anhkgg/pyratPyRat，a rat by python xmlrpc
PyRat, an open-source remote control project based on Python XmlRPC, including a client and a server (also called the control end, hereinafter collectively referred to as the server).
Disclaimer: This project is for technical exchange only. Do not use it for commercial or illegal purposes. Any legal disputes arising from its use are unrelated to the author!
Client
> python .\pyratcli.py localhost 80
Server
> python pyratsvr.py 80
--------------------Python RAT-----------------------
--------------------anhkgg---------------------------
--------------------Copyright (c) 2018---------------
The software is for technical exchange only. Do not use it for commercial or illegal purposes. Any legal disputes arising from its use are unrelated to the author!
--------------------Task command---------------------
--|(l)ist (a)live (k)ill (s)elect (p)rint (c)mdshell (n)ew (d)ownload (r)unexec (u)pload (t)erminate (q)uit (h)elp|--
cmd >
After the client comes online, the server will prompt and automatically set the newly online client as the default target.
cmd >test-3333333 is online.
Auto set target test-3333333
help or h lists all commands supported by the server.
cmd >help
(l)ist: list all clients
(a)live: list alive clients
(k)ill: delete client
(s)elect: select target client
(p)rint: show current client
(c)mdshell: create a cmdshell, type q to exit cmdshell
(n)ew: update client version
(d)ownload: let client download a file
(r)unexec: let client run a exe
(u)pload: upload a file to client
(t)erminate:terminate process
(q)uit: quit server
The server uses SQLite to store client basic information and task information. Clients can be managed through commands.
// List all clients
cmd >l
test-3333333 offline 2018-03-20 22:46:59!
id | client_id | version | localip | remoteip | username | osversion | firsttime | lasttime | status
10 | test-3333333 | 0.1.0 | 192.168.149.1 | 114.245.47.12 | test | Windows10.0.16299 | 2018-03-17 12:39:56 | 2018-03-20 22:46:59 | 0
cmd >
// List online clients
cmd >a
no alive client
// Delete client database records or uninstall client
cmd >k
target cid(or ALL):test-3333333
Do you want to uninstall client?(Y/N)
If you need to control a client, you must select the target client using select or s.
cmd >c // Trying to enter cmdshell, prompts no target
Please first set target client by (s)elect command.
cmd >s // Set target
client_id:test-3333333
Set target client: test-3333333
// View current target
cmd >p
test-3333333
Use cmdshell or c to enter cmdshell. Unless you actively type q, you will remain in the cmdshell working directory.
cmdshell records the working directory; for example, after cd c:\, the next operation will be performed in that directory, achieving a pipeline-like cmdshell.
Additionally, if a process is launched via cmdshell, some processes may block message return, so it is not recommended. Use runexec instead.
cmd >c
RAT-CMD > dir
RAT-CMD > test-3333333 do cmdshell(195) dir True
Volume in drive D is gitrepo
Volume Serial Number is EB2F-5AC0
Directory of D:\PyRat\client
2018/02/24 09:40 <DIR> .
2018/02/24 09:40 <DIR> ..
2018/03/20 22:46 4,919 pyratcli.py
2018/03/20 23:01 28 cmd.log
2018/03/17 12:39 1,322 pyratfc.py
2018/03/17 11:19 2,500 osver.py
2018/03/17 12:39 2,161 pyratfc.pyc
5 File(s) 10,930 bytes
2 Dir(s) 647,836,565,504 bytes free
RAT-CMD > ver
RAT-CMD > test-3333333 do cmdshell(196) ver True
Microsoft Windows [Version 10.0.16299.309]
RAT-CMD > tasklist
RAT-CMD > test-3333333 do cmdshell(197) tasklist True
Image Name PID Session Name Session# Mem Usage
========================= ======== ================ =========== ============
System Idle Process 0 Services 0 8 K
System 4 Services 0 3,564 K
smss.exe 360 Services 0 412 K
csrss.exe 492 Services 0 1,700 K
Calculator.exe 21656 RDP-Tcp#85 1 56,772 K
RAT-CMD > tasklist |findstr Cal
RAT-CMD > test-3333333 do cmdshell(200) tasklist |findstr Cal True
Calculator.exe 21656 RDP-Tcp#85 1 51,856 K
RAT-CMD > taskkill /IM Calculator.exe
RAT-CMD > test-3333333 do cmdshell(201) taskkill /IM Calculator.exe True
SUCCESS: The termination signal was sent to the process "Calculator.exe", PID 21656.
RAT-CMD > taskkill /PID 21656
RAT-CMD > test-3333333 do cmdshell(202) taskkill /PID 21656 True
SUCCESS: The termination signal was sent to the process, PID 21656.
Supports file upload and download. Download supports downloading network files and server local files. Currently only single file upload and download are supported.
cmd >d
url(type N to download local file):N // Choose to download local file
local file:db.db
dest path:db.db
cmd >test-3333333 do download(203) local db.db db.db True
download success
cmd >d
url(type N to download local file):https://dl.360safe.com/360/inst.exe // Download network file
dest path:inst.exe
cmd >test-3333333 do download(204) net https://dl.360safe.com/360/inst.exe inst.exe True
download success
cmd >r
run target:inst.exe
runexec inst.exe
cmd > t
Select type(name/pid):name
process name:notepad.exe
cmd >test-3333333 do terminate(212) name notepad.exe True
SUCCESS: The termination signal was sent to the process "notepad.exe", PID 25416.
If the client runs on Linux and the server on Windows, Chinese characters may become garbled because the two platforms use different encodings. This has not been handled yet.
