🚀 SheetRat Exploit POC

---

🐀 SheetRat RCE Proof o concept ExploiT

Remote Code Execution via Path Traversal + DLL Hijacking in SheetRat RAT Panel

---

📌 Overview

This exploit targets the SheetRat ( Remote Administration Tool panel. It leverages a combination of Path Traversal and DLL Hijacking to achieve Remote Code Execution (RCE) on the server hosting the panel.

By exploiting insecure file-handling logic in the panel, an attacker can upload a malicious Ionic.Zip.dll file to the application's directory. When the panel later loads this DLL (which it does during normal ZIP operations), the malicious code executes with the privileges of the panel process — typically SYSTEM or Administrator.

No user interaction is required.

---

⚙️ How It Works

1. The exploit connects to the target SheetRat panel via TCP
2. Sends a DownloadInfo packet with a path traversal payload:

   ..\..\..\Ionic.Zip.dll
   

3. Sends a DownloadGet packet containing the malicious DLL (Base64-encoded).
4. The panel writes the file to its application directory (3 levels up from its working directory).
5. The panel, upon its next ZIP operation (e.g., extracting a file), loads Ionic.Zip.dll.
6. The malicious DLL executes its payload — reverse shell, file download, or arbitrary command.

---

🧠 Why It Works

• No Input Validation: The panel does not sanitize or normalize the file path.
• DLL Hijacking: Ionic.Zip.dll is not part of the .NET Framework and is loaded from the application folder.

🛠️ Features

• ✅ Fully automated — one command execution
• ✅ Path Traversal (3 levels up)
• ✅ Pre-compiled malicious Ionic.Zip.dll (reverse shell / cmd execution)
• ✅ Multi-threaded scanning for multiple panels
• ✅ Logging and retry logic

---

📦 Requirements

• Windows 7/10/11 (target panel)
• .NET Framework 4.8 (target panel)
• PowerShell 5.1+ (optional, for custom payloads)

---

⚠️ Legal Disclaimer

This project is for educational and security research purposes only. The authors are not responsible for any misuse of this tool. Use it only on systems you own or have explicit written permission to test.

By downloading or using this software, you agree to comply with all applicable laws and regulations. The creator assumes no liability for any illegal or unethical use.

---

📜 License

MIT License - Feel free to use, modify, and distribute, but give credit where due and please mention the author

---

🌟 Credits

• Inspired by: Sheet Rat architecture
• Special thanks to: The open-source security community

---

⭐ Star this repo if you found it useful!

---