Botnets and RATS

Are there any botnet herders here, if so what tools do you use? How much money is in it?

Bumping for interest. I've always wanted to know how these things work in a technical level.

Its an interesting topic, it raised an eyebrow for me when github got attacked by a botnet causing it to be down for 5 days (link here https://arstechnica.com/security/2015/03/massive-denial-of-service-attack-on-github-tied-to-chinese-government/) Personally it would be interesting to see how it would be possible to exploit such a large amount of people, and how easy/hard it would be to gather and maintain such a large network.

>>472 basically you make a virus that embeds itself permanently in the host computer and spreads itself, then listens for commands from a command&control server(which is also generally an infected computer receiving commands over tor).

The most secure and redundant way to run your network is AFAIK by using your botnet as a private Tor network and putting the related entrance nodes and directory servers as hidden services into the public Tor network. Was there any botnet that actually used this technique?

>>476 >>472 I hear infecting iot devices like security cammeras or printers instead of computers are all the rage these days. Way too many of them have default passwords set up.

>>501 100% right. Mirai was the biggest botnet ever a while back(it's open-source!), and it infected mostly that kind of thing. However, it's really easy to add them to blocklists, since they never have a reason to connect to websites. IIRC Mirai can barely pull 100 gigabits anymore.

>>502 >Open source Oh soykaf thanks a lot, I always wanted to see how these are made. Are there any other resources on malware / botnet code examples?

Sorry to derail your thread into more of a botnet general, but I'll take the opportunity to introduce the Internet Census 2012 to any who've not heard of it. It really is quite amazing. https://internetcensus2012.bitbucket.io/paper.html

>>509 I'm not as tech savy as half of you on here, but that is insane. Isn't even that complicated but so potentially devastating (i guess).

>>506 I can upload an older iot botnet source code if you want and give you a break down of mirai if you want anon, and I throw in a simple version of an installer script if you guys want. But I'll say this now, don't try and run these things, looking only, as these thing are really easy to pick up and an easy third of the bots you pull are now docker and vshpere sink holes and conpots.

>>514 A breakdown would be cool

>>514 I've been trying to playaround with zeus sourcecode to see how it works, but I can't set it up because I have brain problems

>>515 would be sweet for the lainzine 5

>>514 What if you run it contained under a bunch of VMs?

>>514 >>519 This. I'm very interested in writing my own "botnet" minus the copying itself bits for management of my personal computers. Some port knocking, making secure HTTP requests, a little shell capability, and something like Ansible for orchestration all tied into a nice command and control web-ui.

I am not a botnet herder but I have worked on command and control software and solutions for managing large distributing computing infrastructure. Personally I have seen software written in Python, C,Perl, Erlang and Scheme to act as distributed agents on computers or networking hardware for monitoring and control or as a remote administration tool, that either leveraged a daemon listening on a socket to run arbitrary or a fixed set of commands. Please find the following resources on botnets and associated tools. Presentations Defcon First Attachment Defcon 18 Resilient Botnet Command and Control with Tor https://www.defcon.org/images/defcon-18/dc-18-presentations/D.Brown/DEFCON-18-Brown-TorCnC.pdf Presentation https://www.youtube.com/watch?v=X7kkwOjsFQA https://media.defcon.org/DEF%20CON%2018/DEF%20CON%2018%20video%20and%20slides/DEF%20CON%2018%20Hacking%20Conference%20Presentation%20By%20Dennis%20Brown%20-%20Resilient%20Botnet%20Command%20and%20Control%20with%20Tor%20-%20Video%20and%20Slides.m4v Second Attachment Defcon 20 Botnets Die Hard Owned and Operated https://www.defcon.org/images/defcon-20/dc-20-presentations/Sood-Enbody/DEFCON-20-Sood-Enbody-Botnets-Die-Hard.PDF.pdf Presentation https://www.youtube.com/watch?v=Og0av8zLYQQ https://media.defcon.org/DEF%20CON%2020/DEF%20CON%2020%20video%20and%20slides/DEF%20CON%2020%20Hacking%20Conference%20Presentation%20By%20Aditya%20K%20Sood%20and%20Richard%20J%20Enbody%20-%20Botnets%20Die%20Hard%20-%20Owned%20and%20Operated%20-%20Video%20and%20Slides.m4v Third Attachment DEFCON XXI How my Botnet Purchased Millions of Dollars in Cars & Defeated the Russian Hackers https://www.defcon.org/images/defcon-21/dc-21-presentations/Schrenk/DEFCON-21-Schrenk-How-my-Botnet-Defeated-Russian-Hackers.pdf Presentation https://www.youtube.com/watch?v=sgz5dutPF8M https://media.defcon.org/DEF%20CON%2021/DEF%20CON%2021%20video%20and%20slides/DEF%20CON%2021%20Hacking%20Conference%20Presentation%20By%20Michael%20Schrenk%20-%20How%20my%20Botnet%20Purchased%20Millions%20of%20Dollars%20in%20Cars%20-%20Video%20and%20Slides.m4v There are at least 4 other talks on bot nets from Defcon available as both slides and video from https://media.defcon.org/. For media from BlackHat see http://www.blackhat.com/html/archives.html , for additional presentations and research papers as attachments see the follow up post. Whitepapers and analysis of botnets Build your own Botnet whitepaper from SANS Information Security Reading Room. https://www.sans.org/reading-room/whitepapers/threats/byob-build-botnet-33729 IOActive Reversal and Analysis of Zeus and SpyEye Banking Trojans https://ioactive.com/pdfs/ZeusSpyEyeBankingTrojanAnalysis.pdf Incapsula Analysis of Mirai Botnet https://www.incapsula.com/blog/malware-analysis-mirai-ddos-botnet.html Wiki resources https://en.wikipedia.org/wiki/Category:Botnets https://www.botnets.fr/wiki/Main_Page https://en.wikipedia.org/wiki/Category:Remote_administration_software Botnet Research https://github.com/anfractuosity/botnet-research-papers Source Code on Github / elsewhere Botnets and RATS https://github.com/jgamblin/Mirai-Source-Code https://github.com/anthonygtellez/BASHLITE https://github.com/whitepacket/ZIB-Trojan https://github.com/quasar/QuasarRAT https://github.com/n1nj4sec/pupy https://github.com/c4bbage/xRAT https://github.com/rodzzlessa24/botnet https://github.com/malwares/Botnet https://github.com/fdiskyou/malware https://github.com/sweetsoftware/Ares https://github.com/moloch--/Yoshimi-Botnet https://github.com/3val/Athena https://github.com/Visgean/Zeus/ https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/turbot/Turbot_HES2010.zip Botnet tools https://github.com/pjlantz/Hale https://github.com/bwall/BAMF https://github.com/rshipp/awesome-malware-analysis (other more general tools)

>>1198 First Attachment Million Browser Botnet Presetation from BlackHast USA 13. https://media.blackhat.com/us-13/us-13-Grossman-Million-Browser-Botnet.pdf Presentation https://www.youtube.com/watch?v=m1lCr6707Cs Second Attachment Turbot Next Generation Botnet Presentation from HACKITO ERGO SUM 2010 http://www.hackitoergosum.org/2010/HES2010-ikolter-zgadot-Turbot-Next-Generation-Botnet.pdf Presentation: https://www.youtube.com/watch?v=yXNlyFa6JLU (first part of eleven) Third Attachment https://www.defcon.org/images/defcon-20/dc-20-presentations/Alonso-Sur/DEFCON-20-Alonso-Sur-Owning-Bad-Guys-Using-JavaScript-Botnet.pdf Presentation https://www.youtube.com/watch?v=xDslqMCaLZM https://media.defcon.org/DEF%20CON%2020/DEF%20CON%2020%20video%20and%20slides/DEF%20CON%2020%20Hacking%20Conference%20Presentation%20By%20Chema%20Alonso%20and%20Manu%20The%20Sur%20-%20Owning%20Bad%20Guys%20And%20Mafia%20With%20Javascript%20Botnets%20-%20Video%20and%20Slides.m4v

>>1199 Research / White Papers First Attachment Your Botnet is My Botnet: Analysis of a Botnet Takeover https://seclab.cs.ucsb.edu/media/uploads/papers/torpig.pdf Second Attachment Botnet over Tor: The Illusion of Hiding https://ccdcoe.org/cycon/2014/proceedings/d3r2s3_casenove.pdf Third Attachment Trend Micro 2006 Taxonomy of Botnet Threats http://www.cs.ucsb.edu/~kemm/courses/cs595G/TM06.pdf

>>1200 >>1199 >>1198 Thanks Lain! Share more materials if you have please! I'm very interested learning about botnets. In your opinion, which is the best botnet for a beginner to learn how it works? I've seen few tutorials, I'm about to try zeus, however I didn't understood how to setup the server. I want to set up a server using tor and try to access it using my computer. Any ideas on how to proceed? Do I just need xammp running and tor? If so, how should I configure it? >>514 Please upload, Lain!

I've set up a zeus botnet at my localhost, but I still have two doubts. Firstly, is there any way to execute the bot.exe without the user notice or grant permission? (Pic related.) And secondly, how can I spread a real botnet? Witch is the better way? I read somewhere about seeding torrents and proxys. But how does it really work? please don't let this thread die.

>>1301 You pack the bot with some other software. Say make a custom installer for some newly released cracked vidya that actually installs said game (don't wanna cause suspicion) and additionally installs your bot (and sets up firewall rules / services / scheduled tasks for it). Users will just click through UAC because they'll think they're installing call of duty or whatever. Which they are after all. And yeah, to spread it, you make a torrent of your custom installer and seed it. Now most people won't bother downloading a torrent with only 1 seed, which is where the proxies come into play. Never did this part myself so I might be talking bullsoykaf but I assume people just send fake announce requests to the tracker through random proxies to make it look like there's more seeders?

>>1462 Thanks, Lain. Do you have any more tips or advice to make my bot more "invisible" to Antivirus, UAC, and the Windows firewall itself? I'm going to try to spread it through torrents. But I'm still very curious about the proxy method. If I discover something new I report here!

>>1469 Often times making something invisible to AV just requires compiling in an different dev environment since the AV definitions are typically signatures of whole files and each dev environment will have unique components. If you don't have access to the source, you could probably just hexedit to modify some of the strings so as to make a change that will not break the program but would alter the hash. IIRC UAC can be bypassed with some powershell tricks, but I think powershell is still disabled by default in a lot of environments. I'd question if your botnet even needs to run as admin however; seems the better malware these days just installs as a scheduled task with user permission. Disabling or reconfiguring the firewall to allow a service is pretty simple if you can avoid UAC, although it seems like the more popular method these days is to avoid listening on a port and simply have your bots proactively check-in with the C&C server on some schedule. Most firewalls still aren't concerned with outbound connections so this avoids the issue. tldr; principle of least privilege applies to malicious software too :P

Mirai botnet was all the rage few months ago I guess you could still hit 100k bots on it now

>>490 >>1112 >Some port knocking Why? Port knocking is cool, but not particularly beneficial for this. Are you trying to hide the existence of your C&C server? Port knocking isn't going to help you there because the only people who are going to discover the address of your C&C server are malware analysists who are one wireshark log session away from knowing the port knocking scheme. It's cool, but it doesn't provide much security. Additionally, if you're using port knocking, you're much, much more likely to have your bot's connection to the C&C blocked by firewall rules. If you're worried that non-bots will connect to your server, use public keys to authenticate your bots instead. >>1301 It's been said that the quickest way to spread malware is to grab a few recent browser exploits, find a sketchy ad company that lets you use javascript in your ads, make an ad that uses the exploits for drive-by downloads, then pay the ad service for a few thousand views. Packing malware into recently cracked popular software and torrenting it, as >>1462 said, is also common. You can also claim it's anything that you think will get a lot of attention and post it somewhere on the Internet. It doesn't even have to be particularly well-hidden. I saw one user of an old onionland hacking forum claim that he had success RATing a few computers by simply posting an exe to 4chan and claiming it was Amanda Todd's nudes shortly after she killed herself. Of course, there are other ways to spread malware. If you can find a remote exploit for your target system, you can just scan the whole internet and use that to infect computers. This is less common now because of firewalls and such vulnerabilities being less common. Get creative. How do you think you could trick people into running a program? Alternatively, drop some money on a 0-day browser exploit and infect tons of people. >>1469 If you're writing your own bot completely from scratch, it will probably be undetectable by AV for a while, since they largely rely on file signatures and they don't know yours, yet. . However, some AV uses behavioral analysis. It might run your program in a sandbox and see what it does. One common way of circumventing this check is having your malware wait a certain period of time before becoming active. Of course, AV knows this, so now some will speed up the time of the sandbox so that your malware will run. Thus, to circumvent it, people started writing malware that waited for a certain number of keystrokes or mouse movement before it ran, and now AV will simulate that. Try to think of your own ways to delay running to avoid AV sandbox tests. Additionally, you can avoid doing anything that will trigger AV, like editing certain registry values. However, finding out what AV is triggered by what behavior can be hard, since they don't exactly make those things public. Once your bots begin being detected by AV, you can use crypters to change their signature. Just be careful to use (or write) a good crypter, as some crypters' decryption code is detected by AV and others will break your code. You'll need to research for the latest UAC bypassing techniques, or pay money for 0-day exploits for it. It may be the case, like >>1474 said, that you don't need admin privileges. You don't need admin privileges to have a bot connect to the C&C, or to do most of the common tasks bots do (DDoSing, proxy servers, etc). Instead of disabling the firewall, you should just architect your client-server protocol in such a way that Window's default firewall doesn't catch it. For example, if your server is on port 80 and accepts HTTP/HTTPS requests, then you'll probably be golden. And, of course, anywhere that I said "pay for 0-days" could be replaced with "find your own 0-days" if you have the skills.

>>1480 I've tried to get in on this stuff before using premade RAT software that's free or cracked but I've always gotten stuck at crypting it. I'd like to get a crypter that I can easy know how to change to make it fud after it becomes detected.

This has already been posted but this is a android rat https://github.com/AhMyth/AhMyth-Android-RAT

I used to when I was in HS. Did it for the kicks mostly. I had 250k worldwide, then I just got bored and gave them to one of my friends. From technical perspective it was kinda meh, the bot was written in C++, backend in PHP + the software to manage the backend in VB, because I wanted it to work like a desktop program and not a web C&C. I used multiple free webhosts to split the traffic and make it a bit more bulletproof (if one backend dies, the bots will use choose another at random). Traffic was basic https. Functionality was basic management functions like delete/update/download and execute, start and stop keylog (because I didn't have the skills or patience for form grabbing) and TCP/UDP packet craft, which could be used to DDoS. I later added a HTTP flood function to it.

>>1542 Oh and for the other software, I made a crypter with binder fuctionality in VB6, it had an USG function which was a bitch to make, but payed off. Took a year for every scanner to pick the stubs up.

>>1542 >>1543 >not implementing cryptominers >not selling your DDoS services I know it was HS, but you should come back dude

>>1521 How would I go about changing the code so that instead of inputting the ip of the target before hand, I just input the ip I want it to connect to? Then have a port listening on my server botnet CnC style

If you are considering getting into the botnet business or any other illegal computer activity, I strongly encourage you to reconsider. You can make a very comfortable living with perfectly honest means. Prison is not kind to scrawny hacker kids. Plus, it's weak as sh*t do some real research with that energy ffs.

>>1547 Is there possible to implement it on AhMyth?

>>1627 Eh, only an issue if you get caught.

here's a opensource rat to look at! https://n0where.net/free-open-source-remote-administration-tool-for-windows-quasarrat/

>>473 That was just a simple ddos, because their government have a too thin skin. Pathetic.

I always find botnet source code interesting to read. This is the source code for Athena bot. It has HTTP and IRC C&C options and various floods and DDOS options. https://github.com/3val/Athena

Anyone ever used Crimson RAT/XAT? It was a multi OS Java Rat that could generate, JARs, EXEs, APKs and IAPs though the free version had only JAVA stub generators. I've got version 3.0.0, and I'm wondering if anyone has any better versions. The developers site is down so...

Is there a way to RAT without using a third party dns like noip etc? That's also secure/safe?

>>3583 Buy a domain with cryptocurrency over Tor. Let it age for a bit. Clone the website of a dyndns provider, have an excuse about new account registration being disabled at the moment. Make sure you have an abuse email. Create some subdomains going to benign content and feed them into virustotal and other feeds. Finally create a subdomain for your RAT. You will get a nice email letting you know when it is time to rotate your subdomain. Make sure to reply about how you are banning the user and fish for as much information about how your malware was detected as possible.

>>1552 I believe this is what the RAT is doing, you input the C&C IP when you compile the app.

>>3583 Host your C&C as a hidden service, then use a service like onion.to to connect to it, or integrate support for connection to hidden services over Tor into your RAT.

>>3583 I use ngrok as an alternative to ddns, since you can proxy everything, use a fake email/info for registration, and the best thing you don't even need to have access to the router or open a door. It's something quite new to me too, but fell fre to ask. But for a cc a .onion is the best choice as >>3627 Said.

>>3630 free*

>>3630 Here, i found out that ngrok has a big issue, when you reset your service, it changes the port. I read the manual, but unfortunately only pro/businesses clients can have a reserved port. Does anyone knows some free service like this?

>>3630 Seems like that would only be useful for very targeted usage since the free plan has such a low connection limit and they would undoubtedly ban you if someone reported it.

>>1841 "They'll never catch me!" t. everyone before they got caught

>>4131 "They'll never catch me!" t. everyone who didn't get caught your point?

What's the best way to hide AhMyth so that it isn't detected? Or just another Android/mobile RAT

>>4137 id figure a standard crypter would work.

>>1627 >You can make a very comfortable living with perfectly honest means. try saying that to the people who can't pass HR

>>4141 Any recommendations?

>>4145 the hard part is finding a crypter that a. isin't already flagged b. doesnt break your code c. isn't backdoored People usually sell crypts for your files, send the file, they encrypt it for a fee

>>4147 Hmm, how hard would it be to just encrypt it myself?

I'm not even going to pretend it's not a skid question, but everyone's gotta start somewhere. Is there any stealth rat for windows (7/8/10) that acts like a sort of remote shadow user session?

>>4147 >it's hard to make your own Jeez man, just put the encrypted exe in memory and decrypt it after getting scanned fuarrrking skids

I wanted to put this FOSS rat on here, If your interested to look at something https://github.com/micle-fm/Parat

>>4157 this pdf will help you fam, also msfvenom

>>1198 Just out of curiosity, I'm looking through the mirai botnet code and the guy rewrote all of his own utils, dispite the fact that things like strcpy, strncpy, and memzero already exist. Why? Is there a point? Just include the library function, right?

>>4553 Maybe he wanted it to work even if dynamic linking to the standard library failed or something. That might be totally wrong, I don't really understand dynamic linking, but it seems like a possibility.

Im making one right now, though im not very experienced yet, i could answer a few questions

I do not use RATs/botnets anymore as I grew out of that a long time ago, but one thing is still important of course: Keeping your binary undetected. In the past, I used to just mess around with Hex Workshop to make my binary FUD by virustotal, scanners, etc. Also, I don't know how botnets are viable these days unless you have a 0day(highly unlikely! :) ), in the past it was easy to just setup a driveby in a hidden iframe or an activeX control which most idiots would use to let you install a trojan onto their PC. But what do kids do these days? Backdoor soykafty torrents still? :/ Can't be too successful in terms of infects.

>>5230 Entry level skills makes you entry level soykaf It aint that hard to find 0days for 3rd party unknown soykaf, but for windblows and *nix you need some skills. I heard most people nowaday have self propagating exploiting software that is akin to just trying out a bunch of already known vulns to make their botnets. Hard hitting 0days are aways shut down in few days. Even though mirai is still viable today it is pretty soykaf because IoT devices are soykaf in general. So, I dunno? The best suggestion I have is do what thou wilt and everything else will come when it comes, don't worry bout money or fame.

>>4556 Static compilation would be the better alternative here wouldn't it? There's almost never a reason to write your own basic utils. >>501 Forget default passwords, some vendors have undocumented hard coded credentials in the firmware that you can use. Security cameras are among the easiest things to hack and what makes this worse is that many of them are networked by default - giving you a compromised node to launch more attacks. >>1627 Not surprised people are dismissing this - it's not edgy enough for teenage wannabe hackers to accept it. You can do serious time for computer crime and prison is absolutely ruthless, especially for sheltered kids. If you're going to hack maliciously you need to wear the risk and seriously understand what you're getting yourself into. Is 10 years of my life worth this hack? If it is, go ahead. It only takes one vulnerability to compromise a system and in the same vein it only takes one mistake to get caught. There are better hackers than you doing time.

BYOB, has anyone played with this yet? I haven't messed around with it and wanted to know anyone's opinion. https://github.com/malwaredllc/byob