Black Hat Go

14BUILDING A COMMAND-AND-CONTROL RAT

In this chapter, we’ll tie together several lessons from the previous chapters to build a basic command and control (C2) remote access Trojan (RAT). A RAT is a tool used by attackers to remotely perform actions on a compromised victim’s machine, such as accessing the filesystem, executing code, and sniffing network traffic.

Building this RAT requires building three separate tools: a client implant, a server, and an admin component. The client implant is the portion of the RAT that runs on a compromised workstation. The server is what will interact with the client implant, much like the way Cobalt Strike’s team ...