I was faced with a question a few days ago, regarding how a RAT server can reach out through the firewall and connect to the client. This was something that I've never given any thought to before, so I was a bit perplexed by the question.
So, the question is, as previously stated, how the RAT server can connect to the RAT client through a firewall. The client is often set to listen to a port, pretty high up in the range, and for the client to work properly port forwarding is often needed. This makes sense; the high port number won't interfere with other applications, so using it should be safe and they're not open by default in most firewalls. No issues here.
Now, for the server. We know that it only infects the victim's computer, and thus it can't perform port forwarding itself. I guess having the server polling for a connection could be one solution, but it would be ugly, inefficient and noticeable (at least if you're monitoring your traffic). Having the client send a connection request to the server though another port, which is open per default, could be another solution, but that could potentially mess with other applications, which would be very bad from the attackers point of view.
So how is it done? How does the RAT server reach out through the firewall to connect to the client, and how does the server receive the connection request form the client without the ability to forward the ports used?