Saturday 18 June 2011

Using a Trojan / RAT

Trojans is one of the first things you must learn when you want to hack. A trojan is a small program you send to someone to infect their PC so you can control their PC, steal passwords, files or just have some fun.

Every trojan works on a diffirent port, like Sub7, works on port 27374. If you scan a PC and find that port 27374 is open, it means the machine is infected with Sub7. Now ofcourse the trojan can be set with a password, its up to you to crack it then. Now remember that most trojans are picked up by Anti Virus software. You need a new released trojan which AV does not pick up.

The trojan most people know is Sub7 . Before you can start using the trojan, you first need a host to infected with a trojan. A host can be infected in a alot of ways. You can send the host the trojan server file, and tell them it's an game or a firewall or whatever you like it to be. Best is to rename the file to something they will think is usefull like : WindowsXP_update.exe. You can email them this file or put it on a downloads area on a web page, use your imagination. When sending a trojan through email, remember to ZIP or RAR the file, most email hosts do not allow you to send .exe files.

If you cannot get hold of a undetecable trojan, you can use a program like Pestil to make the trojan undetectable. I have tested Pestil with Biforst and it was not detected by NOD or AVG anti virus packages.

You can also bind the trojan file with another file, any executable file the trojan can be binded to. Always remember to rename the file, change the program icon and the put a password on the server file. Bind the file with another file and set the file to automatically delete itself after executed, or set it to give an system error.

When you infect a host or find a infected host, it's time to connect. Easy way to find trojans infect hosts is with Trojan hunter. Choose an IP range to scan through and it will search for trojan infected hosts. When you found an infected host, download the trojan client from my Trojans page.. Connect with the trojan to the host IP, to the certain port the trojan works on and you are ready to take control. Each trojan uses a diffident port. Here is a list of ports which a certain trojan works on.

With most trojans, you will be able to log keystrokes on a PC, even get logged into a file, and when the host is online it will email the keystrokes to an specified email address. Delete or copy files, reboot the PC, make screen captures or disable the screen or mouse. With Sub7 you can do anything on the infected host, just as if you where sitting in front of the PC itself.

Important thing to remember. A trojan comes with a file called "server.exe". Never run that file on your own PC, it will infect your PC with the trojan! Use the trojans configuration file to make changes to the "server.exe" file and then send the file to a victim.

There is also trojans which has the option to do a reverse connection. Very usefull if the person sits behind a router or firewall. After your infected the victims PC, the trojan will automaticly connects to you, thus getting past the problem of connecting through a router or firewall. Remember that if you do not connect to the Internet directly (with a modem) and you sit behind a router, you will need to forward the trojan ports in your routers configuration if you are doing a reverse connection.

Try out Bifrost RAT or Poison Ivy RAT which can do reverse connections, usefull when the host is behind a router.

Most of us do not have a static IP address, I recomend using a service like no-ip which gives you a name like which can be pinged from anywhere on the internet and it will give your current IP address. Set your reverse connection trojans to connect to this name.