RDP as a Console
Although RDP is most often associated with the mstsc GUI client,
it can also be used as a command-line tool.
This technique reduces our overhead while still relying on the RDP protocol
which will often blend in well with typical network traffic.
The RDP application, mstsc.exe,
builds upon the terminal services library
mstscax.dll.
This library exposes interfaces to both scripts and compiled code
through COM objects.
SharpRDP is a C# application
that uses uses the non-scriptable interfaces exposed
by mstscax.dll to perform authentication in the same way as mstsc.exe.
Once authentication is performed,
SharpRDP allows us to execute code through SendKeys.
In this manner no GUI access is required
and setting up a reverse tunnel is unnecessary.
To demonstrate this, we’ll use the pre-compiled version of SharpRDP.
We’ll specify the computername,
username, and password along with the command to be executed.
Since this is not terribly useful,
we’ll extend this example to obtain a reverse Meterpreter shell.
First, we’ll ensure a Meterpreter executable
is placed in our Apache server web root,
and msfconsole is set up to catch the shell.
Finally, we’ll use SharpRDP to execute a PowerShell download cradle on appsrv01
that pulls the Meterpreter executable and subsequently executes it
with stacked commands:
This results in a Meterpreter shell on our Kali machine.
Very nice.
We can use this technique to perform command-line lateral movement through RDP
with SharpRDP without the need for GUI access.