I was faced with a question a few days ago, regarding how a RAT server can reach out through the firewall and connect to the client. This was something that I've never given any thought to before, so I was a bit perplexed by the question.

So, the question is, as previously stated, how the RAT server can connect to the RAT client through a firewall. The client is often set to listen to a port, pretty high up in the range, and for the client to work properly port forwarding is often needed. This makes sense; the high port number won't interfere with other applications, so using it should be safe and they're not open by default in most firewalls. No issues here.

Now, for the server. We know that it only infects the victim's computer, and thus it can't perform port forwarding itself. I guess having the server polling for a connection could be one solution, but it would be ugly, inefficient and noticeable (at least if you're monitoring your traffic). Having the client send a connection request to the server though another port, which is open per default, could be another solution, but that could potentially mess with other applications, which would be very bad from the attackers point of view.

So how is it done? How does the RAT server reach out through the firewall to connect to the client, and how does the server receive the connection request form the client without the ability to forward the ports used?

  • Short answer: "shell shoveling" over reversed connections, as described in this old blog I found on Google: mcwresearch.com/archives/19
    – adric
    Commented Aug 1, 2013 at 16:55

1 Answer 1


There are two types of Remote Administration Toolkits: those that are used for legitimate purposes by the system administrators and those that are used by the malware for controlling the PC from a C&C server. You have used the malware tag in your question so I assume you want to know the working of the second type of RATs I mentioned.

When malware infects the machine, usually a small stager code contacts its parent server and download the rest of the code. Note that the connection is initiated from the victim's PC to the attacker's controlled PC. This is called reverse connection which most of the firewalls allow. The connection is initiated on those ports which have a very high chance to be allowed outbound such as port 80 (HTTP) and port 443 (HTTPS). Also, even an application layer proxy examining and blocking non standard traffic on standard ports cannot block these connections because nowadays the RATs uses standard SSL connection stream.

The only chance of detection these outbound reverse TCP/HTTP/HTTPS connections are through blocking the IP or DNS addresses of the C&C servers. This method has only a reasonable chance of blocking the connection and will work against only the most basic attacks since malware can use a variety of techniques to hide their C&C servers. Fast flux and TOR hidden services can be used to hide the C&C effectively and can't be blocked easily.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .