Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
ToRat — ToRat is a Remote Administation tool written in Go using Tor as a transport mechanism and RPC for communication | Kitploit
Tools/GitHubGitHub/luantak/torat
Privilege EscalationPayload GenerationPersistence MechanismsPost-ExploitationPenetration TestingCommand and ControlLearning & EducationRed TeamingRemote Access ToolArchived
GitHubluantak/torat

ToRat

1.0k1963 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

ToRat is a Remote Administation tool written in Go using Tor as a transport mechanism and RPC for communication

View RepositoryWebsite

License CircleCI Go Report Card Docker Cloud Build Status

A Cross Platform Remote Administration tool written in Go using Tor as its transport mechanism currently supporting Windows, Linux, MacOS clients.

DISCLAIMER

USE FOR EDUCATIONAL PURPOSES ONLY

Wiki

How to use ToRat Docker Image

Preview

Client Commands

Server Commands

Current Features

Architecture

  • RPC (Remote procedure Call) based communication for easy addition of new functionality
  • Automatic upx leads to client binaries of ~6MB with embedded Tor
  • sqlite via gorm for storing information about the clients
  • client is obfuscated via garble

Server Shell

  • Cross Platform reverse shell (Windows, Linux, Mac OS)

  • Supports multiple connections

  • Welcome Banner

  • Colored Output

  • Tab-Completion of:

    • Commands
    • Files/ Directories in the working directory of the server
  • Unique persistent ID for every client

    • give a client an Alias
    • all Downloads from client get saved to ./$ID/$filename

Persistence

  • Windows:

    • Multiple User Account Control Bypasses (Privilege escalation)
    • Multiple Persistence methods (User, Admin)
  • Linux:

    • Multiple Persistence methods (User, Admin)

Tor

  • Fully embedded Tor within go

  • the ToRAT_client communicates over TLS encrypted RPC proxied through Tor with the ToRat_server (hidden service)

    • anonymity of client and server
    • end-to-end encryption
  • optional transport without Tor e.g. Use Tor2Web, a DNS Hostname or public/ local IP

    • smaller binary ~3MB upx'ed
    • anonymity of client and server

Upcoming Features

  • Bulk Commands
  • Persistence and privilege escalation for Linux
  • Persistence and privilege escalation for Mac OS
  • Support for Android and iOS (needs fix of https://github.com/ipsn/go-libtor/issues/12)
  • File-less Persistence on Windows

Contribution

All contributions are welcome you don't need to be an expert in Go to contribute.

You may want to join the #torat channel over at the Gophers Slack

Credits

  • Tor
  • Tor controller library
  • Python Uacbypass and Persistence Techniques
  • Modern Cli
  • Colored Prints
  • Screenshot library
  • TLS Certificate generator
  • Shred library
  • Extract Text from Documents
  • RPC
  • UPX
  • Obfuscation
Download Tool
CommandInfo
cdchange the working directory of the client
lslist the content of the working directory of the client
shreddelete files/ directories unrecoverable
screentake a Screenshot of the client
catview Textfiles from the client including .docx, .rtf, .pdf, .odt
aliasgive the client a custom alias
downdownload a file from the client
upupload a file to the client
speedtestspeedtest a client's internet connection
hardwarecollects a variety of hardware specs from the client
netscanscans a clients entire network for online devices and open ports
gomapscan a local ip on a clients network for open ports and services
escapeescape a command and run it in a native shell on the client
reconnecttell the client to reconnect
helplists possible commands with usage info
exitbackground current session and return to main shell
CommandInfo
selectselect client to interact with
listlist all connected clients
aliasselect client to give an alias
cdchange the working directory of the server
helplists possible commands with usage info
exitexit the server