/BlackHole

C# RAT (Remote Administration Tool)

Primary LanguageC++

Build status

BlackHole

  • C# RAT (Remote Adminitration Tool)
  • Educational purposes only

Technologies

  • protobuf-net : message serialization/deserialization in slave<->master protocol
  • NetMQ : network library used for the slave<->master system (client<->server)
  • Lz4.Net : compression library
  • ILMerge : packaging assemblies into a single excecutable

Working feature(s)

  • Reverse connection (extremly simple)
  • Slaves management (connection/disconnection)
  • Remote file browser
  • Remote file downloader
  • Remote file execution
  • Remote desktop (quality + fps)
  • Cancelable download/upload
  • Remote webcam capture
  • Password recovery from differents sources

How it works

We pack the slave into a single .net executable with ILMerge, then we create the according C++ file with the PayloadBuilder. Finally, we build the Loader. When the target start the loader, it will load the CLR and dynamically load the packed Slave from its memory (managed C# executed inside C++ launcher).

Getting started

  1. Build BlackHole.Slave (Will automaticly be packed with its dependencies using ILMerge)
  2. Launch BlackHole.PayloadBuilder (will create a C++ file containing the packed slave in binary format)
  3. Build BlackHole.Loader
  4. Enjoy delivering a single C++ executable

Main window

alt text

File manager

alt text

Downloading command

alt text

Remote desktop

alt text