It is absolutely not important to know all the coding
of the scripts used in this tool,
but it is important that you should be familiar with blocks of
code for this tool mainly for two reasons.
First, if you want to execute only a part of this tool,
let's say you need to configure only a specific scheduled task or
you just need to delete the screen capture files,
you can select only a specific option and you should be aware of
which piece of code is performing that task.
The second reason why you may want to know the working of this
tool is when you want to change some settings.
So, for example,
if you want to save the screenshots in some other folder as opposed
to the default location or you want to edit the email address that
will be used to send the screenshots,
you should know where you need to make the changes.
So,
we will be focusing only on some key areas of scripts that you must be aware of.
As soon as you execute the Python script,
you will be presented with nine different options.
Each of the actions will perform a specific task,
and it is quite self‑explanatory from the names what each option will do.
Each of these options will execute a piece of code in the back end.
I will now switch to the PowerShell ISE,
and here we can see three PowerShell scripts.
The first one is Shoot.ps1.
This script captures the screenshot and saves it in a file.
Here, you can enter the folder path where you wish to
save the screenshots. By default,
it says the screenshot is in the Documents folder and
USERPROFILE. The following section contains the code that
captures the screenshot by using a few .NET classes.
Next is the Mail.ps1 PowerShell script.
This script contains the code that will take all the captured
screenshots and send it to the adversary.
It uses Gmail's SMTP server to send emails.
This is the place where the sender and receiver
email address must be configured.
You can configure two different email accounts,
one for sending and the other for receiving.
In this demo, I will use the same email address to send and receive emails.
I will enter PowershellRAT5@gmail.com in username,
msg.From, and msg.To variables.
I must enter the password of this Gmail account in the
password variable. Here in the smtp variable,
you can see Gmail's smtpServer is being used to send emails. We will leave the
rest of the settings as it is and move on to our next script.
The delScreenShot script will delete all the screenshots taken by the
Powershell‑RAT tool. It uses the Remove‑Item command and deletes all the
files from the screenshot folder that resides in USERPROFILE. We then have
our main script, which is PowershellRAT Python script that serves as the
entry point of this tool.
This is the script that runs in the back end when you
execute the tool. We will quickly look into some of the
important functions of this script.
Do you remember the options that were displayed when we launched the tool?
Each of these functions that we are going to see binds to those
options. Based on the option that we select in the tool,
its associated function will be invoked.
The ExecutionPolicy function will execute PowerShell commands
that will set ExecutionPolicy to unrestricted.
The takeScreenshot function will execute the Shoot.ps1 PowerShell script
that will capture a screenshot. ScreenShotTaskScheduler will create a
Windows Task Scheduler that will run every 1 minute,
thereby taking screenshots at each minute.
The sendMail function will execute the Mail.ps1 script and send the
screenshot files to the email address configured in that script.
MailTaskScheduler will create a Windows Task Scheduler that will turn
every 5 minutes to send email to the adversary.
The same goes with deleting screenshots. The deleteScreenShot function deletes
the screenshots from a user's profile and deleteTaskScheduler will create a
scheduler for it that will run once every 12 minutes.
Finally,
there's the HailMary function that will create all the scheduled tasks
at once and sets a Powershell‑RAT backdoor in one go.
We will be demonstrating this in a while