# JSRAT | Javascript Backdoor to Control Victim Machine 🚪

**URL:** <https://onehack.st/t/jsrat-javascript-backdoor-to-control-victim-machine/59631>\
**Category:** Tools & Scripts\
**Tags:** programming, hacking\
**Created:** [October 3, 2019, 1:38pm UTC](https://onehack.st/t/jsrat-javascript-backdoor-to-control-victim-machine/59631 "2019-10-03T13:38:56Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheJoker](https://onehack.st/user_avatar/onehack.st/thejoker/32/22660_2.png) [@TheJoker](https://onehack.st/u/TheJoker)\
**Post date:** [October 3, 2019, 1:38pm UTC](https://onehack.st/t/jsrat-javascript-backdoor-to-control-victim-machine/59631/1 "2019-10-03T13:38:57Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/8/f/8f8084e6f632cf508b08c388bdcca0fda6ab8be9.png)

# [https://github.com/aspiggy/JSRAT](https://github.com/aspiggy/JSRAT)

JSRAT is a python Script that can be used to get a remote shell of victim pc.

## **Installation & Setup :-**

- Download the JSRAT tool from github

 ![image](https://onehack.st/uploads/default/original/3X/4/5/452489c8cbc60b177410c158d3959de19a4cb5eb.jpeg)

- Download and give appropriate permission to execute the script.Above figure shows the complete installation

## **Starting the web server:**

- Run and execute the command: **python JSRAT.py -i -p 8080**

 ![image](https://onehack.st/uploads/default/original/3X/c/8/c8c585fb802bc5b5c5b017c65396a9fec418e69a.jpeg)

- JSRAT provides the list of URLs.Copy the **Client command** here it is [http://192.168.172.143:8080/wtf](http://192.168.172.143:8080/wtf)

## **VICTIM MACHINE:-**

- Open this **Client command** URL with Victim browser

 ![image](https://onehack.st/uploads/default/original/3X/7/6/768717ddcf6a93def58833e9d25d265e8c3140c1.png)

- To gain the shell payload generated by URL should be opened with CMD.

 ![image](https://onehack.st/uploads/default/original/3X/4/4/4463611a4ad8201aff49e9686eac9c5e9a5d7d37.png)

- Once the command is executed a shell will be obtained.

## **BACK TO ATTACKERS MACHINE:-**

- Here we go !!! We have connected to Victim machine

 ![image](https://onehack.st/uploads/default/original/3X/3/5/35f44b7089d512919662afcdbb06f773da4c2e40.jpeg)

- Let us try some windows command: Ipconfig

 ![image](https://onehack.st/uploads/default/original/3X/3/4/34a9b0332753ef396d8ece6d15018b8a3acf9207.jpeg)

 ![image](https://onehack.st/uploads/default/original/3X/b/9/b95a03acf6b916e805798f0d02af80fc409da25e.jpeg)

> - Above Figure shows executing the command **calc** opens up the windows calculator. JSRat can also provide upload, Read and Download files.

---

<div class="post-metadata">

**Author:** ![E10n](https://onehack.st/user_avatar/onehack.st/e10n/32/22265_2.png) [@E10n](https://onehack.st/u/E10n)\
**Post date:** [October 3, 2019, 1:41pm UTC](https://onehack.st/t/jsrat-javascript-backdoor-to-control-victim-machine/59631/2 "2019-10-03T13:41:47Z")

</div>

Thanks @TheJoker.

---

<div class="post-metadata">

**Author:** ![Darklooter](https://onehack.st/user_avatar/onehack.st/darklooter/32/1882_2.png) [@Darklooter](https://onehack.st/u/Darklooter)\
**Post date:** [October 3, 2019, 2:38pm UTC](https://onehack.st/t/jsrat-javascript-backdoor-to-control-victim-machine/59631/3 "2019-10-03T14:38:08Z")

</div>

Is this a persistent backdoor ?

---

<div class="post-metadata">

**Author:** ![reetkr](https://onehack.st/user_avatar/onehack.st/reetkr/32/19290_2.png) [@reetkr](https://onehack.st/u/reetkr)\
**Post date:** [October 3, 2019, 5:10pm UTC](https://onehack.st/t/jsrat-javascript-backdoor-to-control-victim-machine/59631/4 "2019-10-03T17:10:44Z")

</div>

can it be done for unix systems?

---

<div class="post-metadata">

**Author:** ![Himanshu\_Chandola](https://onehack.st/user_avatar/onehack.st/himanshu_chandola/32/25802_2.png) [@Himanshu\_Chandola](https://onehack.st/u/Himanshu_Chandola)\
**Post date:** [October 19, 2019, 3:20am UTC](https://onehack.st/t/jsrat-javascript-backdoor-to-control-victim-machine/59631/5 "2019-10-19T03:20:16Z")

</div>

Thanks for Sharing !

---

<div class="post-metadata">

**Author:** ![Mountakha\_NDIAYE](https://onehack.st/user_avatar/onehack.st/mountakha_ndiaye/32/23627_2.png) [@Mountakha\_NDIAYE](https://onehack.st/u/Mountakha_NDIAYE)\
**Post date:** [October 19, 2019, 10:54pm UTC](https://onehack.st/t/jsrat-javascript-backdoor-to-control-victim-machine/59631/6 "2019-10-19T22:54:14Z")

</div>

> [@TheJoker](#):
>
> [http://192.168.172.143:8080/wtf](http://192.168.172.143:8080/wtf)

I got this error where i try to reproduce the tuto.

 ![VirtualBox_Debian_piscine0_20_10_2019_00_51_44](https://onehack.st/uploads/default/original/3X/9/a/9ad3f41f47e11710f70ed67185b24f7d80332222.png)