PoisonIvy Remote Administration Tool

In this article, I will talk about PoisonIvy and demo it's usage.

PoisonIvy is a remote administration tool, which is widely used by hackers as the backdoor.

There are some news about PoisonIvy：

• Trend Micro Uncovers Interesting Variant of PoisonIvy RAT
• Poison Ivy RAT served by compromised Israeli website

Usage Demostration

In PoisonIvy Server Profile, we can config the server.

In this tab, address and password can be set. Proxy attribute can also be set in this tab.
The next tab, install, is used to config how the backdoor startup. Such as autostart and executable name is included.

Some advantage attribute like process injection, persistent and key logger are contained.
After generation, a backdoor will be generated. Then we create correspond client and  execute the backdoor in another machine.

After a success infection, a message will showed. And we can get some basic information about victim.

 Then we can retrieve some system information about victim's machine.

Next step, we can create a remote shell to victim.

Moreover, we can also get the remote desktop of victim.