RAT Tutorial - Poison Ivy

Note: I am not responsible for anything you do, ever. You are. I am posting this because I am very interested in RATs and coding my own. You alone are solely responsible of your actions, intentions, and accept so by reading the following. Intended for education purposes relating to any and all of the content below. It must be stressed that the poster is in no way to be held responsible for anything resulting from the addition of the below to your knowledge, or anything resulting from such an addition.

Note: This tutorial was writen by me and you are free to repost this as you please as long as you give full credit to me. You are in no way entitled to steal/copy my work without giving credit to me. but now i dont really care

Requirements:
---------------------------------
no-ip.biz account (see below for instructions)
RAT of your choice, I will be showing Poison Ivy
No-IP client
Know how to port forward (people behind routers only)
---------------------------------

Intro to RATs
---------------------------------
So here we go. I'm going to show you how to setup a RAT. A RAT can stand for a few things:
Remote Administration Tool
Remote Access Tool
Remote Access Trojan
Remote Administration Trojan
and probably more.
In any event, it doesn't matter. What you need to know is that it allows you to access the target computer from yours, using the trojan. Now it may help you to look this up on

Code:

wikipedia. http://en.wikipedia.org/wiki/Remote_administration_tool

---------------------------------

No IP
---------------------------------
First of all, go here

Code:

http://www.no-ip.com/newUser.php

and sign up for an account there. After that log into the site with the account you just created and add your new domain. SEE PIC no-ip.png
[attachment=2095]

Now download the dynamic update client from the downloads tab at the top of the no-ip site. Install that when you are done, and you can update your IP for your domain by logging into the client and updating. Pretty easy.
---------------------------------

Port Forwarding
---------------------------------
If you are not behind a router, skip this. If you are, read on.

You should know how to forward ports on your router. If you dont, head to google, and find out. Each router is different. Usually you can type 192.168.1.1 (or your router's IP address for your LAN) in the address bar of your browser. If you got the right LAN IP, a login box will appear, log in. Default is usually admin:password, or something similar. You're on your own here.
When you finally get int, forward port 3460. That's all.
Hulk11 pointed out that admin:admin is commonly used in routers as well.
---------------------------------

Getting the RAT
---------------------------------
Head over to

Code:

http://www.poisonivy-rat.com/index.php?link=download

and download the latest version. At the time of posting it was 2.3.2.
Download that and unzip it.
---------------------------------

Using the RAT
---------------------------------
Open up poison ivy, and click File>New Client. We are going to set up Poison Ivy to listen for connections on the port you forwarded. Default is 3460. Type in a password for your RAT and click start. You will need this password later.

Now File>New Server. Click create profile. Make it look like Server1.png Be sure that the password you put here and the password here match.
[attachment=2092]

Click next and make your server look like Server2.png.

[attachment=2093]
You will need to select Active X and click the random button. Having the server melt is up to you, I wouldn't pick melt when it is bound to another file. When the file is sent by itself, usually choose to melt it. Click next

Make your server look like Server3.png. Ignore the thing about the keylogger making it unstable. Not much else here. Click next.
[attachment=2094]


You can choose an icon here, or use a resource editor like ResHacker to chage it later. After you do that, click Generate at the bottom and save the .EXE somewhere.
---------------------------------

Testing the RAT
---------------------------------
You can run the server on yourself to test it, this is relatively safe because you have the password to connect to it. When you run the server, you should see yourself in the Poison Ivy Connection's tab.
Notice the pop up box from the system try alerting you of a new connection. That's nice. You can see this in Working.png
[attachment=2096]
I have edited out the IP addresses of those not on my LAN as well as their computer user names and such in order to protect them. To connect to a server, double click the entry in the connections tab. Behold! You are in their PC!
---------------------------------

Distributing
---------------------------------
You can distribute the server file by itself, or bind it to other files. This is where you get to do as you please. Get creative!
---------------------------------

Well that is about it. You can use this knowledge with other RATs and such. If this helped you, rep me or whatever. Don't steal my work, and have fun! Keep in mind both "Note:"s at the beginning of this post. Thanks!