ToRat : A Remote Administration Tool Written In Go Using Tor As A Transport Mechanism & RPC For Communication

ToRat is a Cross Platform Remote Administration tool written in Go using Tor as its transport mechanism currently supporting Windows, Linux, MacOS clients.

How to?

TL;DR

git clone https://github.com/lu4p/ToRat.git
cd ./ToRat
sudo docker build . -t torat
sudo docker run -it -v “$(pwd)”/dist:/dist_ext torat

Prerequisites

Install

  • Clone this repo via git

git clone https://github.com/lu4p/ToRat.git

  • Change Directory to ToRat

cd ./ToRat

  • Build the ToRat Docker Container
  • you need to build a part of the container yourself to get a own onion address and certificate all prerequisites are met by the prebuilt torat-pre image in other to make quick build times possible

sudo docker build . -t torat

  • Run the container
    • will drop directly into the ToRat Server shell
    • the -v flag copies the compiled binaries to the host file system
    • to connect a machine to the server shell just run one of the client binaries on another system

sudo docker run -it -v “$(pwd)”/dist:/dist_ext torat

  • In another shell run the client.

sudo chown $USER dist/ -R
cd dist/dist/client/
./client_linux

  • See the client connect

In your Server shell you should now see something like [+] New Client H9H2FHFuvUs9Jz8U connected! You can now select this client by running select in the Server Shell which will give you a nice interactive chooser for the client you want to connect to. After you choose a client you drop in an interactive shell on the client system.

Notes

Contents of ToRat/dist after docker run

$ find ./dist
./dist/
./dist/dist
./dist/dist/client
./dist/dist/client/client_linux                   # linux client binary
./dist/dist/client/client_windows.exe             # windows client binary
./dist/dist/server
./dist/dist/server/key.pem                              # tls private-key
./dist/dist/server/banner.txt                           # banner
./dist/dist/server/cert.pem                             # tls cert
./dist/dist/server/ToRat_server                         # linux server binary

Current Features

  • RPC (Remote procedure Call) based communication for easy addition of new functionallity
  • Automatic upx leads to client binaries of ~6MB with embedded Tor
  • the ToRAT_client communicates over TLS encrypted RPC proxied through Tor with the ToRat_server (hidden service)
    • anonymity of client and server
    • end-to-end encryption
  • Cross Platform reverse shell (Windows, Linux, Mac OS)
  • Windows:
    • Multiple User Account Control Bypasses (Privilege escalation)
    • Multiple Persistence methods (User, Admin)
  • Linux:
    • Multiple Persistence methods (User, Admin)
  • optional transport without Tor e.g. Use Tor2Web, a DNS Hostname or public/ local IP
    • smaller binary ~7MB upx’ed
    • anonymity of client and server
  • embedded Tor
  • Unique persistent ID for every client
    • give a client an Alias
    • all Downloads from client get saved to ./$ID/$filename
  • sqlite via gorm for storing information about the clients
  • client is obfuscated via garble

Server Shell

  • Supports multiple connections
  • Welcome Banner
  • Colored Output
  • Tab-Completion of:
    • Commands
    • Files/ Directories in the working directory of the server
CommandInfo
selectSelect client to interact with
listlist all connected clients
aliasSelect client to give an alias
cdchange the working directory of the server
helplists possible commands with usage info
exitexit the server

Shell after selection of a client

  • Tab-Completion of:
    • Commands
    • Files/ Directories in the working directory of the client
CommandInfo
cdchange the working directory of the client
lslist the content of the working directory of the client
shreddelete files/ directories unrecoverable
shredremovesame as shred + removes the shredded files
screentake a Screenshot of the client
catview Textfiles from the client including .docx, .rtf, .pdf, .odt
aliasgive the client a custom alias
downdownload a file from the client
upupload a file to the client
escapeescape a command and run it in a native shell on the client
reconnecttell the client to reconnect
helplists possible commands with usage info
exitbackground current session and return to main shell
elsethe command will be executed in a native shell on the client

Upcoming Features

Preview

R K

Recent Posts

Kali Linux 2024.4 Released, What’s New?

Kali Linux 2024.4, the final release of 2024, brings a wide range of updates and…

11 hours ago

Lifetime-Amsi-EtwPatch : Disabling PowerShell’s AMSI And ETW Protections

This Go program applies a lifetime patch to PowerShell to disable ETW (Event Tracing for…

11 hours ago

GPOHunter – Active Directory Group Policy Security Analyzer

GPOHunter is a comprehensive tool designed to analyze and identify security misconfigurations in Active Directory…

2 days ago

2024 MITRE ATT&CK Evaluation Results – Cynet Became a Leader With 100% Detection & Protection

Across small-to-medium enterprises (SMEs) and managed service providers (MSPs), the top priority for cybersecurity leaders…

5 days ago

SecHub : Streamlining Security Across Software Development Lifecycles

The free and open-source security platform SecHub, provides a central API to test software with…

1 week ago

Hawker : The Comprehensive OSINT Toolkit For Cybersecurity Professionals

Don't worry if there are any bugs in the tool, we will try to fix…

1 week ago