WEBVTT

00:00:01.540 --> 00:00:06.510
Powershell‑RAT, as we saw in the previous module, is a back door for Windows

00:00:06.510 --> 00:00:11.980
machines that tracks user activity using screen captures and sends those

00:00:11.980 --> 00:00:15.550
screenshots to the attacker as an email attachment.

00:00:17.340 --> 00:00:19.760
This tool was developed by Viral Maniar.

00:00:20.840 --> 00:00:25.250
This is a post‑exploitation tool that is primarily written in Python,

00:00:26.040 --> 00:00:28.950
but the exploitation agents are written in PowerShell.

00:00:30.440 --> 00:00:32.659
Since it's a post‑exploitation tool,

00:00:33.040 --> 00:00:36.440
an attacker must first find a way to place this malicious

00:00:36.440 --> 00:00:38.860
payload onto the victim's computer.

00:00:39.740 --> 00:00:41.590
Once this payload is in place,

00:00:42.140 --> 00:00:46.370
the attacker can choose to execute the tool that will periodically send

00:00:46.370 --> 00:00:51.740
screen captures over Gmail; hence, the tool can be used to perform data theft

00:00:51.750 --> 00:00:54.550
by deploying the payload on the victim's machine.

00:00:55.640 --> 00:00:59.540
As its name goes, Powershell‑RAT heavily uses Windows

00:00:59.540 --> 00:01:03.800
PowerShell for the data bridge. It leverages PowerShell

00:01:03.940 --> 00:01:09.360
right from capturing screenshots, creating scheduled tasks, and sending emails.

00:01:09.940 --> 00:01:13.980
PowerShell is a powerful native Windows scripting language, which is

00:01:13.980 --> 00:01:18.440
widely adopted by system administrators for automation. Being a native

00:01:18.440 --> 00:01:20.980
command line shell for Windows operating systems,

00:01:21.330 --> 00:01:24.660
it is often not restricted by organizations.

00:01:25.040 --> 00:01:30.290
This enables attackers and red team members to leverage this powerful tool to

00:01:30.290 --> 00:01:33.460
carry out a wide range of attacks and penetration testing.

00:01:34.240 --> 00:01:37.090
PowerShell has the capabilities to interact with many

00:01:37.090 --> 00:01:39.300
different components of operating systems,

00:01:39.390 --> 00:01:43.430
which makes it a good choice for attackers if they intend

00:01:43.430 --> 00:01:45.760
to compromise a Windows‑based system.

00:01:46.840 --> 00:01:51.060
The Python script is the initial step and lets you execute the tool

00:01:51.740 --> 00:01:57.180
after which you will be presented with options either to execute a

00:01:57.180 --> 00:02:00.190
specific task or run this tool as a whole.

00:02:01.340 --> 00:02:05.020
This means the tool will perform all the tasks required to

00:02:05.020 --> 00:02:07.460
gather data and send it to the attacker.

00:02:08.820 --> 00:02:12.060
The techniques that we will cover involve screen captures,

00:02:12.640 --> 00:02:13.660
scheduled tasks,

00:02:14.340 --> 00:02:17.960
automated exfiltration, and Exfiltration over

00:02:17.970 --> 00:02:21.600
Alternative Protocol. To perform the demo,

00:02:21.800 --> 00:02:27.030
we will be using a Windows 10 machine. As a prerequisite, the tool

00:02:27.030 --> 00:02:29.960
requires you to have Python installed on your system.

00:02:30.740 --> 00:02:31.760
Alternatively,

00:02:31.880 --> 00:02:37.850
you can use PyInstaller to compile Powershell‑RAT.py into an executable file.

00:02:38.640 --> 00:02:39.450
However,

00:02:39.840 --> 00:02:44.610
in this demo, we won't be using PyInstaller as we already have

00:02:44.610 --> 00:02:46.950
Python set up in our Windows 10 machine.

00:02:48.240 --> 00:02:50.280
You will also need two Gmail accounts.

00:02:50.840 --> 00:02:54.770
One account will be used to send the email, another account

00:02:54.850 --> 00:02:56.860
where the screenshots will be received.

00:02:58.040 --> 00:03:02.450
Or, you can use a single Gmail account to send and receive emails.