Poison Ivy Tutorial

[xDarryl]

This is a remote administration tool. You can control another PC using this utility. Also has many nifty features that will allow you to find out a lot of information about the affected PC.
More information inside.

Download Link is at very bottom of my post, below the tutorial, and above my signatures.
RAR Password: xchacks.net




====TUTORIAL====



----------PART 1-----------
====Introduction====
Poison Ivy is a powerful RAT.

RAT means remote administration tool. It is Not harmful at all. You use it to control another PC remotely.
You may explore files, view webcam, screenshots, keystrokes, passwords etc, almost anything remotely!



Now don't worry about the download or program setup until you have properly configured your IP and portforwarding!!

What is DNS and Portforwarding???


You need to understand how the server connects to the client.
When you run the server on a pc it will automatically try to connect to the Ip and port that you specified when you built it. (you will learn to build the server below - it is very easy)

Here is an illustration on the connection to help clarify what we're trying to achieve here:

victim pc----->dns host----->your IP----->your open port----->your RAT on your PC.



**Go to your Router/modem settings page to get your dns
** OR type "ipconfig /all" without the quotes in command prompt and press enter and look for Dns


-------------Part 2-------------
===Port Forwarding and DNS Configuration===
Since most of you are behind a router (modem), your Ip changes everyday.


If you configure the server to connect on YOUR IP directly , the next day you will not receive connections.
To permanantly receive connections you need to sign up for a free "no-IP" DNS service on either dyndns.com or no-ip.biz.

Register for a free account at dyndns.com or no-ip.biz .

Next, perform these changes on your pc :

Set a Static IP to receive direct connection*

A. Go to programs>accessories>communications>network connections

B. Rightclick on your connection and click properties

C. Go to tcp/ip setting's properties



This is what you might see after clicking TCP/IP properties
http://img268.imageshack.us/img268/5510/configuretcpip.jpg


To see your machines IP information;
* Start>Run...>"cmd" without quotes>"ipconfig /all" without quotes and press enter
or* Go to your Router/modem settings page to get your dns



In the TCP/IP properties, using your Ip information from the CMD "ipconfig /all" window;

enter your chosen ip (example:192.168.1.50)

enter your subnet mask (if not automatically stated)*

enter default gateway*

enter your dns

save changes

See caps below



Navigating to TCP/IP properties
http://img182.imageshack.us/img182/4176/networkconnecitonsprop.jpg

Using Router Setting to find DNS servers.
http://img182.imageshack.us/img182/886/dns.jpg

Using "ipconfig /all" in cmd to find DNS servers.
http://img268.imageshack.us/img268/9876/ipconfige.jpg






CONFIGURE YOUR ROUTER/MODEM SETTINGS TO FORWARD CONNECTION ON DESIRED INTERNAL IP (in this example i mentioned 192.168.1.50. .. don't forget to forward ports to this ip at the portforwarding stage.


Go to 192.168.1.1 or 192.168.1.2 or any address that opens your settings page

Go to applicaitons /gaming settings or any headings that looks like it contains settings for ports opening/forwarding

Edit any line for the remote ***** client.

Name it RAT

Enter port number to be forwarded to your internal IP

Do this for tcp and udp

Enable it

And save changes


For more info about portforwarding, go to portforward.com.

Now you are ready to open the Rat Client to listen for connection.


-------------PART 3------------
======THE CLIENT======

You now have the Poison Ivy client. Its icon looks like the leaf of IVY plant.

When you open it, the disclaimer will pop up. Choose not to show this again.

Now you are facing the GUI (graphical user interface of the RAT)
Go to file>new server
create new profile
and proceed as below.
http://img217.imageshack.us/img217/4681/connection1.jpg
http://img217.imageshack.us/img217/2521/connection2.jpg
http://img268.imageshack.us/img268/5466/installq.jpg
http://img217.imageshack.us/img217/7823/advanced.jpg
http://img217.imageshack.us/img217/6049/generate1.jpg


--------------Part4------------
===Using & Abusing!===
The moment of truth
Now you are ready to use the server.
First let's test to see if it works!
Best way to see if you did it right is email or use a flash drive to bring your created ".exe" to another PC with no anti virus
Once the file is in a folder on their PC somewhere, double click it and delete it if it doesn't disappear on it's own. [ deleting it will not make it so it doesn't work. ]
Now the target PC is infected.

Go back to your PC, open poison ivy, ( make sure you do not open the ".exe" you created on your own PC. )


click file>new client>
enter port that you want to listen connection (the one you put in your server, the same one you set in port forwarding)
click start...
The "connections tab shows current connections, and the statistics tab shows connection attempts/logs
wait for a connection. ( if you did it right, the target PC should connect within seconds.)
If it worked, you will see the target PC on your connections screen. HAZAH!

http://img88.imageshack.us/img88/8797/39376548.jpg

__________________________________________________ _________
The server (installed on victim's pc when he executes it) connects through dyndns.com or no-ip domains to port XXXX on your PC

[Worshipped]

thats fucking retarded...
is that even the unlimited connection version or the 200 connection limit?

why in a thousand years would you use a privately made RAT?... plus the probability of you actually infecting someone... rofl

[cptcookiemonster]

Thanks for the Tut, hopefully I can infect someone. Been trying and trying and all I can do is infect my own PC.. haha

[xDarryl]

thats fucking retarded...
is that even the unlimited connection version or the 200 connection limit?

why in a thousand years would you use a privately made RAT?... plus the probability of you actually infecting someone... rofl

It's not a privately made RAT. Its Poison Ivy.
Do I s***l noob?

[cptcookiemonster]

Hey Darryl, if Poison Ivy doesn't want to connect to the PC I infected.
What would the most common problem be?

Where you enter the DNS/Port, I clicked on Test Connection and I got a checkmark so i doubt it would be that. Also, the PC I wanted to connect to didn't have an Antivirus.

Thanks

[xDarryl]

pm'd.

10 limit.

[cptcookiemonster]

Can't Respond, need more posts. hah
I finally got to connect to someone.
I changed the Process Mutex for making a new server, does it maker what I call it? I called it )!Vov)!Vo like in the picture.

Thanks

[ohjs]

this might sound like a dumb question but will this work with a wireless connection or do I need my computer connected to my modem?