Stealing Clear Text Credentials from RDP
At this point, we have covered multiple techniques that leverage features of RDP
for lateral movement purposes.
In this section, we’ll demonstrate how to recover the clear text credentials
that are used when an RDP session is initiated.
When a user creates a remote desktop session with mstsc.exe,
they enter clear text credentials into the application.
In this section we are going to analyze an application that can detect
and dump these credentials from memory for us,
effectively working as a more targeted keylogger.
This technique relies on the concept of API hooking.
In a earlier module we used Frida to monitor API calls.
We can use similar techniques to modify APIs and redirect execution
to custom code.
As a basic theoretical example,
let’s imagine that we are able to hook the WinExec API
which can be used to start a new application.
The first argument, lpCmdLine, is an input buffer
that will contain the name of the application we want to launch.
If we are able to pause the execution flow of an application when the API is invoked,
we could redirect the execution flow to custom code
that writes a different application name into the input buffer.
Continuing execution would trick the API into starting a different application
than the one intended by the user.
Likewise, we could execute custom code
that copies the content of the input buffer,
return it to us and continue execution unaltered.
This effectively steals information from the application
and returns it to us.
One way to do this outside of a debugger is to perform API hooking.
Instead of pausing execution
we could overwrite the initial instructions of an API at the assembly level
with code that transfers execution to any custom code we want.
The Microsoft-provided unmanaged
Detours library makes this possible
and would allow an attacker to leak information from any API.
Our goal is to leverage API hooking to steal the clear text credentials
entered into mstsc when they are processed by relevant APIs.
MDSec discovered the APIs responsible for handling the usersname,
password,
and domain.
As a result of this research, they released RdpThief,
which uses Detours to hook these APIs.
The hooks in this tool will execute code
that copies the username, password, and domain to a file.
Finally RdpThief allows the original code execution to continue as intended.
RdpThief is written as an unmanged DLL
and must be injected into an mstsc.exe process
before the user enters the credentials.
Let’s demonstrate RdpThief,
reusing our knowledge of DLL injection from previous modules.
We’ll open the C# console project
containing our existing DLL injection code.
We’ll obviously need to modify this code.
First, we’ll need a compiled version of the RdpThief DLL,
which is located on the appsrv01 machine in the C:\Tools folder.
To make our proof of concept work,
we’ll update the code to use the static path of the RdpThief DLL.
In addition, we want to locate the “mstsc” process instead of “explorer”.
To test this out, we’ll compile the C# project,
log in to appsrv01 as dave,
and copy the executable to C:\Tools.
Next, we start mstsc.exe followed by our C# console application.
Finally, we’ll use mstsc to log in to dc01 as the admin user,
then dump the contents of the RdpThief output file
to find the clear text credentials.
While this technique presents us with the user’s username,
domain, and password in clear text,
we must know when an mstsc.exe process is started
and launch our C# console application before the user enters the credentials.
To improve on this, we can modify our injection code further
to automatically detect when an instance of mstsc is started
and then inject into it.
We’ll implement this with an infinitely-running while loop.
With each iteration of the loop, we’ll discover all instances of mstsc,
and subsequently perform an injection into each of them.
Finally, we’ll use the Thread.Sleep method
to pause for one second between each iteration.
To use this method we must first import
the System.Threading namespace with the using statement.
When the updated C# console application is executed,
it will detect any running instances of mstsc
and inject the RdpThief DLL into them before the user enters the credentials.
In this section, we have leveraged research that allows us to capture
the clear text passwords used on a compromised workstation
when a Remote Desktop instance is started.