Powershell‑RAT, as we saw in the previous module, is a back door for Windows
machines that tracks user activity using screen captures and sends those
screenshots to the attacker as an email attachment.
This tool was developed by Viral Maniar.
This is a post‑exploitation tool that is primarily written in Python,
but the exploitation agents are written in PowerShell.
Since it's a post‑exploitation tool,
an attacker must first find a way to place this malicious
payload onto the victim's computer.
Once this payload is in place,
the attacker can choose to execute the tool that will periodically send
screen captures over Gmail; hence, the tool can be used to perform data theft
by deploying the payload on the victim's machine.
As its name goes, Powershell‑RAT heavily uses Windows
PowerShell for the data bridge. It leverages PowerShell
right from capturing screenshots, creating scheduled tasks, and sending emails.
PowerShell is a powerful native Windows scripting language, which is
widely adopted by system administrators for automation. Being a native
command line shell for Windows operating systems,
it is often not restricted by organizations.
This enables attackers and red team members to leverage this powerful tool to
carry out a wide range of attacks and penetration testing.
PowerShell has the capabilities to interact with many
different components of operating systems,
which makes it a good choice for attackers if they intend
to compromise a Windows‑based system.
The Python script is the initial step and lets you execute the tool
after which you will be presented with options either to execute a
specific task or run this tool as a whole.
This means the tool will perform all the tasks required to
gather data and send it to the attacker.
The techniques that we will cover involve screen captures,
scheduled tasks,
automated exfiltration, and Exfiltration over
Alternative Protocol. To perform the demo,
we will be using a Windows 10 machine. As a prerequisite, the tool
requires you to have Python installed on your system.
Alternatively,
you can use PyInstaller to compile Powershell‑RAT.py into an executable file.
However,
in this demo, we won't be using PyInstaller as we already have
Python set up in our Windows 10 machine.
You will also need two Gmail accounts.
One account will be used to send the email, another account
where the screenshots will be received.
Or, you can use a single Gmail account to send and receive emails.