Lateral Movement with RDP
Although RDP was designed for system administrators,
it can also be abused by attackers.
For example, if we have gained access to clear text credentials for a domain user
and that user is a local administrator of the target machine,
we can simply use mstsc.exe,
the native RDP application, to gain access to that machine.
Let’s take a moment to demonstrate this.
We’ll connect to the Windows 10 client as the user dave
from our Kali machine with rdesktop.
From there, we’ll run mstsc.exe,
and connect to appsrv01.
Once connected, we are given control of the appsrv01 desktop.
Obviously, this is an excellent tool for lateral movement,
even though in this case we relied on clear text credentials
since the tool does not accept password hashes.
However, this technique blends in with normal network traffic patterns
which could help evade detection.
When an RDP connection is created the NTLM hashes will reside in memory
for the duration of the session.
The session does not terminate without a proper logout,
which means simply disconnecting from the session will leave the hashes
in memory.
This creates an attack surface
in which we can harvest the credentials if we compromise the machine.
Let’s examine how dave user’s credentials
are handled on the appsrv01 target machine.
If we run mimikatz.exe from an administrative console,
disable the LSA protection
and dump credentials,
we’ll find the NTLM hash of the dave user.
In this case, we expected these cached credentials.
This means that if we happen to compromise a well-used server,
like a jump server,
we could dump any of those cached credentials as well.
This example highlights an interactive login scenario.
Since we ran it over RDP from a different machine,
it’s also considered a remote login.
As previously mentioned,
clear text credentials are required for all interactive logins.
In an attempt to prevent attackers
from stealing credentials on a compromised server,
Microsoft introduced RDP with restricted admin mode,
which allows system administrators to perform a network login with RDP.
A network login does not require clear text credentials
and will not store them in memory,
essentially disabling single sign on.
This type of login is commonly used by service accounts.
We can use restricted admin mode
by supplying the restrictedadmin argument to mstsc.exe.
When we supply this argument,
the current login session is used to authenticate the session.
Note that we do not enter a password for this transaction.
Since we are logged in as the “dave” domain user,
the network login is executed as that user.
This gives us an RDP session as dave on appsrv01.
If we open an administrative prompt,
and once again launch Mimikatz,
we can attempt to dump the NTLM hash.
Since we used restricted admin mode, \no credentials have been cached,
which helps mitigate credential theft.
Restricted admin mode is disabled by default
but the setting can be controlled through the
Disable Restricted Admin registry entry
at the following path:
While restricted admin mode protects against credential theft on the target,
it is now possible to pass the hash when doing lateral movement with mstsc.
To demonstrate this,
let’s perform lateral movement from the Windows 10 client to appsrv01
as the admin domain user by abusing the NTLM hash.
We will assume that we are already in the possession of the admin user NTLM hash
and are logged in to the Windows 10 client as the dave user.
We can then run mimikatz from an administrative console,
and use the pth command to launch an ms tsc.exe process
in the context of the admin user.
Once the command finishes, an instance of mstsc opens.
Clicking Connect
opens an RDP session on appsrv01 as admin,
achieving lateral movement with the native RDP client in Windows
with only the NTLM hash.
As mentioned previously, restricted admin mode is not enabled by default.
However, if we are in possession of a
password hash for a local account on the target machine,
we can enable it in order to be able to use RDP to connect to that target.
To demonstrate this,
we will first disable the restricted admin mode on our appsrv01 target.
We’ll do this from the RDP session as the admin user we just created
by using Remove-ItemProperty.
With restricted admin mode disabled, we’ll verify that we can no longer log in
by first logging out of the RDP session on appsrv01,
and immediately relaunching it from Mimikatz.
When we click Connect,
we are presented with the error message,
which indicates that restricted admin mode is disabled.
At this point we are able to fully demonstrate our lateral movement.
To re-enable restricted admin mode,
we are going to first launch a local instance
of PowerShell on the Windows 10 machine
in the context of the admin user with Mimikatz.
From this PowerShell prompt we’ll use the Enter PS Session cmdlet,
and supply the appsrv01 hostname as the -Computer argument.
This will provide us with shell access to our target machine.
With this access, we’ll create this registry entry
The restricted admin mode setting is updated instantly
and we can once again use it to gain access to the target.
It is worth noting that the xfreerdp RDP client,
which is installed on a Kali system by default,
supports restricted remote admin connections as well.
We can demonstrate the previous example with xfreerdp.
Keep in mind that the target RDP port must be reachable from our Kali attack machine.
This provides us with the same GUI access we had previously from Windows
but this time, we did it directly from Kali without the clear text password.
In this section, we discussed various ways of using
Remote Desktop to perform lateral movements,
using both the conventional method
and through restricted admin mode with the NTLM hash.
Next we’ll look at more advanced methods.