🔥 PyRAT Exploit by Bayazid (K4RL0S)

A custom-crafted exploit targeting a vulnerable Python Remote Access Trojan (RAT) found in the TryHackMe "pyrat" CTF challenge.
Instead of brute-forcing, this attack injects a crafted socket string to escalate privileges and achieve a reverse interactive root shell.

---

👨‍💻 Author Info

• 👤 Author: Bayazid (aka K4RL0S)
• 🧠 GitHub: bayazid-bit
• ✉️ Email: bayazid.mtu@gmail.com

---

⚙️ How It Works

Instead of using the usual brute-force password attack, this script:

1. Connects twice to the vulnerable PyRAT server.
2. Builds a fake socket string by reversing the attacker’s real socket metadata.
3. Injects fake admin socket strings using multiple guessed file descriptors.
4. Triggers a remote shell, then upgrades to a fully interactive shell using:

   python3 -c 'import pty; pty.spawn("/bin/bash")'

5. Root shell achieved if one of the FD guesses is correct!

---

🧪 Example Usage

python3 exploit.py <victim_ip> <victim_port>

Example:

python3 exploit.py 10.10.10.10 8888

---

🚀 Requirements

• ✅ Python 3.x
• ✅ Vulnerable pyrat.py server running (from the CTF)
• ✅ Open port accessible for socket connection

---

💡 Notes

• If the exploit doesn't seem to work, try manually adjusting the format string inside the reverse_sock() function:

  return text = f"<socket.socket fd=, family=2, type=0, proto=0, {localaddr}, {remoteaddr}>"

• FD brute-force range can be tuned via angel_hits() function parameters.

---

⚠️ Disclaimer

This exploit is for educational purposes only.
I am not responsible for any misuse or damage caused by this tool.
Use only in CTFs, penetration testing labs, or environments where you have legal permission.

---

✊ Final Thoughts

"AI can follow walkthroughs, but hackers create new paths."

AI couldn’t find this bug.
I could.
Because hacking needs creativity — and this exploit proves it.

Stay curious. Stay ethical.
— K4RL0S | বাংলার হ্যাকার