MK01-OnlyRAT - OnlyRAT is the only RAT you'll ever need. We will

项目说明

OnlyRAT

> Blue Cosmo | 01/07/2022
---

Update: 3.2

Hides OnlyRAT user from login, start menu, and more

Fixed update bug

ZSH support

port support

[!!] DISCLAIMER

TLDR:
Please use securely and ethically :D

Feel free to use this RAT on any computer that you own or ha to test malicious code on. It's perfectly legal. But do not install this RAT on targets you don't ha to test malware on. Not only is it illegal, but by doing so you are putting that computer at risk. Since the RAT needs to be able to remotely connect, it is enabling a persistence that other hackers on the network may target or e force.

The purpose of this RAT is to teach members of the security community the basics of malware de, so do not use it with malintent. Malware de is an essential skill that is often o within the security world. By learning malware de, security researchers can better understand how hackers think and develop malicious code, as well as learn to develop their own for security purposes. By making a single RAT that can hold all of the teachings in one form factor, it is much easier to connect the lessons.

O:

OnlyRAT [Only Remote Access Tool] is the *only RAT* you'll ever need. This tool is an SSH [Secure SHell] RAT that is completely network-oriented, making it fileless. It is capable of remotely connecting to the target computer, remote file uploads and downloads, as well as code execution all through network commands and communication.

Its ad network capabilities make it difficult for standard antivirus and firewalls to detect. The RAT has a multitude of ways it can be installed onto a target PC, including batch file installation and the use of Hak5 gear. Depending on how OnlyRAT is installed, you can ha as a *from GitHub* or *from VPS* install.

*From GitHub* will install OnlyRAT from GitHub's raw data, allowing no user configuration. But the connection can only be local since there is no VPS to route traffic and forward ports from.

*From VPS* will install OnlyRAT utilizing a Private Server (VPS) or any computer accessible on the internet to route traffic to and from the target. Meaning with this installer, you can access your target from anywhere.

Resources:

YouTube Video

YouTube Channel

Website

Article

Requirements:

Attacker PC:

Security Linux [Debian Based]

- Kali Linux
- Parrot OS

Linux Terminal

Python3

SSH Tools

- OpenSSH-client
- ssh-keygen
- ssh-copy-id

Target PC:

Windows 10 Home

Installation:

Target Installation:

The installers folder contains all the ways we can install the RAT onto our target

Attacker Installation:
1. Install OnlyRAT by cloning this repository

2. Install dependencies for OnlyRAT
- YES, the onlyRAT directory is supposed to disappear
- restart the terminal once the installation is complete

Configuration File:

The configuration file username.rat is a file we obtain through our OnlyRAT installers. It sa that OnlyRAT needs to connect back to our target computer. Having configuration files allows hackers to have a database of all the compromised PCs they ha to.

If was used, download configuration by running:

Running OnlyRAT:

1. Run onlyrat in your terminal for help

2. Append the configuration file to specify a target

3. For additional information, run:

How It Works:

OnlyRAT is a very simple yet complex piece of network-oriented malware. To learn how it works and to possibly build up your malware skillset, I highly recommend checking out this article that I wrote about OnlyRAT.

Connection Types:

OnlyRAT is capable of connecting to the target both locally and remotely [ required for remote connections]. OnlyRAT makes this change easy via the following...

Switch to Local Connection:
To switch to a local connection, run:

Switch to Remote Connection:
To switch to a remote connection, run:

Updating OnlyRAT:

The CosmodiumCS Team will continuously push out updates to OnlyRAT. To prevent users from continuously having to reinstall OnlyRAT themselves. We ha the update process.

1. To check the current , run:

2. To update, run:

- this will automatically check for the latest and run update

Uninstall OnlyRAT:

To uninstall OnlyRAT from your attacker computer, run:

OnlyRAT Killswitch:

To uninstall OnlyRAT from your target computer, run:

Payloads:

Credits:

Shoutout to Oreo for making the ASCII art for the repo :)

be sure to check his work out here

项目信息

开发语言：Python

Star 数：179

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕OnlyRAT is the only RAT you'll ever need. We will be able to use this tool to remotely command and control windows computers.Once installed we will have remote administrative access to our target that we can connect to through Python console on our attacker pc. The onlyrat console has plenty of payloads we can then use on our target.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。