WEBVTT

00:00:00.540 --> 00:00:03.690
It is absolutely not important to know all the coding

00:00:03.690 --> 00:00:05.850
of the scripts used in this tool,

00:00:06.540 --> 00:00:10.580
but it is important that you should be familiar with blocks of

00:00:10.580 --> 00:00:14.060
code for this tool mainly for two reasons.

00:00:14.540 --> 00:00:18.460
First, if you want to execute only a part of this tool,

00:00:19.040 --> 00:00:24.050
let's say you need to configure only a specific scheduled task or

00:00:24.110 --> 00:00:26.560
you just need to delete the screen capture files,

00:00:27.440 --> 00:00:31.150
you can select only a specific option and you should be aware of

00:00:31.150 --> 00:00:33.650
which piece of code is performing that task.

00:00:34.440 --> 00:00:37.850
The second reason why you may want to know the working of this

00:00:37.850 --> 00:00:40.860
tool is when you want to change some settings.

00:00:41.540 --> 00:00:43.300
So, for example,

00:00:43.460 --> 00:00:47.930
if you want to save the screenshots in some other folder as opposed

00:00:47.940 --> 00:00:52.600
to the default location or you want to edit the email address that

00:00:52.600 --> 00:00:54.560
will be used to send the screenshots,

00:00:55.440 --> 00:00:58.350
you should know where you need to make the changes.

00:00:59.140 --> 00:00:59.800
So,

00:00:59.820 --> 00:01:05.260
we will be focusing only on some key areas of scripts that you must be aware of.

00:01:07.340 --> 00:01:09.720
As soon as you execute the Python script,

00:01:09.900 --> 00:01:12.590
you will be presented with nine different options.

00:01:14.540 --> 00:01:17.360
Each of the actions will perform a specific task,

00:01:17.840 --> 00:01:22.760
and it is quite self‑explanatory from the names what each option will do.

00:01:23.440 --> 00:01:27.250
Each of these options will execute a piece of code in the back end.

00:01:28.240 --> 00:01:30.460
I will now switch to the PowerShell ISE,

00:01:31.340 --> 00:01:33.680
and here we can see three PowerShell scripts.

00:01:34.740 --> 00:01:36.960
The first one is Shoot.ps1.

00:01:37.940 --> 00:01:41.650
This script captures the screenshot and saves it in a file.

00:01:42.440 --> 00:01:45.960
Here, you can enter the folder path where you wish to

00:01:45.960 --> 00:01:48.940
save the screenshots. By default,

00:01:48.950 --> 00:01:52.390
it says the screenshot is in the Documents folder and

00:01:52.390 --> 00:01:57.140
USERPROFILE. The following section contains the code that

00:01:57.150 --> 00:02:00.560
captures the screenshot by using a few .NET classes.

00:02:01.640 --> 00:02:04.360
Next is the Mail.ps1 PowerShell script.

00:02:05.220 --> 00:02:08.509
This script contains the code that will take all the captured

00:02:08.509 --> 00:02:11.460
screenshots and send it to the adversary.

00:02:12.440 --> 00:02:16.160
It uses Gmail's SMTP server to send emails.

00:02:16.940 --> 00:02:19.100
This is the place where the sender and receiver

00:02:19.100 --> 00:02:21.050
email address must be configured.

00:02:21.840 --> 00:02:24.150
You can configure two different email accounts,

00:02:24.540 --> 00:02:27.860
one for sending and the other for receiving.

00:02:29.040 --> 00:02:33.860
In this demo, I will use the same email address to send and receive emails.

00:02:35.050 --> 00:02:40.450
I will enter PowershellRAT5@gmail.com in username,

00:02:41.040 --> 00:02:44.650
msg.From, and msg.To variables.

00:02:45.840 --> 00:02:49.360
I must enter the password of this Gmail account in the

00:02:49.360 --> 00:02:53.300
password variable. Here in the smtp variable,

00:02:53.450 --> 00:02:59.680
you can see Gmail's smtpServer is being used to send emails. We will leave the

00:02:59.680 --> 00:03:03.760
rest of the settings as it is and move on to our next script.

00:03:04.740 --> 00:03:09.100
The delScreenShot script will delete all the screenshots taken by the

00:03:09.100 --> 00:03:14.320
Powershell‑RAT tool. It uses the Remove‑Item command and deletes all the

00:03:14.320 --> 00:03:20.260
files from the screenshot folder that resides in USERPROFILE. We then have

00:03:20.260 --> 00:03:25.960
our main script, which is PowershellRAT Python script that serves as the

00:03:25.960 --> 00:03:27.550
entry point of this tool.

00:03:28.340 --> 00:03:31.120
This is the script that runs in the back end when you

00:03:31.120 --> 00:03:35.410
execute the tool. We will quickly look into some of the

00:03:35.410 --> 00:03:37.360
important functions of this script.

00:03:38.340 --> 00:03:41.600
Do you remember the options that were displayed when we launched the tool?

00:03:42.340 --> 00:03:45.680
Each of these functions that we are going to see binds to those

00:03:45.680 --> 00:03:49.350
options. Based on the option that we select in the tool,

00:03:49.740 --> 00:03:52.160
its associated function will be invoked.

00:03:52.930 --> 00:03:56.670
The ExecutionPolicy function will execute PowerShell commands

00:03:56.960 --> 00:03:59.950
that will set ExecutionPolicy to unrestricted.

00:04:00.640 --> 00:04:04.900
The takeScreenshot function will execute the Shoot.ps1 PowerShell script

00:04:05.160 --> 00:04:10.610
that will capture a screenshot. ScreenShotTaskScheduler will create a

00:04:10.610 --> 00:04:14.150
Windows Task Scheduler that will run every 1 minute,

00:04:14.540 --> 00:04:17.260
thereby taking screenshots at each minute.

00:04:18.339 --> 00:04:23.330
The sendMail function will execute the Mail.ps1 script and send the

00:04:23.330 --> 00:04:27.060
screenshot files to the email address configured in that script.

00:04:27.940 --> 00:04:32.750
MailTaskScheduler will create a Windows Task Scheduler that will turn

00:04:32.760 --> 00:04:36.360
every 5 minutes to send email to the adversary.

00:04:37.440 --> 00:04:42.080
The same goes with deleting screenshots. The deleteScreenShot function deletes

00:04:42.080 --> 00:04:48.080
the screenshots from a user's profile and deleteTaskScheduler will create a

00:04:48.080 --> 00:04:51.650
scheduler for it that will run once every 12 minutes.

00:04:52.440 --> 00:04:53.210
Finally,

00:04:53.300 --> 00:04:57.370
there's the HailMary function that will create all the scheduled tasks

00:04:57.380 --> 00:05:01.860
at once and sets a Powershell‑RAT backdoor in one go.

00:05:02.440 --> 00:05:04.750
We will be demonstrating this in a while