# Modules

* See below for each modules documentation
* To get to modules right click a call back and you will see the following options

| Surveillance                          |
| ------------------------------------- |
| Remote Shell                          |
| Remote Screen                         |
| Remote Camera                         |
| Remote Regedit                        |
| File Manager                          |
| Process Manager                       |
| Netstat                               |
| Record                                |
| Program Notifications (Start \| Stop) |

### Remote Shell

* Exactly what it sounds like
* Click on the module wait for below to appear

```
Microsoft Windows [Version 10.0.20348.1787]
(c) Microsoft Corporation. All rights reserved.
```

* This is a `cmd.exe` prompt not a powershell prompt!
* Use the white bar at the bottom to execute commands

<figure><img src="https://2098276108-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwXbmWAdfb5sb4Veuw2rn%2Fuploads%2FzmJRoxHvm1lugL4nuPCj%2Fimage.png?alt=media&#x26;token=41b4ac0b-5922-46db-b56d-480eb590ad81" alt=""><figcaption></figcaption></figure>

### Remote Screen

* Also exactly what it sounds like
* View the remote screen of the remote system
* It can take a second to load, please be patient.
* Screen sharing can be controlled (off/on) with the `Start` button at the top left
* Option to `View only` or control the remote machine via your `mouse` and `keyboard`
* To turn either on press the respective button at the top
* Can also take auto screenshots with the `Camera` button also at the top

  * By default it will capture the screen every \~3 seconds
  * IMO that is far too fast, I am working on tuning it to roughly every 30 seconds to drop the amount of network traffic that is required with the screenshots.

  <figure><img src="https://2098276108-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwXbmWAdfb5sb4Veuw2rn%2Fuploads%2FAI3kiA90RhbvBUBpvBvt%2Fimage.png?alt=media&#x26;token=927fcf2c-19b9-4af4-bb2a-d45c8dd2696b" alt=""><figcaption></figcaption></figure>

### Remote Camera

* View the remote systems webcam
* Requires loading `RemoteCamera.dll` into memory which will happen automatically
* If no camera if found the pop up will exit automatically

### Remote Regedit

* Remotely view the registry in addition to creation of new keys or modification of existing keys

<figure><img src="https://2098276108-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwXbmWAdfb5sb4Veuw2rn%2Fuploads%2FgRmjD1Uvglfi0UOeiLkE%2Fimage.png?alt=media&#x26;token=c49711aa-6b6f-4d0c-9207-f96c9909951d" alt=""><figcaption></figcaption></figure>

* To create a new key click on `Edit` at the top and follow the prompts
* It is nearly identical to the normal `Regedit` program on Windows

### File Manager

* File manager for remote upload, download, compressing and general file manager options
* Just point and click
* To move up a directory after traversing down the file system ensure you `Right Click --> Back`
  * That took me longer to figure out than I care to admit pubically

<figure><img src="https://2098276108-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwXbmWAdfb5sb4Veuw2rn%2Fuploads%2FzEIjsaie3fC9YJzI3GBF%2Fimage.png?alt=media&#x26;token=022cf5a8-bc00-4f46-a4d7-5028141e2e8f" alt=""><figcaption></figcaption></figure>

* When you download a file a `ClientsFolder` will get created, you can find your exfil'ed file there

```
DcRat\Binaries\Debug\ClientsFolder\1427F5A9B444217138E1 #String is client id
```

### Process Manager

* Exactly like it sounds
* View running process
* Right Click to `Refresh` or `Kill` a specific process
* Refreshes pulls a up to date process list
* It is better opsec to not constantly upload as that can greatly increate the amount of network traffic

<figure><img src="https://2098276108-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwXbmWAdfb5sb4Veuw2rn%2Fuploads%2F6geBwv67l7msbur8J0E1%2Fimage.png?alt=media&#x26;token=e22bdd0b-d0c7-459c-bb4e-cc57f75b71b8" alt=""><figcaption></figcaption></figure>

### Netstat

* Exactly like it sounds
* View network connection on the remote host
* `Right Click` and select `Refresh` or `Kill`
* Selecting `Kill` attempts to kill the process creating that network connection

<figure><img src="https://2098276108-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwXbmWAdfb5sb4Veuw2rn%2Fuploads%2Fv6x25lbrC0f1e5zU1tqm%2Fimage.png?alt=media&#x26;token=8c305408-28ef-4501-8c39-d3a3eca4bcaa" alt=""><figcaption></figcaption></figure>

### Record

* Record the audio off the remote systems microphone

<figure><img src="https://2098276108-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwXbmWAdfb5sb4Veuw2rn%2Fuploads%2F5UkOYSFWMQiZCmKR4L3R%2Fimage.png?alt=media&#x26;token=ba0e8fb5-41cb-445a-a18f-dfa9374e6d2e" alt=""><figcaption></figcaption></figure>

* If the remote system has no microphone you will get an error in the logs

<figure><img src="https://2098276108-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwXbmWAdfb5sb4Veuw2rn%2Fuploads%2Fgsa4HUSsLQiwaatukMjI%2Fimage.png?alt=media&#x26;token=ebc1a72e-6025-42b1-957b-5af5537c83d2" alt=""><figcaption></figcaption></figure>

* Requires the `Audio.dll` file to be automatically loaded onto the remote systems memory

### Program Notification

* Alert the operator when a specific remote process is launched on the system
* Defaults to `Uplay,QQ,Chrome,Edge,Word,Excel,PowerPoint,Epic,Steam`
* Currently changed to:

```
Chrome,Edge,Firefox,Word,Excel,PowerPoint,Task Manager
```

<figure><img src="https://2098276108-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwXbmWAdfb5sb4Veuw2rn%2Fuploads%2FuuS4RPaCCnzXok49YjRD%2Fimage.png?alt=media&#x26;token=650ba51c-7090-410c-95f9-d9df17803912" alt=""><figcaption></figcaption></figure>

| Control          |          |                   |                     |
| ---------------- | -------- | ----------------- | ------------------- |
| Send File -->    | From URL | Send File to Disk | Send File to Memory |
| Run Shellcode    |          |                   |                     |
| Message Box      |          |                   |                     |
| Chat             |          |                   |                     |
| Visit Website    |          |                   |                     |
| Change Wallpaper |          |                   |                     |
| Keylogger        |          |                   |                     |
| File Search      |          |                   |                     |

### Send File

### Run Shellcode

### MessageBox

### Chat

### Visit Website

### Change Wallpaper

### Keylogger

### File Search

| Malware           |         |         |
| ----------------- | ------- | ------- |
| DDOS              |         |         |
| Ransomware -->    | Encrypt | Decrypt |
| Disable WD        |         |         |
| Password Recovery |         |         |
| Disable UAC       |         |         |

### DDOS

### Ransomware

### Disable WD

### Password Recovery

### Disable UAC

\-- All modules not currently listed yet