Viralmaniar/Powershell-RAT Viralmaniar/Powershell-RAT

  • Stars
    star
    1,034
  • Rank 44,573 (Top 0.9 %)
  • Language
    Python
  • Created over 6 years ago
  • Updated about 2 years ago
Twitter logo Share LinkedIn logo Share Facebook logo Share
Viralmaniar/Powershell-RAT
github

Viralmaniar

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Python based backdoor that uses Gmail to exfiltrate data through attachment. This RAT will help during red team engagements to backdoor any Windows machines. It tracks the user activity using screen capture and sends it to an attacker as an e-mail attachment.

Powershell-RAT

Python based backdoor that uses Gmail to exfiltrate data as an e-mail attachment.

This RAT will help someone during red team engagements to backdoor any Windows machines. It tracks the user activity using screen capture and sends the information to an attacker as an e-mail attachment.

Note: This piece of code is Fully UnDetectable (FUD) by Anti-Virus (AV) software.

This project must not be used for illegal purposes or for hacking into system where you do not have permission, it is strictly for educational purposes and for people to experiment with.

Any suggestions or ideas for this tool are welcome - just tweet me on @ManiarViral

RAT Architecture Diagram

image

Screenshot

On the first run of the Powershell-RAT user will get options as below:

image

Using Hail Mary option to backdoor a Windows machine:

image

Successfully taking screenshots of the user activity:

image

Data exfiltrated as an email attachment using Gmail:

image

My Windows machine do not have Python installed, what should I do?

  • Compile PowershellRAT.py into an executable using Pyinstaller

  • PyInstaller is available on PyPI. You can install it through pip:

pip install pyinstaller

Setup

  • Throwaway Gmail address
  • Enable "Allow less secure apps" by going to https://myaccount.google.com/lesssecureapps
  • Modify the $username & $password variables for your account in the Mail.ps1 Powershell file
  • Modify $msg.From & $msg.To.Add with throwaway gmail address

How do I use this?

  • Press 1: This option sets the execution policy to unrestricted using Set-ExecutionPolicy Unrestricted. This is useful on administrator machine

  • Press 2: This takes the screenshot of the current screen on the user machine using Shoot.ps1 Powershell script

  • Press 3: This option backdoors the user machine using schtasks and sets the task name to MicrosoftAntiVirusCriticalUpdatesCore

  • Press 4: This option sends an email from the user machine using Powershell. These uses Mail.ps1 file to send screenshot as attachment to exfiltrate data

  • Press 5: This option backdoors the user machine using schtasks and sets the task name to MicrosoftAntiVirusCriticalUpdatesUA

  • Press 6: This option deletes the screenshots from user machine to remain stealthy

  • Press 7: This option backdoors the user machine using schtasks and sets the task name to MicrosoftAntiVirusCriticalUpdatesDF

  • Press 8: This option performs all of the above with a single button press 8 on a keyboard. Attacker will receive an email every 5 minutes with screenshots as an email attachment. Screenshots will be deleted after 12 minutes

  • Press 9: Exit gracefully from the program or press Control+C

Questions?

Twitter: https://twitter.com/maniarviral LinkedIn: https://au.linkedin.com/in/viralmaniar

Contribution & License

Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 International License.
Want to contribute? Please fork it and hit up with a pull request.

Any suggestions or ideas for this tool are welcome - just tweet me on @ManiarViral

To Do

  • Encrypted exfil over Gmail to defeat SSL inspection
  • Get photos from front camera
  • Record mic

More Repositories

1

BigBountyRecon

BigBountyRecon tool utilises 58 different techniques using various Google dorks and open source tools to expedite the process of initial reconnaissance on the target organisation.
C#
1,188
star
2

Passhunt

Passhunt is a simple tool for searching of default credentials for network devices, web applications and more. Search through 523 vendors and their 2084 default passwords.
Python
1,177
star
3

I-See-You

ISeeYou is a Bash and Javascript tool to find the exact location of the users during social engineering or phishing engagements. Using exact location coordinates an attacker can perform preliminary reconnaissance which will help them in performing further targeted attacks.
Shell
765
star
4

SMWYG-Show-Me-What-You-Got

This tool allows you to perform OSINT and reconnaissance on an organisation or an individual. It allows one to search 1.4 Billion clear text credentials which was dumped as part of BreachCompilation leak. This database makes finding passwords faster and easier than ever before.
Python
422
star
5

Wifi-Dumper

This is an open source tool to dump the wifi profiles and cleartext passwords of the connected access points on the Windows machine. This tool will help you in a Wifi penetration testing. Furthermore, it is useful while performing red team or an internal infrastructure engagements.
Python
269
star
6

Remote-Desktop-Caching-

This tool allows one to recover old RDP (mstsc) session information in the form of broken PNG files. These PNG files allows Red Team member to extract juicy information such as LAPS passwords or any sensitive information on the screen. Blue Team member can reconstruct PNG files to see what an attacker did on a compromised host. It is extremely useful for a forensics team to extract timestamps after an attack on a host to collect evidences and perform further analysis.
Python
207
star
7

XposedOrNot

XposedOrNot (XoN) tool is to search an aggregated repository of xposed passwords comprising of ~850 million real time passwords. Usage of such compromised passwords is detrimental to individual account security.
Python
136
star
8

PeekABoo

PeekABoo tool can be used during internal penetration testing when a user needs to enable Remote Desktop on the targeted machine. It uses PowerShell remoting to perform this task. Note: Remote desktop is disabled by default on all Windows operating systems.
Python
132
star
9

Phirautee

A proof of concept crypto virus to spread user awareness about attacks and implications of ransomwares. Phirautee is written purely using PowerShell and does not require any third-party libraries. This tool steals the information, holds an organisationโ€™s data to hostage for payments or permanently encrypts/deletes the organisation data.
PowerShell
115
star
10

MurMurHash

This little tool is to calculate a MurmurHash value of a favicon to hunt phishing websites on the Shodan platform.
Python
113
star
11

HiveJack

This tool can be used during internal penetration testing to dump Windows credentials from an already-compromised host. It allows one to dump SYSTEM, SECURITY and SAM hives and once copied to the attacker machines provides option to delete these files to clear the trace.
C#
108
star
12

In-Spectre-Meltdown

This tool allows to check speculative execution side-channel attacks that affect many modern processors and operating systems designs. CVE-2017-5754 (Meltdown) and CVE-2017-5715 (Spectre) allows unprivileged processes to steal secrets from privileged processes. These attacks present 3 different ways of attacking data protection measures on CPUs enabling attackers to read data they shouldn't be able to. This tool is originally based on Microsoft: https://support.microsoft.com/en-us/help/4073119/protect-against-speculative-execution-side-channel-vulnerabilities-in
Python
93
star
13

DDWPasteRecon

DDWPasteRecon tool will help you identify code leak, sensitive files, plaintext passwords, password hashes. It also allow member of SOC & Blue Team to gain situational awareness of the organisation's web exposure on the pastesites. It Utilises Google's indexing of pastesites to gain targeted intelligence of the organisation. Blue & SOC teams can collect and analyse data from these indexed pastesites to better protect against unknown threats.
C#
36
star
14

Guided-Access-Mode-Bypass

This write-up will provide detailed description on how to bypass Guided Access mode on Apple iPhones.
18
star
15

Reg-Hives

This tool can be used during internal penetration testing to dump Windows credentials from an already-compromised host. Use it to copy SYSTEM, SECURITY and SAM hives and download them back to the attacker machines.
Python
15
star
16

Pentest-Stuff

DIGITAL Command Language
11
star
17

Viralmaniar

6
star
18

Flubber-Ducky

2
star
19

Pentest-Payloads

2
star
20

viralmaniar.github.io

JavaScript
2
star
21

Information-Security-Links

Access to awesome blogs and tutorials related to information security field.
1
star
22

OSCE_learning

1
star
23

JavaScript_Code_Snippets

1
star
24

Javascript

Short snippets for pentesting.
1
star