Full Beast Tutorial
by Itchy
A note:
This tutorial was written for Beast 2.07. If you're using an different version, some of the features I explain in this tutorial will not appear in your version.
Thank you and congratulations to tataye, for coding such a great RAT. Without Beast, this tutorial would not exist!
You can download the Beast from BeastDoor Downloads
About the anchors on this page: I know it will confuse everyone if I don't explain it, so I will. Most of the large images are image maps, so you can click on different sections of the images to go to the corresponding part of the tutorial. All of the Blue Text and Green Text are anchors. I know the anchors are in weird places, but I wanted to make getting around the page a lot easier.
The Red Text is important, read it when you see it, it contains important information that you need to know.
This
tutorial is separated into three sections:
Client
This is what Beast should look like when you open it:
Title Bar: If you right-click on the title bar, you will get:
· Rollup/Restore: "Rolls up" the window, you are left with only the title bar. Restore restores the window
· Minimize: Minimizes all Beast windows to the taskbar
· Minimize to Tray: Minimizes all Beast windows to the tray, and will appear as a small Beast head icon in the tray.
· Close: Closes Beast 2.07 and all of its open windows
Note: You can do these four things by clicking the appropriate button in the top right hand corner of the title bar, or by clicking the Beast icon in the top left hand corner of the title bar. Also, if you open any managers, etc. you will only get Rollup/Restore and Close
You may also press {Ctrl + Alt + Shift + A} at any time to hide the Beast client and all its open windows from the tray/taskbar and from visible view. Pressing {Ctrl + Alt + Shift + A} again will show all of Beast's windows again. However, this will not stop Beast from showing up in the Task Manager.
Direct Connection:
Host:
This is
where you enter the IP address of the remote computer
once you have received it in the
notification
Port: The Listen Port that the server has opened for you to connect, also
gotten from the notification. You set this in the server builder.
Password: This is optional, and is set in the server builder.
If you
enter the wrong password, you will not be able to connect.
Go BEAST!/Connecting/Disconnect: Use "Go BEAST!" to connect using direct connection once you have entered all the right information, and it will turn into the "Connecting" button while trying to establish a connection with the remote computer. Once it has connected to the remote computer, it will turn to "Disconnect". It will also turn into "Disconnect" when you connect using reverse connection. Hit "Disconnect" at any time to disconnect from the remote computer.
Address Book (Indicated
by 
): This
opens the Beast's address book. Here, you can store the information of any
remote computers that you wish to keep. You have these options:
· IP Address/Port/Pass/Comment: This is where you enter or edit the information you want for the current entry
· Add: Adds the information in the fields to an entry in the list above.
· Remove: Removes the currently selected entry from the list
· Replace: Select an entry from the list above, and change the fields to what they should be. Then, hit this button to replace the data in the entry to the new data you have entered
· Connect: Select an entry from the list, and hit this to automatically connect to that computer
· Save: Saves all of the above entries to a .bad file onto your computer, for viewing with Beast later
· Load: Loads a .bad file from your computer and shows you the entries in the list.
Port: The SIN Port needed to receive SIN notifications. You will not receive this in ICQ/E-mail/CGI Notifications, you must remember it.
Start/Stop Listening [SIN]:
You hit this button once you have entered the SIN Port, to
receive SIN notifications. To stop "listening", hit the button
again.
Remote
Computer List: This is where the remote
servers will appear if
they have connected to you.
Once you receive a notification, a small
Beast head will appear here. Double-click on it to connect to that particular
server.
You may right-click in this area, and get the following
options:
· Report View: If you select this, you will get two headers, UserName and IP. The UserName is the name of the Windows account the remote user is using, and IP is the remote user's IP address.
· Icon View: The default view, remote users will appear as large Beast head icons, with the UserName and IP under the icon.
· Connect: Connects to the server selected by the right-click. If you get a message "Please select an item", it means you have not right-clicked on an icon, you have right-clicked on a blank space.
Build Server:
Opens the Server Builder.
Plugins: This option was implemented to reduce server size. Accessible
only when you are connected, this will give you the Plugins window. This will
upload or unload the plugins of your choice. It will give you these options:
· ScreenShots/Webcam [50KB]: Allows use of the Screen Capture and Webcam Capture features
· Protected Storage Passwords [15KB]: Allows retrieval of the passwords in the protected storage.
· ICQ/Trillian Passwords [12KB]: Allows retrieval of ICQ and Trillian passwords.
· Dial-Up Passwords [9KB]: Allows retrieval of the Dial-Up passwords, if the remote user is on dial-up.
Upload: First, select the plugin(s) you wish to upload using the appropriate checkbox(es), and hit this to automatically upload and install
Unload: First, select the plugin(s) you wish to unload using the appropriate checkbox(es), and hit this to automatically uninstall and delete
Close: Closes the Plugins window
Note: Once uploaded, the plugins may be detected by AV's. If you upload the plugins and still find you are unable to use the Screen Capture/Webcam Capture/Passwords Capture features, the AV is probably detecting and deleting them. Disable the remote AV, close and restart the Beast client, reconnect, and try to upload again.
Binder: Opens the Binder window. This binds different files together, to create one file. It will give you these options:
· Add File: Opens an "Open File" dialog box to add a file to bind with others. Select more than one file.
· Remove File: Removes a selected file. If you haven't selected a file, you will be greeted with "Please select a fuckin' file."
· Bind Files: Opens a "Save File" dialog box to bind all selected files and bind them to one file, with your choice of filename.
Note: The above three buttons are also accessible by right-clicking on the big dark box, where the file icons appear
· Choose Icon: Opens a "Extract Icon From File" dialog box. From here you can select a .exe, .dll, or .ico to extract an icon for the bound file. The currently selected icon will appear in the main Binder dialog box, above this button.
Note: The binder stub is detected by most AV's
Note: A small bug existed in Beast 2.07 a/b, where the first file bound did not execute. If this problem exists for you, please download the latest version of Beast.
Statistics (Indicated by
): Opens the statistics box,
similar to the "Networking" option in the Windows Task Manager. It detects all up/down
activity between you and the server you are connected to.
Skins (Indicated by
):
In the older versions of Beast, this changed the colour scheme of the Beast
client. With version 2.07, it opens the Skins windows, which allows you to
customise Beast much more than was possible with earlier versions.
Note: This feature was available in the private versions of Beast 2.06
The Skins window looks like this:
Undetectables
(Indicated by
):
Super Offers! If you want a private Beast 2.07, or any other offers for private
Beasts that are available, come here. Also, if you want some custom source codes
made, come here to contact tataye, and he will see to your needs.
Functions:
 |
 |
 |
 |
 |
 |
 |
Managers:
Files: Opens the file manager. Here, you can manage the files on the
remote computer. You will get these options:
· Find Drives: Click this to list the drives in the drop-down menu to the left of this button
· Refresh: Refreshes the list of files
· Download File: Downloads the selected file to the Download directory
· Download Dir: Downloads the selected directory to the Download directory
· Upload File: Opens the Upload dialog box, here is:
o Local File for upload: Here you can type the file you want to upload from your computer, but you can alternatively click the icon button next to it to open a "Load File" dialog box, and select it from there
o Remote directory: Here you can type the remote directory you want the file to appear in (If you already have a directory selected, it will automatically enter itself here)
o Remote file name: This is what the file will be called on the remote computer (The filename of the local file will automatically enter itself here, but you can change it if you want to)
o Upload: Uploads the local file to the remote directory with the remote file name
· Delete File: Deletes the currently selected file
· Rename File: Opens the Rename File dialog box, here is:
o Current File Name: Automatically entered here is the current filename. You cannot change this.
o New File Name: Here, type what you want the file to be renamed to.
o Rename: Click this to rename the Current File Name to the New File Name
· Run File: For executables, runs the currently selected executable
· Run Hidden: For executables, runs the currently selected executable, but it is not visible to the user.
· Open File: Opens the currently selected file. If it is not an executable, it will open with the default program
· Search File: Opens the Search File dialog box, here is:
o File Name (Or Part Of): Enter the name of the file you want to search for here, or simply part of the file name. The asterisk (* - wildcard) will be entered as a normal part of the filename, and not as a wildcard.
o Drive (Dir Path): Here you can select a drive, or enter a directory to search. If you have selected a drive/directory, it will automatically be entered here
o Search: Searches for the File Name in the Drive
· Attributes: Opens the View/Set File Attributes dialog box. Here is:
o File Name: Here is automatically entered the name of the currently selected file/directory. You cannot edit this.
o Read Only: Sets the Read Only attribute (i.e. data in these files cannot be edited)
o Hidden: Sets the Hidden attribute (i.e. makes the files hidden, unless the current user can view hidden files)
o System: Sets the System attribute (i.e. makes the file a system file – these are usually not viewable by default, and it is unlikely that the user has selected to view them. They also cannot be deleted)
o Archive: Sets the Archive attribute
· Delete Dir: Deletes the currently selected directory
· Erase All: Deletes all files on the user's computer. Don't do this.
Note: All of the above options are available by right-clicking on the file list
Registry: Opens the Beast Registry Manager, to edit the user's registry. You will get these options:
· Root Key: The main keys of the registry. Select one from the drop-down box
· SubKeys: Here is a list of all the subkeys in the current root key. Double click a subkey to open and view the keys in that subkey
· Current Key: Here is automatically entered the name of the currently selected key. You cannot change this manually.
· Refresh: Refreshes the Subkeys list
· Add SubKey: Adds a subkey to the current key
· Add Value: Adds a value to the currently selected subkey. There may be more than one value to a subkey
· Del SubKey: Deletes the currently selected subkey and all values under it. There must be no subkeys under the subkey you wish to delete
· Del Value: Deletes the currently selected value in the selected subkey
· Set Data: First, select a value from the list of values above. Then, change the data of the value with the edit box next to this button. Then, click the button to change the data
Screen: Opens the Beast Screen Capture Manager, to take screenshots of their current screen and sends them to you. You will get these options:
· Save Images To: You can check this to save all received desktop images to a selected directory. To change the directory, either type it in the edit box below this checkbox, or hit the icon button next to the checkbox to open a "Browse For Folder" dialog box, and select a directory from there
· As JPG: If this is selected, the images will be received and/or saved as .jpg's. If it is not selected, the images will be received and/or saved as .bmp's
· Bit Depth: Changes the quality of the images received. The lower the number, the lower quality the image, but it will transfer faster
· Interval: Sets the amount of seconds between captures. e.g. if this was 5, the remote computer will take a screen shot and send it, then wait 5 seconds after the first has been received before taking another screenshot and sending it.
· Enable Clicks: Lets you click on the image, and have it click on that area on the user's computer in real time. You may also right-click.
· Stretch Image: Stretches the image to fit the current size of the window. If unselected, the image will appear with the resolution on the remote computer
· Start/Stop: Starts/Stops the screen capture
WebCam: Opens the Beast WebCam Capture Manager, so you can view through the user's webcam. You will get these options:
· Save Images To: Same as Screen Capture Manager, if you want the images saved, check this, and type or select a directory to save to.
· As JPG: Same as Screen Capture Manager, receive and/or save the images as .jpg's if checked, receive and/or save the images as .bmp's if unchecked.
· Interval: Same as Screen Capture Manager, time in seconds between each receive/capture.
· Start/Stop: Starts/Stops the capture of the webcam
Apps: Opens the Apps Manager, here you can view/close all currently open applications. You will get these options:
· Window Name: The title of the window open
· Class Name: The class of the window open. e.g. TApplication is an application, IMWindowClass is an Instant Messenger window, etc.
· Refresh: Refreshes the list above
· Kill App: Closes the currently selected application
Processes: Opens the Processes Manager, in here you can view/close all running processes
· Process Name: The name of the process running
· Refresh: Refreshes the above list
· Kill Proc: Ends the currently selected running process
Services: Opens the Services Manager. This only works on NT (NT,2000,XP) systems and only when the user is an administrator. You can stop/start etc. the services running on the remote computer. The options are:
· View: Choose whether you want to view All services, only Stopped services, or only Started services
· Refresh: Refreshes the list
· Stop: Stops the currently selected service
· Start: Starts the currently selected service
· Disable: Disables the ability for anyone to start/stop
· Autostart: Tells the remote computer to automatically start the service at boot
· Delete: Deletes the service from the remote computer
Note: The last six options are accessible by right-clicking on the service of your choice
Clipboard: Opens the Clipboard Manager (The clipboard is the text/image that it saved when you use Copy or Cut. However, Beast does not have the capabilities to set an image into the clipboard, only text). You will get these options:
· Clipboard Text: The text that is currently in the clipboard
· Refresh: Refreshes the Clipboard Text
· Set Text: First, type what you want in the clipboard, then hit this to set it into the clipboard
· Lock/Unlock: Disables/Enables use of the clipboard
Passwords: Opens the Passwordz Manager. Here you can retrieve some of the stored passwords on the remote computer. You will get these options:
· Protected Storage Content: Retrieves the passwords in the HTTP cookies/storage. If the user doesn't choose to save the password into the password list, they will not be retrieved (As they obviously won't be in the protected storage)
· DialUp: Retrieves the Dial up passwords (If the user is using dial up, that is). However, if the user doesn't choose the "Save Password" option when connecting, Beast will not be able to retrieve the password. The other info (ISP, Phone Number, etc.) will be retrieved still.
· ICQ/Trillian: Retrieves the ICQ 2003a/b/Lite passwords stored on the computer. Also retrieves Trillian passwords of all versions. Passwords can't be retrieved if the user doesn't select the "Save Password" option when signing in. The login names will still be retrieved still.
· Save: Saves the list in the box below into a text file
Hide All: Hides all windows, including the tray and desktop (They will still be open, but just not visible to the user)
Crash: Ends all running processes, so the computer will crash
Power Off: Cuts power to the PC (Not recommended – this can cause damage to the PC)
Reboot: Reboots the computer as it would if the user selected it from the Start Menu
Shut Down: Shuts down the computer as it would if the user selected it from the Start Menu
Log Off: Logs off the current Windows user
Hide/Show Icons: Hides/Shows all icons on the desktop
Hide/Show Tray: Makes the tray invisible/visible
Hide/Show Start: Makes the Start Menu button invisible/visible
Disable/Enable Tray: Tray will still be visible, but the user will not be able to click on it. Enabling allows the user to click on it again
Open/Close CD: Opens/Closes all CD/DVD drives. Only works on NT systems
Lock/Unlock Mouse: The user will not be able to move the mouse, but is still able to click in the place where it is locked. Unlock lets the user move the mouse again
Hide/Show Clock: Hides/Shows the clock from the tray. However, the ToolTip will still be there, as will the ability for the user to double-click on the area to display the "Date and Time Properties" dialog.
Swap/Restore But's: Swaps the mouse buttons. i.e. right clicking will give left click functions, and vice versa. Restore makes buttons normal.
Crazy Mouse: Causes the mouse to move around the screen at random points with a short interval
Fun Stuff:
Hide/Show Mouse: Mouse will be hidden, and the user will not be
able to click on anything. Show restores the mouse to the centre of the screen
Lock/Unlock CD's: Doesn't let the user open/close any CD/DVD drives. Unlock restores this.
Go To URL: Click on this, type a URL, and hit OK to open the user's default browser and send them to the URL you specified
Wallpaper: Specify an image to set as the remote desktop wallpaper. Note: Only works with .bmp files
Chat: Opens a chat window between you and the remote user. The user may not close the chat, only you may do this. You will get these:
· Your Nick: Sets a nickname for your messages to the remote user
· Victim's Nick: Sets a nickname for the user's messages to you
· Size (% of victim's screen): Sets a percentage of how much of the user's screen will be taken up by the chat window. Measured diagonally
· Open/Close Chat: Opens the chat window between you and the remote computer, taking up the size specified. Close will close the convo.
· Send: Type a message to send, then hit this button or hit enter. The box above this shows all messages between you and the remote user
Restrictions: Opens the Restrictions window. With this, you can set restrictions on various parts of the Windows OS. They're all pretty self-explanatory. You may have to restart the remote system for some of the effects to take place.
Note: The Control Panel section does not work for 9x/Me systems
This is what the Restrictions window looks like:
Update: With this, you can change the settings of the current server. It will open the Server Builder, but with a few changes:
· Save Server (Build Server function) button: Changed to "Update"
· Melt Server On Install: Disabled, as it is not needed
· Fake Error Message: Disabled, as it is not needed
· Update: Once you have decided on the server settings, hit this button to upload the settings, and the server will automatically re-install itself with the new settings.
Close Server: Closes the server (You cannot connect to it), but this does not uninstall it. It will be active at next restart
Kill Server: Uninstalls the server from the remote computer. Read here for more information on injection
Info: Gives info about the remote computer, such as Windows username, processor, current resolution, etc. and also about the server installed. You may Refresh the info, or Save it to a .txt file
Scanner: Opens the Port Scanner, which can scan for inbound/outbound activity on any port. The options are:
· From/To IP: Enter the range of IP addresses you want to scan here.
Note: The IP's must be identical, except for the last (Fourth) section, these may differ from each other
· From/To Port: Enter the range of Ports you want to scan here.
· TimeOut (Milliseconds): Type here the timeout of the scan (How long you want to scan each port for)
· Beast/All Ports: Choose whether to scan for opened Beast ports only, or any opened port
· IP Addresses/Port List: Once you start scanning, this lists the IP Addresses and the Ports that are opened
· Start Scan: Starts the scan
· Stop Scan: Stops the scan
· Clear List: Clears the list on the right
e.g. If your From IP was 127.0.0.1, your To IP was 127.0.0.2, your From Port 6666, and your To Port was 6667, your TimeOut was 1000, the scanner would scan 127.0.0.1:6666, 127.0.0.1:6667, 127.0.0.2:6666, and 127.0.0.2:6667, each for 1000 milliseconds
Note: If you port scan active Beast ports, you may have problems with using some of Beast's functions. The server may need to be restarted before they work again.
Messages: Opens the Message Manager, so you can send messages to the remote user. You will get these options:
· Messages Box Icon: Set an icon for the message, which will appear next to the Message Box Text
· Message Box Buttons: Set the button combinations you can have. e.g. if you selected "Yes, No", the message will pop up with 2 buttons, one saying "Yes", the other "No"
· Message Box Title: Type the title of the message that you want here. It will appear as the window's caption
· Message Box Text: Type the text of the message that you want here
· Test: With this, you will get a preview of the message that will be sent to the remote computer with the current settings.
· Send: Sends the message to the remote computer with the current settings
Run Appz: Opens the Run Appz window. This is for sending commands to the DOS Shell on the remote computer, and receiving the output. From this window, you get:
· Output: This is where you will receive the output of the command you have entered
· Run: First, type a message into the edit box next to this button, then hit the button. The output will appear in the Output box
· Run Hidden: If this is checked, the DOS window will not appear on the user's computer. If it is not checked, the user will be able to see it
· Save: Saves the output of the command into a .txt file on your computer
KeyLogger: This will open the keylogger window. You will get these options:
· Logfile size: Displays the current size of the log file. If you did not enable the keylogger when building the server, this will always appear as 0 Bytes.
· Logfile size limit: This was set when you built the server, in the configuration of the keylogger. The default is 5120 KB (5 MB)
· Get Log: Downloads the logfile, and saves it as log.txt in the Beast directory. After it is downloaded, you will be given the option to decrypt it automatically.
· Delete Log: Deletes the log from the remote computer, and restarts the log from 0 bytes
· Decrypt Log: Choose a log file from your computer to decrypt. Decrypting is necessary to read the log. You should only do this if you didn't do it when prompted after downloading the log.
Live Keys: This opens the Live Keylogger window. When you open it, you will receive the user's keystrokes in real time. You have the opportunity to Save the log to a txt file on your computer.
Note: The Live Keys feature is also affected by the Smart Keylogger
System Time: Displays the Time dialog box. You will get:
· Remote date: Displays the date on the remote computer.
· Remote time: Displays the time on the remote computer.
· Refresh: Refreshes the Remote date and Remote time
· Set: Before doing this, change the Remote date and/or the Remote time, then hit this to upload the new date and/or time.
About: Displays the About box. This will tell you a little about the version of Beast you are using, a Bible quote relating to the Beast, tataye's personal website, and tataye's E-Mail.
Credits:
Displays the Credits
Help: Displays the help file. You can choose from 3 languages: English,
French, and Spanish. I suggest reading this, it contains some important
things that this tutorial doesn't
Options: Opens the Options menu. From here, you can configure a few
things like:
· Enable SIN PopUp: If checked, a little box like the MSN one will pop up in the bottom right hand corner of the screen when you receive a SIN notification
· Enable SIN Sound: If checked, a short sound will play when you receive a SIN notification
· Statistics (on Start): If checked, the Statistics will automatically be open when you open Beast
· Default Host/Password/Port/SIN Port: With these 4 options, you can set the default Direct Connection IP/Port/Password, and the Reverse Connection SIN Port when Beast opens
· Download Directory: Here, you can enter a local directory for all File Manager downloads to go to. Alternatively, click the icon next to this to open a "Browse For Folder" dialog box to select a folder.
· Cancel: Closes the window without saving the settings
· Save: Closes the window and saves the current settings
·
Defaults:
Automatically loads the default settings without closing the window
Well, that's it for the client
The server builder should look like this when you first open it:
Title Bar: If you right-click on the title bar, you will get:
· Rollup/Restore: "Rolls up" the window, you are left with only the title bar. Restore restores the window
· Close: Closes the Server Builder
Note: You can do these two things by simply clicking the appropriate button in the top right hand corner of the title bar, or by clicking the Beast icon in the top left hand corner of the title bar.
Basic:
Direct Connection: This is a typical trojan
connection. With this, a port is opened on the remote computer, and you enter
the port into the Beast client with the IP address, and connect to the remote
computer. If the remote computer is behind a router, you cannot use direct
connection.
Listen Port: This is for Direct Connection. This is the port that the server will open on the remote computer once installed. You enter this in the "Port" box in the Direct Connection section in the client once you have received the ICQ, CGI, or E-Mail notification. Default is 6666.
Pass [Optional]: You may set a password for Direct Connection to the remote server, so only people with the password will be able to connect. "Show" will show the characters that you enter in the box.
Reverse Connection: Reverse connection is the opposite of direct connection. With this, SIN notification must be used. The server on the remote computer connects to you, using the SIN port, and you must "Listen" for connections, so that you can connect to the remote server. You should use reverse connection for remote computers that are behind routers.
SIN Port: This is for Reverse Connection. This is the port that
the client will open on your computer when you "Listen"
for connections from remote servers. Enter this into the
"Port" box in the Reverse Connection section of the Client when the
server has installed on the remote computer. Default is 9999.
Note: If you select "Reverse Connection", SIN Notification will automatically
enable itself
Injection: Injection is a very good way for bypassing firewalls. You can
choose to use, or not use, injection. If you decide to inject, the server will
become a .dll instead of a .exe when installed. However, selecting No Injection
may give a more stable connection than a server using injection. Also included is an option to inject into a
process of your choice. Default is "notepad.exe", but some other suggestions
are:
Ad-Aware 6: "Ad-aware.exe"
GetRight Download Manager: "getright.exe"
Kaspersky Anti-Virus v4.5: "avpcc.exe" or "avp32.exe"
Kaspersky Anti-Virus v5: "kav.exe" or "kavsvc.exe"
KaZaA Lite K++: "kpp.exe"
Microsoft Outlook: "Outlook.exe"
mIRC: "mirc.exe"
MSN Explorer v6: "msn6.exe"
MSN Messenger v6-: "msmsgs.exe"
MSN Messenger v6+: "msnmsgr.exe"
Outlook Express: "msimn.exe"
Trillian: "trillian.exe"
Windows Media Player: "wmplayer.exe"
Windows Messenger:
"msmsgs.exe"
Yahoo! Messenger: "ypager.exe"
ZoneAlarm: "zlclient.exe"
Note that the above processes haven't been tested, I don't know if they will actually work. They should, however...
A note on injection: In the previous versions when using
injection, Beast injected into winlogon.exe automatically, so when the server
was killed, the computer had to be restarted for the server to uninstall
completely. However, with Beast 2.07, it doesn't inject into winlogon.exe, it
instead injects into explorer.exe. This is very different, as explorer.exe is
simply restarted, and the server uninstalls completely instantly, and doesn't
need a restart to uninstall. On 9x/Me systems, the server globally injects to
systray.exe, instead of explorer.exe.
Also, you should note that you can use injection with both direct and reverse connection.
Server Name: The name that the server will take once it is installed (In either the <Windows> or <System> directory). If you are using No Injection, it will be a .exe, if you are using injection, it will be a .dll
Reside in: Rather simple, this is where the server (svchost.exe or dxdgns.dll, or however you renamed it) will reside once installed. You have a choice of the <System> or <Windows> directories. If you are using a no injection server, and you select <System>, the Name of the server will automatically change from "svchost.exe" to "mshost.exe". Selecting <Windows> again will change it back to "svchost.exe". The <System> and <Windows> directories are usually in one of these places:
<Windows>:
NT Systems: C:\Windows\ or C:\Winnt\
9x/Me Systems: C:\Windows\
<System>:
NT Systems: C:\Windows\System32\ or C:\Winnt\System32\
9x/Me Systems: C:\Windows\System\
Note: If the user is
running NT, and is not an administrator, the Beast will automatically install in
the
C:\Documents and Settings\<Username>\Local
Settings\Application Data\Microsoft\Credentials\
and the
C:\Documents and Settings\<Username>\Local
Settings\Application Data\Microsoft\Windows\
directories.
Notifications:
SIN: To learn how to setup and use SIN notification, read my tutorial
<here>
IP (DNS) Address: Here you enter your IP address (Or DNS Address if you
have a dynamic IP, and are using the No-IP
DNS redirect service or similar)
Connection Time-out (seconds): Set the speed that you wish the
Beast server to send the notifications. The longer the time-out, the slower you
will receive all of the packets of information, but this also uses lots of
bandwidth. If you know you will have lots of servers running, set this to a
higher number, so as to not overload your bandwidth.
Get IP: Automatically enters your current IP in the "IP (DNS) Address"
box
Enable SIN: Enables SIN notification for the current server.
Note: If
you check this, Reverse connection in the Basic settings will automatically
enable itself.
E-Mail:
E-Mail Address: Enter your email address here (Note – does not work for
Hotmail addresses)
Edit Message: Edits the text in the email you will be sent
SMTP Addresses: Here, you enter the SMTP addresses you want Beast to use to email you the notifications
Get SMTP: Enter your
email address, and click this to automatically find an SMTP address that is
compatible with your email address
Test: Tests the email notification with the email currently in the
"E-Mail Address" box
Enable E-Mail: Enables E-Mail notification for the current server.
ICQ:
ICQ UIN: Enter your ICQ number here
Get/Clear UIN: Automatically enters a UIN in the
"ICQ UIN" box that has been
used on your computer. Clear removes the UIN that was automatically
entered.
ICQ string: Changes the ICQ message that will be sent to you.
Change it only if you know how.
Test: Tests the Notification with the UIN currently in the "ICQ UIN" box
Enable ICQ: Enables ICQ notify blah blah blah.
CGI:
To learn how to setup and use CGI notification, read my
tutorial
<here>
CGI URL: Enter the URL of the location of "log.cgi" on your site.
e.g.
http://mysite.netfirms.com/cgi-bin/log.cgi
CGI Script Data: Edit the CGI notification you will be sent.
Again, change only
if you know how.
CGI Password: This is a password for accessing the list.cgi on your
website. Show Chars
will show the characters that you type in the box.
Create CGI files: This will create the CGI files needed for CGI
notification (log.cgi, list.cgi, and log.txt), in "<Beast directory>\CGI
Files"
with the password you specified
Test: Tests the CGI notification with
the data entered in CGI URL and Script Data
Enable CGI: *yawn*
StartUp:
Suggested to select all, to make sure that the server runs at
boot.
With each of these, you are able to edit the name of the subkey
ActiveX: Adds a registry entry under the key:
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active
Setup\Installed Components"
HKey Local Machine: Adds
a registry entry under the key:
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run"
HKey Current User: Adds registry entries under these keys:
"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run"
"HKEY_USERS\S-1-5-21-1606980848-602609370-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run"
AV-FW Kill:
Closes Anti-Virus Programs and Firewalls at selected periods
of time
Kill AV – FW On Start: Closes AV and FW at boot.
"Configure" button will
give you a list of all the current processes set to be closed. You may add or
delete processes within this list.
Kill AV – FW On Every … Seconds: The number in this box indicates the
number of seconds between the closing of the selected processes.
e.g. if this
was set to 25 seconds, and the server was run at 12:00:00, it would kill AV-FW
at 12:00:00, 12:00:25, 12:00:50, 12:01:15, etc.
Disable XP FireWall: Disables the Firewall included in Windows XP
Note: AV-FW Kill does not
work with many Anti-Virus Scanners and Firewalls, they usually have preventative
measures installed so that the server cannot kill the process.
Misc:
The Miscellaneous server settings
Melt server on install: Selected by default, this means that when
server.exe is run, it will install the needed server files, and then server.exe
will automatically delete itself
Clear Restore Points (XP): This will clear the restore points on XP when
it is run. This means that the user can't delete Beast by returning XP to a
previous, clean state
Open Port On-Line Only: This is for direct connection, and it means that
it will only open the Listen Port when the remote computer is online. This is
good, as it looks suspicious when a port is opened mysteriously when the
computer isn't even online.
No LAN Notifications: This is also for direct connection only. With
Beast, you may infect and successfully connect to remote computers on LANs, but only with
reverse connection. If you use direct connection and infect a person on a LAN,
you will get no notifications from these computers if this option is checked.
Enable Keylogger: Enables the online/offline keylogger.
Hit the "Configure" button, and you can change the logfile size limit, aswell
as the name. The Keylogger function has also changed since version 2.06. The
server's keylogger is now able to email the logfile to you once it reaches a
certain size.
You can also enable "Smart Keylogging", which means, you enter strings from the window caption that you want, and the keylogger will only log the keystrokes that are typed into an active window with those particular strings in the caption, and not anything else. You don't need the entire window caption, just a portion of it. e.g. using "ess" will capture keystrokes in windows with the captions "ess", "Messenger" and "MSN Messenger Service", and all windows with the caption containing the string "ess".
Note: These advanced keylogger features were available in the private versions of Beast 2.06
Here is the new keylogger window:
Fake Error Message: With this, you can set a fake error message when the
server is first run. With the "Configure" button, you can edit the message and
the message box itself, or you may leave it at default.
This function works exactly like the Message Manager function in the main
client section.
Delay Execution: This is a great feature.
Instead of the server installing and opening ports, sending notifications, etc.
immediately, you can set it to activate after either a number of restarts, or
after a certain date on the computer has come. e.g. if you set "Active after 2
restarts", the server would copy the needed files (exe/dll + 2 x ms****.com
files + reg. entries) and wait silently. After the computer has been restarted twice after the server was run, it will become active and you will be
able to connect to it. If you set it to "Active on 25/12/2004 date", it will sit
silently until Christmas Day, 2004 before you can connect to it.
Exe Icon:
Here you can select what icon you want server.exe, and the
installed exe/dll to have. There are a few
pre-saved ones, but you can extract an icon from any .exe, .dll, or .ico file on
your computer.
Other:
Help: Opens the help file.
You can choose from 3 languages: English,
French, and Spanish
Settings (Save/Load): Saves the current settings to load at a later date,
or load configurations already saved.
Save Server: Builds the server with the current settings,
compresses it with a built-in UPX (1.20) packer and saves it as
"server.exe" in the Beast directory.
And that's the server builder
· SIN
· CGI
Notification/Connection Problems:
· I'm using SIN and ICQ/CGI/E-Mail notifications, but why can't I connect using the data from the ICQ/CGI/E-Mail notifications?
· Okay, but how do I forward the ports?
· I don't get any notifications.
· I'm having problems with transfers, the file transfer freezes and won't upload/download anymore.
· Uh-Oh. My Anti-Virus scanner detects the Beast server/client/binder stub as a virus. What do I do?
· I connected to a Beast 2.06 server with the Beast 2.07 client, but I can't use any of the functions.
· I have discovered the remote user is a paedophile, what do I do?
· I have discovered pr0n on the remote computer, but all of the people in it are at/above the legal age.
· I think the user knows that he/she has been backdoored. What should I do?
How do I setup SIN (Static IP Notification)?
First off, you need to know the difference between static and dynamic IP addresses. If your IP changes every time you reconnect, you have a dynamic IP
If your IP stays the same every time you reconnect, you have a static IP
If you have a static IP, simply enter your IP address into the IP (DNS) Address box in the Server Builder. If it's dynamic, then you need to follow the below tutorial.
To configure SIN notification with a dynamic IP:
Go to http://www.no-ip.com, and create an account.
After creating an account, download the DUC client (ducsetup.exe), and run the setup.
Run DUC20.exe (The client that you just installed). Enter your username and password and hit "Ok"
Down the bottom, you should see a message saying, "No hosts found on server, change to a different account, or click here to sign in to No-IP and create hosts". Click the "here" link, it will open a new browser window. Click the "Add" button on the menu on the left.
This is the host creation screen. Type a hostname (e.g. "itchy"). The IP box should have your current IP. If not, enter it. Just leave everything else at default. You may change "no-ip.info" (In the drop-down box) if you want to, though, but there's no need.
After you've created your host, go back to the DUC client, and a new message should have appeared, "Once you have finished editing your hosts, click here to refresh the above list". Click on the "here" link. Your host should appear up the top as a smiley emoticon. (Continuing with the previous above example, it would be "itchy.no-ip.info") Make sure that the checkbox next to it is always checked.
Keep the client running and go back to Beast. Click the "Build Server" button on the main window.
Make sure you select "Reverse connection" on the "Basic" window. Go to Notifications > SIN. The "Enable SIN" checkbox should already be checked, but just make sure.
Type your No-IP hostname, not your No-IP User Account Name in the "IP (DNS) Address" box (Continuing with the previous above example, you would type "itchy.no-ip.info")
Use whatever other options you want when creating a server. I suggest testing it on yourself first, so run server.exe when you've created the server.
Type the SIN port you used when creating your server (Default 9999), and hit "Start Listening [SIN]"
If you've done everything right, a little box pops up in the bottom right hand corner of the screen, and a Beast alien icon should appear in the window below the "Start Listening [SIN]" box
Double click on the Beast icon, and you're connected!
How do I setup CGI (Common Gateway Interface) Notification?
Firstly, you need some webspace. If you host a website, or own some webspace, that's good. If you don't, follow the instructions below to get some free space with Netfirms:
Head over to Netfirms. Type the domain name you want, and hit "Search". Hopefully, the domain you typed doesn't already exist. If it does, keep trying until you have one.
You should now be on a page that is displaying the cost of your domain. It should be $0. Click the "Continue" button
Enter your details (They don't have to be real, except your email address), click the I Agree to the Terms and Conditions box, and click "Continue". Another price review page should appear. Hit "Continue" again.
Okay, so now you have your free web space. Now, you need to get the CGI files onto the server. So open Beast, head to the Notifications -> CGI section
You should see a box called "CGI Password", which is empty. Type a password in here (Preferably not one you usually use), and hit "Create CGI Files". You should receive a message telling you that the files were successfully created.
Open up the folder where you store the Beast client, and you should see a new folder called "CGI files". Open it, and it should contain 3 files:
1. log.cgi
2. list.cgi
3. log.txt
Now that you have your CGI files, you need to upload them. Open up your web browser or FTP client, and go to ftp://yoursite.netfirms.com. You'll need to login. This should be in the File menu, or it will automatically prompt you.
Open a new window or frame, and head over to your email account which you supplied to Netfirms. You should have received an email from them, with your account information. You will only need your membername, and your password. Enter these into the login box, and it should log you in fine.
You should see two folders at your domain: www and cgi-bin. Open up cgi-bin. Go to the CGI files folder on your hard drive, copy all of the three files, and paste them into the cgi-bin folder.
Go back to the Beast server editor, and type http://yoursite.netfirms.com/cgi-bin/log.cgi. This is the file that logs all of the CGI notifications. Click the "Test" button. With any luck, you should receive a message telling you that the notification was sent successfully.
Now go to http://yoursite.netfirms.com/cgi-bin/list.cgi. This is the file you need to view all the notifications you have received. Type the password you supplied to Beast, and you should arrive at a page with a table on it, which should contain the notification you sent from Beast.
Congratulations, you just
set up CGI notification! From now on, all you need to do to receive a CGI
notification is type http://yoursite.netfirms.com/cgi-bin/log.cgi into
the Beast server editor when you create a server, and type
http://yoursite.netfirms.com/cgi-bin/list.cgi
into your web browser to view your notifications. You will also need to type
your password into list.cgi.
Notification/Connection Problems
I'm using SIN and ICQ/CGI/E-Mail notifications, but why can't I connect using the data from the ICQ/CGI/E-Mail notifications?
This is because when you enable SIN notification when building the server, reverse connection automatically enables itself (And vice versa). ICQ/CGI/E-Mail notifications are for direct connection only, to connect with reverse connection, you must use SIN. The point of using ICQ/CGI/E-Mail notifications with reverse connection is a way of letting you know that the server is installed (Just in case you're having problems with SIN, and you're not sure that the server has installed). There is no way of connecting to a reverse connection server with the data from the ICQ/CGI/E-Mail notifications, you must use SIN.
I can't connect using the data from the ICQ/CGI/E-Mail notifications, but I'm not using SIN and reverse connection.
There could be many reasons for this:
· The remote computer has gone offline since you received the notification
· The user's firewall is not letting you connect to the computer. The firewall may be giving the server access to the internet to send notifications, but is not giving it access to "act as a server", i.e. the firewall is not letting a remote computer connect to the server. The best way to prevent this from happening is to use the Beast's injection technology
· The user's AV (Anti-Virus Scanner/Monitor) has picked up the server and disinfected/deleted it since sending you the notification, or the user has deleted it him/herself
· You did not enter the correct information (It does happen)
· The Beast client does not have internet access in your firewall settings. If you have a decent firewall, when you attempt to connect to someone with the client, you will be prompted, asking you if you wish to give the Beast client internet access
·
The remote computer is behind a router (On a LAN, and
not using the proxy server). In this case, direct connection does not work,
you need to use reverse connection for these computers. To prevent getting
notifications from people who are behind routers when using direct connection,
select "No LAN Notifications" when building the server
It seems that you have forwarded the SIN Port, but Beast uses 10 ports, and all are needed to use all the functions. You need to forward the SIN Port, and the 9 ports after it. e.g. if you're using port 9999, you need to forward ports 9999-10008. If you're using port 8581, you'll need to forward ports 8581-8590, etc.
Okay, but how do I forward the ports?
If you know your router's brand and model you might try looking on the website of the company that made it, they usually have tutorials on how to do it. If you don't know the website of your router's manufacturer, check out this thread started by Digerati on the Evil Eye Software Forums. Alternatively, ask on the BeastDoor Forums, chances are, somebody might have the same router you do.
Again, there could be many reasons for this, make sure you read my SIN tutorial thoroughly. But, if you're sure you've done everything right:
· Remote computer is offline
· The user's firewall is not giving it internet access. This is different from the case when using direct connection, as with direct connection, the server needs to be able to "act as a server" in the firewall settings, whereas when using reverse connection, all it needs is simple internet access. This is because when using direct connection, the server acts as a server, and the client (You) connects to it. But when using reverse connection, the server becomes the client, and it connects to the server (You). In other words, it needs different internet access rights.
· The Beast client does not have the right to "act as a server" in your firewall settings. See above for more information on this.
· The user's AV has picked it up and disinfected/deleted it, or the user has uninstalled the server him/herself
· You did not use the right SIN port
· The user has a hardware firewall, sometimes the Beast has trouble getting past these
I don't get any notifications.
In this case, the server has not installed, or has been deleted, or the user's firewall will not give it internet access
What you have done is enabled SIN notification, or set the server to reverse connection. You can't connect using the direct connection method when the server is set to reverse connection, you must use SIN.
I'm having problems with transfers, the file transfer freezes and won't upload/download anymore.
Although this does not happen often, Beast is fairly stable, it does happen sometimes. Some possible reasons are:
· Different internet connection speeds – there are a few connection issues when you and the remote user have different connection speeds. e.g. if you were on 56k dial-up, and the remote user on T1, there would be connection problems because of the difference in bandwidths of your connections
· File already exists – e.g. if a file "<drive>\Documents and Settings\UserName\My Documents\me.jpg" exists, and you try to upload/download another "me.jpg" to "<drive>\Documents and Settings\UserName\My Documents\", it will probably freeze and the connection may hang. To fix this, delete or move the already existing file before uploading/downloading the second file
· The remote user is using lots of bandwidth – if the user is using a program/programs that use lots of bandwidth (e.g. online games), you may have trouble uploading/downloading. To fix this, close their programs, they don't need 'em!
Uh-Oh. My Anti-Virus scanner detects
the Beast server/client/binder stub as a virus. What do I do?
The only thing to do is to try to make it undetectable, and the best way to do this is to edit the hex coding of the file. Download
Hex Workshop (A good hex editor) from here. Search the forums,
there have been a few threads on undetectable servers.
Or, contact tataye to buy a private Beast. These are undetected by all AV software and also from some memory scanners.
No more than one Beast server can be on a computer at a time. Running a second server will not delete the first. One way to uninstall the first Beast server is to have physical access to the computer and delete it yourself (You'll have to boot in safe mode). Another is to run a server from a different RAT (e.g. Optix Pro, CIA, Assasin, Lithium, ProRAT, Theef, Institution, MoSucker, Bifrost, etc.) and delete the Beast server remotely (You'll have to end the process first, or unload the dll and end the explorer.exe task if you're using injection)
I connected to a Beast 2.06 server with the Beast 2.07 client, but I can't use any of the functions.
No, most of them do not work. You can update a Beast 2.06 server with the Beast 2.07 client, however.
I have discovered the remote user is a paedophile, what do I do?
Whatever you do, do not fuck around with them (i.e. delete the underage porn, give them weird messages, etc. that would make them suspicious), they may delete the underage porn themselves. If the user is a paedo, contact the proper authorities, and let them handle it.
I have discovered pr0n on the remote computer, but all of the people in it are at/above the legal age.
So? They can have it if they want it...
I think the user knows that he/she has been backdoored. What should I do?
Uninstall the server immediately. Note that nobody but you is responsible for your actions.
Final Note:
If you discover a problem/mistake, etc. with this tutorial please tell me about it! The best way to do this is to notify me through PM on the BeastDoor Forums. My profile can be found here.
I hope by reading this tutorial you've solved any problems you might have had, but if you've read it fully and still don't understand something, post on the BeastDoor Forums, everyone there is happy to help you in any way they can!
Tutorial last updated on August 10, 2004, 9:56:10 PM AEST (Australian Eastern Standard Time)
Itchy.