A Cross-Platform Remote Administration tool is written in Go using Tor as its transport mechanism currently supporting Windows, Linux, macOS clients.
DISCLAIMER
USE FOR EDUCATIONAL PURPOSES ONLY
Wiki
How to use ToRat Docker Image
Preview
Client Commands
Command | Info |
cd | change the working directory of the client |
ls | list the content of the working directory of the client |
shred | delete files/ directories unrecoverable |
screen | take a Screenshot of the client |
cat | view Textfiles from the client including .docx, .rtf, .pdf, .odt |
alias | give the client a custom alias |
down | download a file from the client |
up | upload a file to the client |
speedtest | speedtest a client’s internet connection |
hardware | collects a variety of hardware specs from the client |
netscan | scans a clients entire network for online devices and open ports |
gomap | scan a local ip on a clients network for open ports and services |
escape | escape a command and run it in a native shell on the client |
reconnect | tell the client to reconnect |
help | lists possible commands with usage info |
exit | background current session and return to main shell |
Server Commands
Command | Info |
select | select client to interact with |
list | list all connected clients |
alias | select client to give an alias |
cd | change the working directory of the server |
help | lists possible commands with usage info |
exit | exit the server |
Current Features
Architecture
RPC (Remote Procedure Call) based communication for easy addition of new functionality
Automatic upx leads to client binaries of ~6MB with embedded Tor
SQLite via gorm for storing information about the clients
the client is obfuscated via garble
Server Shell
Cross-Platform reverse shell (Windows, Linux, Mac OS)
Supports multiple connections
Welcome Banner
Colored Output
Tab-Completion of:
Unique persistent ID for every client
Persistence
Windows:
- Multiple User Account Control Bypasses (Privilege escalation)
- Multiple Persistence methods (User, Admin)
Linux:
Tor
Fully embedded Tor within a go
the ToRAT_client communicates over TLS encrypted RPC proxied through Tor with the ToRat_server (hidden service)
optional transport without Tor e.g. Use Tor2Web, a DNS Hostname or public/ local IP
Upcoming Features
Contribution
All contributions are welcome you don’t need to be an expert in Go to contribute.
You may want to join the #torat
channel over at the Gophers Slack
Credits