Nuclear RAT 1.0 Tiny Tutorial

by Caesar2k

First of all, lets situate ourselves in the client 'hall', where you access everything in the RAT. The 1 mark is the Create Server, where we will go for creating a server at first instance. The 2 mark is the Connection manager, we will take a look later.

Enough talking lets do it: After you click the Create server button, you will see this screen:

WTF does all this edits means? Well here is the explanation:

URL: This is where you put the full path for your file containing your updated IP, so the servers can connect to it. Put the complete location including http:// and the file after the /
Eg.: http://someserver.com/ip.txt
NOTE: the file containing the IP can have any name or extension

DNS: Can be your static IP or a DNS. So you can be at 56k or other dynamic IP connection, that the DNS will redirect it to your IP.
You can use No-IP or DynDns.
NOTE: If you are going to use direct connection, you can use this DNS as a "password", that you allow just the owner of this DNS to connect to the server.

DNS Port: For direct connection, this will be the port that the server will listen on! For reverse connection, this will be the port, together with your DNS, that will connect to you.

URL is Redirect Service: If you want to be sure that the servers aren't going to be lost, then setup a mirror service, like CJB.net or ShortURL.com, that allows you to create pages that redirects to another, like your ip.txt file is in the server http://blah.hypermart.com/ip.txt, and you have another page that have http://members.lycos.com/ip.txt. So you create a redirection service that points to hypermart. If its goes down or anything like it, you can change the redirect to the Lycos, so you wont lose your servers.
NOTE: Only check this if youre going to use the URL for IP retrieving.

Direct Connection: Check this box to create a direct connection server, means that the server will open a port when online so you can connect directly, in the client 'hall' using the IP edit and the connect button

Test Server: A test module for the server, wont write any startups or create folders, will just drop the dll into Windows folder with the name NRDLL.dll. You can create direct or reverse connection test servers, just choose between then

Here is the instalation tab for NR server. You choose the filenames of dll and server executable, folders to install and where to inject.
NOTE: If youre creating a test server, no need to change Filename, Dll Name, Folder Name and Startup

Filename: The executable that will be placed on the chosen folder. Include extension and must be a valid executable extension!
Eg.: nuclearRAt.exe

DLL Name: The dll name that will be dropped in the chosen folder. Don't include .dll or it will look like server.dll.dll

Folder Name: The folder where everything will be installed to. Must follow the syntax, otherwise it will create a folder named NR under Windows Folder!
Variables:

%w: Will create the folder under windows folder

%s: will create under the system folder

%pf: Will create under program files folder

NOTE: Follow this syntax - %variable\Foldername

Startup: Will make the server to startup within windows.
Stealth Shell Folder: Will make everything in the folder to startup
Run: HKLM\Run and RunServices

Inject to: You choose where the server should inject. You can use the following variables
%w: Will create the folder under windows folder
%s: will create under the system folder
%pf: Will create under program files folder
%i: Inject to already running process.
You can also set multiple injection places, so you can assure the server will always start. Limit each target with a *
Eg.:%pf\Internet Explorer\iexplore.exe*%iexplorer.exe*%s\calc.exe
NOTE: You must use this syntax - %variable\PathToEXE. When using %i, use this way - %iexplorer.exe (injects to already running explorer.exe)

Here are the Misc. options. They are self explanative, but anyway

Assigned Name: If you create a server for your work computer then put a suggestive name, like Work Computer :P
This is useful to keep track of each server, and where/how they are installed

Melt Server: Deletes itself at first execution

All other checkboxes: Hooks to perform the checkbox description

Enable fake error. If you don't want to use it, just leave the Title and Message blank.

Test: Test the message box to see how it looks like

NOTE: Use | to emulate carriage + line feed when writing the message. Like "Runtime error 1089|Library not loaded"

Put the full location to the PHP script. For further info about the script, check the logger.php file.

Ok, after you clicked building and saved the server, lets go to the Connection Manager dialog (mark number 2).
NOTE: If you build a direct connection server, disregard this part. Direct connection happens in the client 'hall', in the Connect button area.

1: FTP Location (IP/HOST), usually ftp.yourhost.com

2: The IP for the server to connect. You can put somewhere else IP

3: Get your current IP for updating

4: If using FTP, then this is your FTP login pass, if using PHP for updating the file, then its the pass you put to allow writing (check change.php for further info)

5: +Show the client where to upload the file. Usually on root -> /

6: +Your login name for accessing the FTP

7: +The file name that will be uploaded

8: The port to start listening for connections on the client

9: When using the PHP script, the complete URL for the change.php script, including http://

10: Enable using PHP instead of using FTP to upload

11: Changes the file remotly and start listening

12: If you are only using DNS, then check this, the client will open the port immediately without modifying files

13: Beep when a new connection is established. It works with direct connection too.

+ means only when using FTP

Hope this tutorial help people out to configure NR to make it sucessifully usable. But remember this isnt a newbie RAT, if you want one easy like get Sub7.
~Caesar2k

Nuclear Winter Crew