Step by Step on How to Setup DarkComet

  • 5,910 views
Uploaded on

This is a guide on how setup DarkComet RAT the free and popular Remote Administration Tool. …

This is a guide on how setup DarkComet RAT the free and popular Remote Administration Tool.

This software is an efficient type of software, especially created to remote control any Microsoft
Windows machine.

More in: Technology
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Be the first to comment
No Downloads

Views

Total Views
5,910
On Slideshare
0
From Embeds
0
Number of Embeds
2

Actions

Shares
Downloads
74
Comments
0
Likes
1

Embeds 0

No embeds

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
    No notes for slide

Transcript

  • 1. Ultimate Guide to Setup DarkComet RAT with NoIP What is Darkcomet? DarkComet RAT is a free and popular Remote Administration Tool. This software is an efficient type of software, especially created to remote control any Microsoft Windows machine. It is famous for being one of if not the most stable and most complete RAT’s available. Just like VNC and other similar types of software, DarkComet gives you the ability to connect to and control your systems, wherever you are. You can keep a close eye on your computers to supervise the online activity of your employees or children. Furthermore DatkComer RAT can be used to monitor your system, remotely assist your clients or family members to recover lost data or repair a computer. The main functions of DarkComet RAT are System Monitor (Process, Registry, Startup, DNS Manager, etc.), File manager (which is even more complete than an FTP-server), Surveillance (Micro-capture, Keylogger, Screen capture, Webcam capture, etc.), Network functions (Scan for local computers, monitor network activity, WIFI viewer, download files from web, etc.) and much more. Both the DarkComet RAT Controller and its Controlled module can be detected by some antivirus-programs but that constitutes a false positive due of the abilities of the program in the system. The package doesn’t and will not ever contain any viruses or other types of malware. Its why DarkComet RAT got such a very good reputation. HackingSpace.org
  • 2. Requirement before Setup 1. Latest Darkcomet RAT Legacy v5.4.1. Link to download will be provided at the end of this post. 2. A No-IP account (Click to visit site) What is No-IP? No-ip is a DNS redirectional service. You may have used it before if you managed a RSPS. For RSPS, it was easier than remembering a specific IP like 83.111.911.83 for an example. Rather RSPSserver.zapto.org or something. For your RAT, it simply covers your ass if your IP changes. The problem with direct linking to your IP is if your IP changes and you’re NOT using No-ip, you lose every single one of your slaves. This is where No-ip comes to rescue, making sure that as long as you used it, slaves are redirected to your real IP and you keep all of your slaves. It’s why it’s so crucial. HackingSpace.org
  • 3. How to create and setup No-IP account? Go to http://www.no-ip.com/ and hover over “Sign in” and click “Sign up for an account”. HackingSpace.org
  • 4. Now go to your email and click on the confirmation link. Go Download the client app from this link or on their website. Install it in your OS. After the installation you will see this windows popup. Type in your username and password. HackingSpace.org
  • 5. After you’ve successfully login, you should see something like this. Do not freak out, click on EDIT HOSTS. Login to your noip.com type in your username and password and click on Manage Host HackingSpace.org
  • 6. Now back to your DUC or NoIp app. Click on Edit Host HackingSpace.org
  • 7. Check on the host that you’ve just created and click on Save. If you’ve done it correctly, you should see something like this. That’s it. All that you need to do with it after is keep it running, and it will perform its duty of redirecting your slaves to your real IP. Enjoy. HackingSpace.org
  • 8. How to Set up Darkcomet? This is where I see a lot of things go wrong, this is where the false information gets spread, propagated, and A LOT of things can go wrong. Let’s begin. Start by extracting and opening Darkcomet. If you recently downloaded it from the link I mentioned earlier, you have to extract it from the .ZIP before you can use it. What the @#$% happened to Darkcomet?! If your Darkcomet.exe does not have a blue asteroid icon, or just doesn’t show at all, your Antivirus has likely quarantined and/or corrupted Darkcomet. Turn it off. If you don’t have an AV and it still does this, Windows Defender is likely the cause. How to disable windows defender? Click the Start Button -> (Enter into the Search Box) -> Windows Defender > Open -> Tools -> Options -> Administrator -> Use this program? -> Uncheck > Apply -> You’re awesome! Once Darkcomet is open, an EULA should come up, just hit the checkbox, “Do not again display the EULA” and press Accept after 10 seconds. After Darkcomet is open (and it is your first time), another box should come up giving you general tips about Darkcomet. If you wish to read through it, that’s fine. Just hit “Do not show on restart” and then “Fine” after you are done. Once it is open, go to the Socket/net Tab at the top middle-right and right click in the general area, and click “Add port to listen.” HackingSpace.org
  • 9. This box should come up. What should I put for the port? The port, like the No-ip, does not matter. The only two restrictions are it HAS to be a number between 1-65535 and another program must not be using it. Other than that, go free. 1337 or 1604 or 101 are all popular, it’s really your own preference, though. Once you click Listen, a Windows Firewall diologue box should pop up (If you have it enabled) and if it does, just click “Allow access”. This is Darkcomet trying to add itself as an exception to the firewall, this is fine. What is upnp.exe in %temp% for? Darkcodersc (Coder of Darkcomet) added Universal Plug and Play to Darkcomet. This is not a RAT or a keylogger, it is simply trying to portforward for you automatically. I’d say this is a good thing, especially since most routers support it and it would eliminate the hassle for you trying to portforward. Once it is added, navigate to Canyouseeme.org and check if it’s open. If UpNP worked successfully, your port should be open and working. HackingSpace.org
  • 10. Hurray! Good for you. If it’s not, do the following. 1. Completely Disable Windows Firewall/Any other Firewalls you may have. (These often block the ping from canyouseeme.org) 2. Completely disable your antivirus (Some block the connection as well.) 3. Make sure Darkcomet is open AND listening to the port. (I cannot stress this enough, it will be a false negative, your port MUST be listened to before it can show as open.) If it still not open, I will have a mini tutorial soon for portforwarding near the bottom of the post. Alright. My port is open, Darkcomet is open, what do I do now? Make a stub. HackingSpace.org
  • 11. There are two different options for making a stub: Minimalist and Expert. I will sum up the options here:  Minimalist: Little options, very hard to screw up but still possible.  Expert: A plethora of options, any screw up will leave you with a corrupted server after crypting.  Settings for Minimalist: Stub ID is a variable which can set to your liking, though it could be used for organization of your slaves. IE: From Youtube, From Ewhoring, From Torrents, From X Crypter, etc. IP/DNS: No-ip address. Port: The port you chose earlier in the thread. 1604 is the default port. Generate the stub as “Normal”. Why? It has a chance to corrupt if you crypt a small server. (As it’s compressed with UPX) Why did you turn off startup? It ensures the maximum amount of compatibility for your crypter. It is much more stable to use your crypter startup. In my own experiences, it has also corrupted the stub after it was crypted, though not all the time. It’s essential to leave it off for this HackingSpace.org
  • 12. reason. Settings for Expert: Expert only has one advantage in my opinion to Minimalist, otherwise it’s the exact same. Mutex. Mutex ensures that only one copy of that specific stub runs on one slave. It is useful for making sure that your slave count is accurate, and to avoid duplicates. For Advanced Users (Note that the Client Password is not required, if you don’t want to use it, that’s fine. Just uncheck it, but I will be covering it as it does increase security for you by a good amount.) Click “Network Settings,” the settings for such can be found here: HackingSpace.org
  • 13. (Once again, 1604 was the default port for Darkcomet. Obviously replace it with the one you are using.) Skip “Module Startup”, “Install Message”, and “Module Shield”, “Keylogger”, “Hosts File”, “Add Plugins”, “File Binder”, “Choose Icon”, skip down to “Stub Finalization”. Why?? This is to ensure the maximum amount of compatability for the crypter you are using. If you want any options on any of those pages, it should be enabled on your crypter only. (Especially startup.) Now, make sure to build it according to my settings following: HackingSpace.org
  • 14. Click Build the stub, give a name to it and hit enter. Congrats, you are ready to test your stub. What about the password we set earlier? Oh right, let’s cover that! Navigate to Client Settings. Enter the password you entered earlier in Expert build (If you used it. If you did not, do not bother with this step.) HackingSpace.org
  • 15. Now, we are ready to test it. Still doesn’t work no matter what I do This is due to your router not supporting NAT Loopback, most do not. Therefore, you testing it on yourself will give you a false negative in terms of whether or not your server works. How do I test my stub, then? Use Anubis. (Uncrypted servers ONLY, Anubis distributes samples + Crypted ones do not work.) You may also be able to test it if some very helpful person were to give you a test install, otherwise running it on one of their slaves to see if your server works. (I do not do this as I have little slaves.) HackingSpace.org
  • 16. Mini Portforwarding Tutorial I understand that most routers do not have the exact same options, but the majority of them support port forwarding in the exact same way. It may be called as a different name, “Virtual Server” or “Port Opening” or “Pin holes” or just “Port Forwarding”. These are the exact same thing. Navigate to the start Menu -> Enter into search box -> Cmd -> Hit Enter. When that black box comes up, type “Ipconfig” and hit Enter. The following text should come up. Find the “Ipv4 address” and copy it down. This is the IP you’ll be forwarding too. There are multiple Ipv4 addresses, which one do I know is right? There is two ways. It is the first one to display this information (It’s not at the bottom, it’s at the very top after you type the command.) The second way is if it has “default gateway”. This is a surefire way to tell that it is correct. HackingSpace.org
  • 17. Copy the “Default Gateway” into the address bar of your browser. Then hit enter. If your router has a password, it should prompt you for a password.A quick google search of your router model + default password will probably reveal it. That’s on you. Once you’re at your router page, it can be tricky to locate the “Port forwarding” option. It is, in most cases, located under the Security section/Firewall/Advanced Settings/Advanced Setup. It’s different for every router, so there is no way to encompass them all. Mine was under Advanced Setup. Yours should look similar to mine (but not in GUI, but in options.) HackingSpace.org
  • 18. Starting Port: The port you’re going to use on your RAT. Ending port: The port you’re going to use on your RAT. (Note that Starting port and Ending port should be the same number. As it only requires one port to RAT for Darkcomet.) Protocol: TCP (It’s what Darkcomet uses.) If your router only has “Both” and you want to be doubly sure, go ahead. It doesn’t matter, as long as it encompasses TCP at one point or another. IP address: That IPv4 address from CMD, enter that in that box. Since the other settings are marked as optional by my router, the only thing you need to do now is hit the equivalent of “Apply” on your router. It may be save settings, it may be apply settings, whatever. Your router may restart to apply them, and it may not. It depends on what you have. Darkcomet is open (and listening to the port). Windows Firewall is off. Antivirus is off. I followed the mini portforwarding guide. My port is still not open. What do? In this, there is only one more option on your router that could be of assistance. In my case DynDNS: (Dynamic DNS) This will allow ANY traffic from any port on your HackingSpace.org
  • 19. router. This is a major security concern. If you wish to allow it, find “Dynamic DNS” on your router, enable it and enter your IPv4 address and hit Apply. That’s All! I hope you enjoyed the tutorial. If I did ANYTHING wrong at all, I gave the false info, I had a spelling mistake, my image was not relevant. PLEASE leave the comment or shoot me an email. I really love to hear your feedback on this post. Download Links: Darkcomet v5.4.1 Legacy Mirror Links: Mirror Link 1 Mirror Link 2 Mirror Link 3 HackingSpace.org