remote-access-trojan

A Remote Access Trojan (RAT) with UEFI persistence, fully implemented in Rust.

Features

• Remote shell for both Windows and Linux (conhost.exe and /bin/bash).
• TCP C&C channel with TLS encryption.
  • With the help of rustls, OpenSSL is completely not required to work.
• Terminal frontend using xterm.js in operator control panel.
• OpenAPI-based HTTP/2 management API, which can be easily integrated with another web frontend.

Windows-only

• Bypass Windows reinstallation ("Reset this PC" option).
  • Cannot bypass reinstallation using a Windows installation media (USB/DVD) though. The persistence works by creating a new boot entry and setting it as default. When using an installation media, the malicious boot entry still exists, but Windows sets its legitimate boot entry as default.
• Kernel-mode self-defense: preventing our user-mode process and its threads from being memory-written, suspended or terminated.
• Does not trigger PatchGuard.
• Obfuscated dropper using XOR encryption with a 64-byte key (created by hashing the build timestamp with SHA512).
  • The dropper is more like a tool rather than a system component. You can replace it with a batch script that:
    • Verify the system is using UEFI, Secure Boot is disabled.
    • Mount ESP.
    • Copy bootmgfw.efi (legitimate) to bootmgfw_old.efi.
    • Drop rat-efi to bootmgfw.efi, violet04.efi.
    • Unmount ESP.
  • In addition to obfuscation, the dropper can write files directly to the ESP without mounting the partition, thereby reducing the likelihood of detection by monitoring systems.

Demonstration

Because the trojan is executed as a Windows service, we automatically get a remote shell as NT Authority\System:

Of course, the self-defense feature can prevent user-mode processes from terminating our malware, even when we are already System.

Attempts to terminate our threads will also fail. For example, when trying to do so using an Administrator Process Explorer:

Build instructions

Linux

Important

This section will be written in the future.

Refer to the Dockerfile for the detailed procedure.

Windows

The build was tested with Rust 1.96. Additional required stuff beside the default target x86_64-pc-windows-msvc includes:

• The target x86_64-unknown-uefi.
• The crate cargo-wdk via cargo install cargo-wdk. The build was tested with cargo-wdk v0.1.1. Future versions are not guaranteed to work though.
• Windows Driver Kit (WDK) build 26100.6584. You can install from here, or just use the installer at extern/wdksetup.exe.

After installing the above, simply run scripts/build.bat to build in debug mode. For release mode, run scripts/build.bat release. The script was designed to execute independently of the working directory, so you don't have to cd to the repository root or anything (and honestly, all scripts should be written this way).

Refer to the GitHub Actions config for the detailed procedure.

Deployment

• Server:
  • Linux: rat-server
  • Windows: rat-server.exe
• Client:
  • Linux: rat-client
  • Windows: rat-dropper.exe (run as Administrator once)

Note that the TLS certificate used by the server must be signed by the root certificate that is trusted by the client. Usually, the rat-client build script already handles this.

Known limitations

• No authentication nor authorization has been implemented in the management API yet.

Windows-only

• UEFI persistence works only on Windows 10.0.19041.
• Cannot bypass UEFI Secure Boot yet, though you can refer to this repository for a proof-of-concept vulnerability.
• The C&C address is hard-coded in rat-driver. There is currently no way to dynamically set it from the dropper except modifying the embedded binary.