How does a RAT connects to the client?

Remote Access Trojans (RATs) typically connect back to the attacker using Dynamic DNS Update Clients (DUC). Since attackers' systems often have dynamic IP addresses, DUC services (like no-ip) maintain a consistent hostname that updates automatically when the IP changes. Port forwarding is required but doesn't actively maintain the connection; backtrack is a Linux distribution for testing; php scripts may be attack vectors but not the connection mechanism itself.