# ToRat | Remote Administation Tool Using Tor Network **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools, programming\ **Created:** [November 2, 2021, 7:53am UTC](https://onehack.st/t/torat-remote-administation-tool-using-tor-network/205780 "2021-11-02T07:53:32Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Hannah](https://onehack.st/user_avatar/onehack.st/hannah/32/174875_2.png) [@Hannah](https://onehack.st/u/Hannah)\ **Post date:** [November 2, 2021, 7:53am UTC](https://onehack.st/t/torat-remote-administation-tool-using-tor-network/205780/1 "2021-11-02T07:53:32Z")
![image](https://onehack.st/uploads/default/original/3X/0/5/0542cd2230cadcdcc80dbd84cd9e4e7f1c7a0554.png) [![License](https://camo.githubusercontent.com/ace47511c6506353ca7ffc78b4ce9b6ca466d50dbfa5d6fed958ab36948f9dd3/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c6963656e73652f6c7534702f546f5261742e737667)](https://unlicense.org/) [![CircleCI](https://camo.githubusercontent.com/8776af7c6ac0a79c575564b84b3a2d49c57be77259bb0b1998b77d4612c8f216/68747470733a2f2f636972636c6563692e636f6d2f67682f6c7534702f546f5261742e7376673f7374796c653d737667)](https://circleci.com/gh/lu4p/ToRat) [![Go Report Card](https://camo.githubusercontent.com/654f94bd67a1841c5c7ffd3099a206eaa8a43445a57dc37fce205ed7aacdd43f/68747470733a2f2f676f7265706f7274636172642e636f6d2f62616467652f6769746875622e636f6d2f6c7534702f546f526174)](https://goreportcard.com/report/github.com/lu4p/ToRat) [![Docker Cloud Build Status](https://camo.githubusercontent.com/5127419746993b6bbd0f6cd207952623431dd82d33803353ccd8fc785ce32967/68747470733a2f2f696d672e736869656c64732e696f2f646f636b65722f636c6f75642f6275696c642f6c7534702f746f726174)](https://hub.docker.com/repository/docker/lu4p/torat) A Cross Platform Remote Administration tool written in Go using Tor as its transport mechanism currently supporting Windows, Linux, MacOS clients. ## DISCLAIMER USE FOR EDUCATIONAL PURPOSES ONLY ## Wiki [How to use ToRat Docker Image](https://github.com/lu4p/ToRat/wiki/How-to-use-the-ToRat-Docker-Image) ## Preview [![](https://camo.githubusercontent.com/c5eb9a2f4013c54a56382e700348e6f13a8fcb8c5c513125d7199bb23ac26dd4/68747470733a2f2f61736369696e656d612e6f72672f612f3331383533342e737667)](https://asciinema.org/a/318534) ### Client Commands | Command | Info | | --- | --- | | **cd** | change the working directory of the client | | **ls** | list the content of the working directory of the client | | **shred** | delete files/ directories unrecoverable | | **screen** | take a Screenshot of the client | | **cat** | view Textfiles from the client including .docx, .rtf, .pdf, .odt | | **alias** | give the client a custom alias | | **down** | download a file from the client | | **up** | upload a file to the client | | **speedtest** | speedtest a client’s internet connection | | **hardware** | collects a variety of hardware specs from the client | | **netscan** | scans a clients entire network for online devices and open ports | | **gomap** | scan a local ip on a clients network for open ports and services | | **escape** | escape a command and run it in a native shell on the client | | **reconnect** | tell the client to reconnect | | **help** | lists possible commands with usage info | | **exit** | background current session and return to main shell | ### Server Commands | Command | Info | | --- | --- | | **select** | select client to interact with | | **list** | list all connected clients | | **alias** | select client to give an alias | | **cd** | change the working directory of the server | | **help** | lists possible commands with usage info | | **exit** | exit the server | ## Current Features ### Architecture - RPC (Remote procedure Call) based communication for easy addition of new functionality - Automatic upx leads to client binaries of ~6MB with embedded Tor - sqlite via gorm for storing information about the clients - client is obfuscated via [garble](https://github.com/burrowers/garble) ## Server Shell - Cross Platform reverse shell (Windows, Linux, Mac OS) - Supports multiple connections - Welcome Banner - Colored Output - Tab-Completion of: - Commands - Files/ Directories in the working directory of the server - Unique persistent ID for every client - give a client an Alias - all Downloads from client get saved to ./$ID/$filename ## Persistence - Windows: - Multiple User Account Control Bypasses (Privilege escalation) - Multiple Persistence methods (User, Admin) - Linux: - Multiple Persistence methods (User, Admin) ## Tor - Fully embedded Tor within go - the ToRAT\_client communicates over TLS encrypted RPC proxied through Tor with the ToRat\_server (hidden service) - anonymity of client and server - end-to-end encryption - optional transport without Tor e.g. Use Tor2Web, a DNS Hostname or public/ local IP - smaller binary ~3MB upx’ed - anonymity of client and server ## Upcoming Features - Bulk Commands - Persistence and privilege escalation for Linux - Persistence and privilege escalation for Mac OS - Support for Android and iOS (needs fix of [https://github.com/ipsn/go-libtor/issues/12](https://github.com/ipsn/go-libtor/issues/12)) - [File-less Persistence on Windows](https://github.com/ewhitehats/InvisiblePersistence) ## Contribution All contributions are welcome you don’t need to be an expert in Go to contribute. You may want to join the `#torat` channel over at the [Gophers Slack](https://invite.slack.golangbridge.org/) ## Credits - [Tor](https://www.torproject.org/) - [Tor controller library](https://github.com/cretz/bine) - [Python Uacbypass and Persistence Techniques](https://github.com/rootm0s/WinPwnage) - [Modern Cli](https://github.com/abiosoft/ishell) - [Colored Prints](https://github.com/fatih/color) - [Screenshot library](https://github.com/vova616/screenshot) - [TLS Certificate generator](https://github.com/lu4p/genCert) - [Shred library](https://github.com/lu4p/shred) - [Extract Text from Documents](https://github.com/lu4p/cat) - [RPC](https://golang.org/pkg/net/rpc/) - [UPX](https://upx.github.io/) - [Obfuscation](https://github.com/burrowers/garble) ## GitHub: > **[GitHub - lu4p/ToRat: ToRat is a Remote Administation tool written in Go...](https://github.com/lu4p/ToRat)** > > ToRat is a Remote Administation tool written in Go using Tor as a transport mechanism and RPC for communication