Cybergate RAT Tutorial For Beginners

1) What is a R.A.T?
R.A.T is remote administration tool. In other words, if a RAT is set up correctly, then a person (hacker) would gain acces on victim's computer. That hacker can do any stuff in victim's pc.
For example: a)will be able to move his mouse and keyboards
b)will be able to see your victim by hacking his webcam and etc.

2) Which is the best RAT?
I dont use many RATs. The best that i ever used is Cybergate RAT

So now, lets get started.
First of all you guys download this:

Cybergate Download Link(click here to download)

this download link was not made by me.download and use it at your own risk
this application is called cybergate and it will used to create rat server.
this app might be detected as virus by some antivirus.but dont worry it is not backdoored.

download it and extract it to a folder.

==============================================================
Secondly set up the no-ip client

to do that you must go to :
NO-IP SITE(click here)

register there.

once you have logged in, you must "add a host"

Image has been scaled down 36% (758x329). Click this bar to view original image (1174x509). Click image to open in new window.




Now type in your name at hostname.and choose any domain. you dont have to follow the same name like in the picture below.



now you can see that you have successfully created a host.
now download the no-ip duc client that is available at that site.

Image has been scaled down 16% (758x273). Click this bar to view original image (902x324). Click image to open in new window.



click the windows version.

once done downloading, run the program. sign in using your no-ip username and password.
and press select host and you can see your host there. click at the box and press save .


===========================================================
now its time to set up your cybergate RAT seRVER
LETS CONTINUE

run the cybergate rat that you have extracted into a folder.
there will be agreement which you got to wait for a few seconds before agreeing.

next: Control center-->start


now a box would appear.you have type in 100 and press the go image button.
and type in the connection password as 123456
and click save

Image has been scaled down 26% (758x344). Click this bar to view original image (1012x458). Click image to open in new window.



now press: control center--->builder--->create server

Image has been scaled down 25% (758x345). Click this bar to view original image (1009x459). Click image to open in new window.




now a box would appear.
click new
press the name of the new user and ok

Image has been scaled down 25% (758x344). Click this bar to view original image (1009x457). Click image to open in new window.



now double click the new user.

Image has been scaled down 25% (758x342). Click this bar to view original image (1009x455). Click image to open in new window.


after that you will the connection tab.
view the picture for better understanding.

if you want to test the server on yourself or same lan networkk, then you have to edit the 127.0.0.1:999 to 127.0.0.1:100
if you want to test on others, then add:
yourhost.no-ip.info:100

Image has been scaled down 25% (758x346). Click this bar to view original image (1010x460). Click image to open in new window.


change the identification to cyber and password to 123456

Image has been scaled down 26% (758x344). Click this bar to view original image (1011x458). Click image to open in new window.



now press the installation tab and use the same setting as mine.
Install directory is the where the server installs
%System%
%Windows%
%Root%
%Program Files%
%Other%
it is more better to use "system"
Boot: this will be the startup option. check everything and press random 5 times so that the server will start everytime your victim start the computer
Directory is the place where the server will be situated
File Name will be the name of the server in the directory
change the creation date
persistence will inject the server into the victim,s pc until success
for inject into just use default browser
dont choose hide file because it will make your server detectable by all antivirus

Image has been scaled down 25% (758x345). Click this bar to view original image (1008x458). Click image to open in new window.



go to anti debug tab and check all

Image has been scaled down 25% (758x343). Click this bar to view original image (1010x456). Click image to open in new window.


and then go to create server tab
check use icon,delayed execution, and google chrome password
delayed execution will be the time taken for the server to inject into victim's pc .
google chrome password will help you to steal google chrome passwords.
a pop up will appear and just press ok

Image has been scaled down 25% (758x344). Click this bar to view original image (1008x457). Click image to open in new window.


now you have done setting up your server.
===================================================================
PortForwarding
Q: So, what is portforwarding?
A:Port forwarding allows remote computers, for example, computers on the Internet, to connect to a specific computer or service within a private local area network (LAN)
so lets start portforwarding.

remember that your the port that you have choosen is 100.
to make it easier.lets download the simpleportforward tool from this site:

SIMPLE PORT FORWARDING(click here)

from here pc wintech TuT starts ., all credits of port forwarding goes to Pc win tech.com
now, once it is downloaded,run the program.

1)firstly update your router list and set your router.

Image has been scaled down 38% (758x341). Click this bar to view original image (1216x547). Click image to open in new window.


and press the "choose which port you need to forward" by pressing the "do it now"
and press the "add custom"
type
name:anything
type: tcp/udp
start port:99
end port:100
and then press "add"

now click "update router"


when you have pressed update router, you can see the program accessing your router and editing whatever you have typed just now.
and now the last step, which is to check whether your port 100 is open or not.
but before that close your cybergate program.
and now do like in the below picture

Image has been scaled down 9% (758x551). Click this bar to view original image (829x602). Click image to open in new window.



if the portforwarding is failed, then you have to start from the beginning of portforwarding
======================================================================
now,you have done it.
what you have to do now is spread your server.
good luck

---------------------------------------------------------knox d3cryptor/Team 73cyf

Read More

Dark comet RAT TuT [PDf with Picture ] NooB friendly

Read More

Problem Steps Recorder [PSR] Windows TuT maker

Main purpose of Problem Steps Recorder is to send feedback to Microsoft’s developers, but you can use it also to create image tutorials for your computer . Problem Steps Recorder is to send tracking your mouse and keyboard input while taking screenshots that correspond with each new action and save it as HTML slide show. To lanuch this program type in start menu psr.exe

Read More

Kali Linux Installation [virtual Machine]

Kali Linux:

A famous PenTest OS for hackers

Download Kali linux
Download Virtual Box

Read More

ProXPN [installation]

ProXPN helps to upgrades your internet connection with VPN encryption secures all types of connections from DSL and cable to 3G gives you 100% private access to the internet get an IP address in the USA, UK, or NL.

It Protects websites you visit, hijack your passwords, credit cards, or banking details intercept and spy on your email, IMs, calls, or anything else, record your web, history, run traces to find out where you live.

Download 

Video tutorial 

Read More

TOR installation -[high anonymity]

Tor is very useful for online anonymity, its protect your privacy, defend against a form of network traffic analysis. Traffic analysis can be used to infer who is talking to whom over a public network. Knowing the source and destination of your Internet traffic allows others to track your behavior and interests.

Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features. 

Tor to keep websites from tracking them and their family members, or to connect to news sites, instant messaging services, or the like when these are blocked by their local Internet providers. Tor's hidden services let users publish web sites and other services without needing to reveal the location of the site.

Download 

Video Tutorial 

Read More

How to Setup Darkcomet 5.3.1

How to setup Darkcomet, this is going to be a nice average sized guide providing you with all the information needed to successfully run and manage the Darkcomet tool. There will be pictures, examples, step by step pieces and a lot more.

What Is Darkcomet
So the best way to start off your guide would be to explain what you will be working with first. So I will give you a quick explanation of Darkcomet, what it is and how it works. Darkcomet is a Remote Access Trojan or Remote Administration Tool. it is used mainly to gain access of a victim's PC but there are many uses for a RAT, I will provide most of them.

Ability to control and view screen

File management (Upload, Execute, Download, etc)

Shell Access (CMD)

Computer Power Access (Power off, log off, etc)

Host and Registry control

Keystroke viewing and control

Network Monitoring (Wifi, View local PC's, etc)

Password access on Chrome, Firefox, Opera, Safari and IE

Task Manager Access

1.       Block Mouse/Keyboard

2.       Make Victim's DDoS (TCP, UDP, HTTP)

3.       Open CD Tray

4.       Play Sounds

5.       Talk into their speakers

Darkcomet can be used for malicious intent, or for a prank. Many cyber criminals use RAT's like darkcomet to steal and log passwords, credit cards and more. There is a whole marketplace behind RAT's, it's mostly around botnets but RAT's are in the business too. People can make lot's of money with bots, they can use them to DDoS and make a DDoS service, steal their passwords, make shops and sell their accounts, keylog and sell logs, then sell the bots in a bot shop and a lot more.

Requirements
Okay so to have this correctly setup you are going to need a few simple requirements, I will list them below.

Access to portforwarding (Your Router user and pass)

Darkcomet (Download Here)

No-ip / DUC (Download Here)

Winrar or 7Zip

Tutorial
Okay so once you got all of the requirements and are ready to proceed, continue to this step by step tutorial and I will show you everything you need to know!

Darkcomet - Section 1

Installing, setting up and preparing Darkcomet - Darkcomet Section 1.1
1. Extract the darkcomet folder (VERY IMPORTANT)
2. Open Darkcomet.exe
3. Agree to the EULA, terms, etc
It should look like this: Click Here For Picture

Portforwarding - Section 1
Okay so like I said, you need access to your router, otherwise you won't be able to portforward. You could still use an HTTP rat like "Loki Rat" if you don't want to portforward. Although if you want to go through all that trouble uploading the files to your FTP server and all that, you might as well go with an HTTP botnet like Cythosia, but let's get started.

Finding your Router Gateway Address - Portforwarding Section 1.1
1. Open your start menu
2. Search for "CMD" or Open "RUN" and type "CMD" on it.
3. Enter this code into your Command Prompt: "ipconfig"
4. Scroll all the way up and look for "Default Gateway" and "IPv4 Address"
(We will need IPv4 Address later)

Forwarding your Port - Portforwarding Section 1.2
5. Enter the Default Gateway IP into your URL bar
6. Login to your router, if you don't know your account search for some default logins.
7. Look for a portforwarding section (Might be in a gaming tab, every router is different)
8. Type "1604" on both "Starting Port" and "Ending Port"
9. For "Protocol" try "Both" but if there's only TCP and UDP, do both seperately
10. For "IP Address" get your IPv4 Address and enter it there
11. Enable the port and press submit

Allowing Port through Firewall - Portforwarding Section 1.3
1. Open Start menu and search "Firewall"
2. Click "Windows Firewall with Advance Security"
3. Go to "Incoming Connections" and click "New Rule"
4. Select "Port" and press the next button
5. Choose "UDP" and select "Specific Local Ports" and enter "1604"
6. Allow the connection and press next until you get to "Name"
7. Name is "darkcomet" or whatever, and give it any description
8. Click Finish and repeat it again for inbound connection but with "TCP" Port.
9. Repeat steps 1-8 but with "Outbound Connection"
10. Also you should check with your Antivirus firewall just in case.[/b]

Darkcomet - Section 2

Connecting and configuring Darkcomet - Darkcomet Section 2.1
1. Open Darkcomet.exe
2. Go to Socket / Net Section
3. Right click and press "Add port to listen to"
4. Make the Listen Port "1604" and enable "UPnP"
5. Click Listen and you have configured Darkcomet

Creating A Server (Stub/Virus) - Darkcomet Section 2.2
Okay now you will be making the virus that you will get users to run in order to infect them, there are many features on Darkcomet so I will take you through them.

1. Open Darkcomet Menu on top right corner
2 Go to Server Module and click Expert.
(If you want a list of what all the features do, read below)

Main Settings
Security Password - Adds a password so only you can manage bots
Mutex - Stops multiple connections on the same port
Server ID - The ID or Group bots that run this server are in
Profile Name - You can save your settings under a profile name
Process Hijacking - Firewall Bypass, not recommended if crypting (outdated)

Network Settings
IP/DNS - The DNS or IP Address bots will connect to
Port - Port bots will use to connect
Add - This will add the settings, remember to click this!
Also remember to click the added setting once added

Module Startup
Startup - Starts the stub with windows
Drop File in - Where the virus will be placed
Melt File - Deletes the virus execution file, but keeps virus after running
Date Created - Change the creation date to trick users
Persistence - Very important, keeps the program task from being removed

Install Message
This is basically where you make a fake error message when your virus starts to make it seem more legitimate.
Icon - Choose which img comes with the error, I suggest the "X" icon.
Title - What it says at the top of the error message (I.E "Error 804")
Message - What the actual error says "Warning, an unexpected error has occurred, program will now be terminated"
Test Messagebox - You can test the error on yourself, it is harmless and you can do it just to be sure

Module Shield
Persistent Process - Again, persistence for more than task manager, recommended.
EVERYTHING ELSE IF NOT RECOMMENDED AND IS OUTDATED IN THE MODULE SHIELD SECTION

Keylogger, Hosts, Binder, and Icon
Keylogger is able to send logged keys to a website through FTP connection.
You can manage a victim's "Hosts.txt" file through here and control which websites he can go on.
Bind a file with your server so they both run at the same time, this will make the user less suspicious.
Change icon of file to make it more legitimate and cause less suspicion.

DUC / No-iP - DNS Config Section 1

Creating a No-IP Account - DNS Config Section 1.1
1. Go to http://www.noip.com/newUser.php and register
2. Create a "No-ip.biz" hostname with any name you want
3. Click "No thanks, I'll use no-ip.biz" and click "Sign Up"
4. Validate your Email and Activate your Account

Configuring DUC - DNS Config Section 1.2
1. Open No/IP DUC and log into your No/Ip Account
2. Click "Edit Hosts" on the DUC Menu
3. Select your no-ip.biz website and click "Save"
4. Click Refresh Now and you're good to go!
5. Click File>Hide to get all of that out of your way

Setting up DUC or No/IP with Darkcomet - DNS Config Section 1.3
1. Open Dark Comet and click the drop down menu (Top right corner)
2. Click Server Module > Full Editor (Expert)
3. Use the Previous tips to setup your stub but leave the "Network Settings" alone
4. Instead of your IP address, enter your No/IP Website (DNS) and port "1604"
5. Press the "Add" button and click on it to select it
6. Finish your settings and press build stub

Tips and Tricks

Spreading
Spreading is basically a method to sending your server (virus) to a bunch of victims. This can be done best through a "Niche" which is basically a topic that a large amount of people are interested in, for example "Minecraft". You can make a Youtube Video about a "Minecraft Mass LastLogin Stealer" or something of the sorts, and spread your server. You can also do JDB's (Java Drive By) and use things like "Adult Cams" to attract and infect pedo's and pervs.

Crypting
Always be sure to crypt your file, this is when you edit the code of your virus to make it undectable (FUD) by antiviruses, this will durastically increase your spreading rates. You can buy a crypter from HF, use freeones or try using tools like obfuscation or hex editing to crypt it yourself. Always remember not to upload to av scanning websites that distribute your file otherwise it will become less UD, do NOT use "Virustotal" or "Novirusthanks". Instead you should use "Element Scanner". The best website to upload to would be: http://ge.tt

-------------------------------------------------------------------------------------------------------KNOXD3CrypT0r

Read More

Trojans and RATs- Know The Facts

What are TROJANS?

A Trojan is a program that pretends to be legitimate program, while It is malicious in nature and is infecting the system in background. It  provides complete access of that system to the Attacker.

How Trojans work?

Trojans work on client server basis.  The client will reside on hacker’s system and the server will be on victim’s computer. When the victim clicks the server, client listens to the connections through the specified ports and gives the access to the victim’s system.

Ports

Ports are the end points that provide communication between computers or networking devices.

Physical ports- example usb ports,serial port etc

Virtual ports- Virtual ports provide a virtual connection between the computer systems. These ports are the ones we need for communication on internet. Different Trojans use different ports.  These are referenced using some numbers. There are  65535 ports.

Direct connection Trojans

If the Trojan is direct connecting Trojan then attacker can connect to the victim directly and can get access to the victim machine, but the scenario is not always that easy. Victim can be behind a router, in that case direct connection Trojans will not any provide any access to the victim computer. One more disadvantage is we need to know the IP address of the victim.

HACKER-->server-->VICTIM

Example: PRORAT

Reverse connection Trojans

When the  Victim is behind a router, direct connection Trojans will not  provide any access to the victim computer. Here comes the need of reverse connection Trojans. In this case, the victim will be connected to the hacker using the server file. This is Very useful if the person sits behind a router . After infecting the victims PC, the trojan will automaticly connects to the hacker.

HACKER<--Server<--VICTIM

Example: Darkcomet

Port forwarding

If the hacker does not connect to the Internet directly (with a modem) and he sits behind a router, he needs to forward the trojan ports in his routers configuration if he is doing a reverse connection. This is called portforwarding.  The basic idea of port forwarding is to instruct our router to allow external connections to our PC. It varies from router to router based on its company and version.

Dynamic IP address

Most of the computers today do not have a static IP address, So  using a service like no-ip which gives you a name like hacker.no-ip.org  which can be pinged from anywhere on the internet and it will give your current IP address. Set your reverse connection trojans to connect to this name.

Read More