CloudflaredRAT is a simple combination of popular open-source tools, wrapping a local-facing shell with Cloudflares Argo Tunnel in an executable, to create a persistent internet-facing encrypted web shell for remote access. It is designed and created for red teams, as it does not scale well. Make sure you have permission of the target (company) before using it.
| Advantages | Disadvantages |
|---|---|
| Gets around the firewall | Can easily be analyzed and removed, once found |
| Combination of standard resources evade AntiVirus and EDR systems | Not anonymous to Cloudflare |
| No server required = no OPSEC risk | Attack does not scale for many targets, as each target needs their own tunnel |
| Web shell accessible via protected domain |
- shell2http run as local-facing web shell
- Allows file upload, file execution and full terminal access
- Mandates authentication
- Argo tunnels allow a device to be accessible from the internet using Cloudflare services
- Cloudflare offers services such as whois-protected domains, protecting origin servers and custom access rules. Its is a great tool for red teams.
- Tunnels use an encrypted HTTPS tunnel to the Cloudflare network, which makes traffic almost invisible
- Cloudflare recently introduced Argo tunnels which have limited access permission and restore themselves on a restart. This allows to use tunnels to make target computers visible on the internet consistently.
- Uses WinRAR to create a self-extracting archive executable with custom icon
- Helper powershell scripts (1_configure.ps1 & 2_build.ps1) to configure and build the RAT
- Scheduled Tasks used for persistence
- Runs shell as SYSTEM user by default
- Download and extract the repository
- Make sure you have WinRAR installed and the WinRAR.exe configured in your PATH
- File
bridge.execontains the cloudflared CLI. Use it to create a JSON file for the target tunnel. - Map the argo tunnel hostname to a public facing domain on Cloudflare
- Run
1_configure.ps1and fill in the variables when prompted - (Optional) Replace the icon.ico with the icon you want to use instead for your executable
- Run
2_build.ps1to create the executable - Execute on the target machine and wait for the website to be available