understand the above paragraphs with respect to system implementation support.  Additionally, many students of such institutions tend to learn(or otherwise assume) that C++ is a replacement for C and thus C# is a replacement for C++.  Neither are true.  Furthermore, I'm admittedly very biased; I prefer lower-level development(like OS & embedded development).  That means I'm far more interested in designing & implementing the JVM or the .NET framework support than in using the language.  You cannot create the JVM in Java; it must be written in C, C++ or some other language that compiles to run natively(and preferably something that can actually do ASM...just try doing inline assembly in C#).  Likewise, you cannot create support for the .NET framework using .NET.  Certainly an operating system cannot be created strictly in .NET or Java(they've tried...they failed).

And so, I surrounded the term "opinion" in single-quotes(apostrophes) above because it is not just an opinion; it is fact.

I noticed my RAT comment, for some reason I was thinking of reverse TCP payloads being different for windows and nix. Hence, using a language that would offer easy ports to different systems. If you say otherwise then the OP should be set. I might be misunderstanding Python since it's the language I'm learning now.

Actually, using Python wouldn't be a bad idea as a start.  However, I wouldn't want to deploy it as a script on a remote system.  For that, you definitely want a compiled EXE.  However, using Python for development could ease many things along, especially rapid feature additions.  If nothing else, it'd be good for developing the structure before moving to another language.

I guess I understand your thoughts on portability but again, it'd have to be compiled for the target as you can't expect a Python interpreter to be installed and easily accessible.  However, none of that would matter for TCP between systems.
« Last Edit: November 26, 2014, 09:10:47 am by Xires »
-Xires

Offline SanCliare

  • /dev/null
  • *
  • Posts: 9
  • Cookies: 2
    • View Profile
Re: Development of Trojan RAT
« Reply #12 on: November 26, 2014, 10:21:09 pm »
^Yes, I understood your bias from your initially reply. It wasn't your message but your push towards your Java preference over #. Java was part of my undergrad so I understand the JVM, thanks. Thats great info to post in on this site for those that aren't aware.

I'm not arguing the fact that the OP may have better luck with Java... Or especially Java Script (obviously I understand it's not the same as Java) but I hope you don't think I'm one of those nuts that thinks C++ is an iteration of C. At this point, I prefer C++ over Java. I think both are great languages but I like C++'s ability to handle cache/RAM more efficiently. Moreover, at this point I'm learning Python so send me a PM if you want to continue. Otherwise, replies should be for the OP

Offline Stackprotector

  • Administrator
  • Titan
  • *
  • Posts: 2515
  • Cookies: 205
    • View Profile
Re: Development of Trojan RAT
« Reply #13 on: November 26, 2014, 11:14:06 pm »
but I like C++'s ability to handle cache/RAM more efficiently
Well okay...


Anyhow,

OP: I am pretty sure your education doesn't want you to actually write a fully functional piece of mallware but rather find out how everything works and document that. Python would be great to write an PoC remote administration toolkit and you can even do some hiding and obfuscation.  I don't know what kind of level you are at school but by the sounds of it i don't advise you to get into very complicated evasive tech etc.
~Factionwars

Offline 0E 800

  • Not a VIP
  • VIP
  • Baron
  • *
  • Posts: 895
  • Cookies: 131
  • • тнε ιηтεяηεт ιs мү яεcүcℓε-вιη •
    • View Profile
Re: Development of Trojan RAT
« Reply #14 on: November 26, 2014, 11:24:53 pm »
Remote Access Trojan + 9000 = Trojan Remote Access Trojan or TRAT.

First thing I noticed and realized OP has no clue.

Maybe took a programming class with delusions of creating the next WOW then realized it takes an army of programmers for that, so decides hes gonna make a RAT. Doesn't know much about hacking, so joins EZ hoping to copy-paste free-bee 0day code.

@OP I suggest creating a portable webserver.
Check out srvdir.net and then check out the sourcecode here: https://github.com/inconshreveable/srvdir


Edit: my bad, just realized you want to code it in C#.
srvdir is coded with Go. You can learn it here:
https://golang.org/

Here are some C# projects you can work with:

Simple HTTP Server in C#
http://www.codeproject.com/Articles/137979/Simple-HTTP-Server-in-C

DarkAgent RAT mostly coded in C#
https://www.openhub.net/p/darkagentrat

SharpBot RAT written in C#
http://sourceforge.net/projects/sbrat/
« Last Edit: November 26, 2014, 11:33:28 pm by 0E 800 »
The invariable mark of wisdom is to see the miraculous in the common.