Enabling RDP.
In this video, we will be exploring
the process of how to enable RDP on a Windows target
after we've gained access, and we'll also
take a look at how to utilize the RDP protocol so that we can
actually authenticate with the target system via RDP
and consequently gain access and interact with the target
system, right?
So what is RDP?
Because I've been throwing the word around for quite a while
during this course, and we of course
explored-- we actually explored the process of enabling RDP
previously, but in this case, we'll
be, again, exploring it a little bit more
and actually taking a look at how we can utilize it
as a legitimate authentication protocol or a protocol that
can give us access to the target system
once we have credentials that we can utilize, right?
So RDP stands for the remote desktop protocol.
So it's a proprietary graphical user interface
remote access protocol developed by Microsoft
and is used to remotely connect and interact with a Windows
system.
So the key things that you need to take into consideration
there is that it's a graphical user
interface remote access protocol,
which means RDP provides you with a GUI in terms
of controlling your target.
So it's not like a terminal remote access tool or protocol
like switch where you need to log in
and then you have access with a command prompt.
In this case, you actually get access
to the full Windows experience.
So you'll get access to the desktop, et cetera, right?
And RDP by default will utilize TCP Port 3389.
And again, that's something that you need to be aware of.
Whenever you see 3389 running on a Windows target,
just know that that's RDP, and that
is a very important protocol that you can actually test,
right?
Now, RDP on Windows is disabled by default. However,
we can utilize a Metasploit framework
exploit module to enable RDP on the Windows
system or the Windows target and consequently utilize RDP
to remotely access the system.
Now, RDP requires authentication,
and the authentication it requires
is obviously going to be the user account or the user name
and the password for that user account, right?
So we'll actually need to get or set those details.
And in our case, because we've only been able to get hashes,
we'll actually be changing the administrator's password
so that we can gain access to or we can gain access
to the system via RDP, as RDP will require clear text
credentials.
All right, so let's actually take
a look at how this can be done.
So I'm just going to start up the lab environment.
And of course, you can, too.
And let's take a look at how we can enable RDP
and also utilize our RDP to authenticate and gain access
to the target system.
All right, so I'll see you within the lab environment.
All right, so I'm back within the lab environment.
And in this case, we have the target IP specified
for us, which is great.
So I'm just going to copy that.
And of course, we'll need to start up the PostgreSQL
Database Service.
So I'm just going to open up a terminal,
maximize that so you can see what's going on.
So we're going to say service PostgreSQL start,
and then we're also going to start up MSF console
so we can save a little bit of time, all right?
So that will ensure that we can interact with the Metasploit
framework database.
And that's going to start up the Metasploit framework
console for us, so we are then going to create a workspace
and in this case, we're just going to call it RDP, right?
Because that's what we're dealing with.
We're then going to set up the global variable value
for the ROS option to the target IP
so that we don't need to, again, keep
on typing the target IP address for every module that we load.
So I'm going to hit Enter.
And then we need to perform an Nmap scan on the target system,
because first and foremost, we actually
need to gain access to the target system.
So let's get an idea of what services we can actually
exploit on the target system.
So I'm going to just perform a simple service version
detection scan, and I'll paste in the IP.
And of course, we're utilizing the db_nmap command, which
allows us to perform an Nmap scan from within MSF console,
and the Nmap scan results will consequently
be saved within the Metasploit framework database
within our current workspace.
So I'll hit Enter, and I'll give that a few seconds.
All right, so as you can see, the Nmap scan results,
or the actual results from the Nmap scan
reveal that we have BadBlue running on port 80, which we've
exploited before, and that's what
we're going to be exploiting in this case
to gain access to the target system.
We can also see that because we performed
a default scan or a default port scan
that scanned 1,000 of the most common ports,
so we weren't able to identify 3389 as open,
so RDP by default on this system is disabled.
So I just want you to keep that in mind.
All right, so what we'll do is we'll search for the BadBlue
exploit, so I'm just going to say search BadBlue,
and we're going to utilize the pass through buffer overflow
module.
All right, and I'll just say use and paste that in there.
And of course, we can actually confirm
that it's running on the target by opening up our browser
and navigating to port 80.
So I'll paste in the target IP there.
There we go, BadBlue is running, and this
is the Enterprise Edition, which is important in this case.
So I'm going to say, show options.
And we have the target IP specified,
because we set up the global variable value
for the RHOST option.
And then we don't have an SSL certificate
and the port is configured correctly.
All we need to do is set up the target.
So I'm going to say set target, and we're
going to say BadBlue Enterprise Edition 2.7 Universal,
and I'll just hit exploit.
All right, there we are.
Fantastic.
We get a Meterpreter session.
Just going to wait for it to pop up.
There we are.
And we can then say get user ID.
And we currently have NT authority system privileges,
which are the highest privileges available on a Windows system.
If we perform some local system enumeration,
we can see that it's a Windows Server 2012 R2
version of Windows running, and then the target operating
system architecture is 64-bit.
In this case, we don't need to upgrade our Meterpreter session
to a 64-bit Meterpreter session.
So again, that's perfectly fine in this case.
What we need to do now is, of course enable RDP on the target
system, so I'm just going to put this in the background using
the Control+Z keyboard combination.
There we are.
And I'm going to search for the Enable RDP module,
so I'm going to say search enable_rdp, and that's
the model here, or the module.
And we can then say use.
There we are.
And if we show the options, you can
see that we have the enable options set to true,
so that will enable RDP and add the firewall exception,
so it'll actually allow us to communicate with port 3389.
And then we can perform some port forwarding.
We'll be exploring this during the pivoting video.
For now, we're just going to be taking
a look at the LPORT option.
So this is if you enable port forwarding,
you can set up the local port to 3389, as well,
and connect to your local host on port 3389,
as port forwarding will essentially
handle the connection.
We also have the password option.
So that will allow you to create a user
and specify the password, which you can do if you want.
However, in this case, we're going
to be changing the administrator password.
So I'm going to say set the session to 1,
and then we can just hit exploit.
And in this case, it looks like RDP was already enabled.
However, we'll need to confirm that, right?
So it's going to say opening the RDP service is started,
and it's going to open the port in the local firewall,
if necessary.
So we can perform a quick Nmap scan to verify that.
So we're going to say db_nmap -sV,
and we can then specify the port 3389,
to be specific, and paste in the target IP, which
I do not have within my clipboard,
so let me just copy it there.
There we go.
So I'll paste it in there.
And let's see whether port 3389 is currently open,
so that we can confirm that RDP is indeed
enabled on the target.
So I'll give that a few seconds to complete.
All right, so I just modified the Nmap scan
to only scan the actual port or the status of the port
and ignored the service version detection, because
for some reason, it looked like that
was taking quite a bit of time.
And in this case, we can see that port 3389 is now open,
which means we now have RDP running on the target.
So how do we gain access to RDP?
Well, as I said, we need a legitimate user account
on the system.
Furthermore, we also need a clear text password.
So given the fact that we already have access
to the target via a Meterpreter session,
we can pop up a shell or the command
prompt by typing in shell, and list out
the actual users on the system by saying net users.
And as you can see, we only have the administrator and guest
user.
Now, you can create another user account on the system,
and you can do that through the Enable RDP module,
as we explored, but in this case,
we are not going to do that.
So we are going to change the password for the administrator
user.
Now, this is not recommended, because of course, this
is an obvious indicator of compromise on the target
system, because once the administrator tries to log on,
then of course they're going to find out
that their password has been changed
and consequently determine or find out
that the system has been hacked, so this is not
really recommended.
However, if you wanted to do that, we could say net user,
or just specify the actual user that we want
to modify the password for.
So we're going to say net user administrator,
and then specify the new password.
In this case, we'll just call it hacker_123321.
We hit Enter, and it's going to tell you the command completed
successfully.
Now, in order to change user account passwords,
you of course need to have administrative privileges,
which we have.
So that's the only way we can do that.
Otherwise, you would have to go through the process of cracking
hashes or utilize Mimikatz to dump clear text
passwords from memory, which again is a hit
and miss type of process.
But in this case, we have been able to do it.
So I'm just going to terminate the channel here,
and we'll go back to our Meterpreter session.
So now that we have obtained legitimate credentials here,
which I'll just copy the password that we specified,
how do we gain access, or how do we interact with RDP
from a Linux system?
Well, we can create a new tab and we can utilize
a utility called X Free RDP.
So we can just type it in, xfreerdp,
and then we need to specify the actual username that we
want to authenticate as.
So that can be done by using the forward slash, u, colon,
and then the username, administrator,
and then we use a forward slash, p, colon, password.
We specify the password here, which I'll just paste in.
And then we need to specify the actual target host or the IP
address, which is done by specifying the forward slash v
hyphen option, and then we paste in the target
IP, which I'll do right now.
There we are, and we hit Enter.
And it's going to ask you whether we want to essentially
accept the certificate.
And I'm going to hit yes.
And it will open up a remote desktop session on the target
system, as you can see here.
And it authenticates successfully,
and we now have access to the Windows target system.
And as you can see, this is the advantage of having RDP.
You can essentially interact with the target
through the actual Windows desktop,
and it provides you with a graphical user interface
and we can essentially navigate around the system.
And of course, in this case, or with this particular lab
environment, we're supposed to get the flag, and we do,
so we have actually gone through all the steps necessary.
All right, so you can pretty much
do whatever you want on the system now.
However, again, if another user is logged on
or the administrator user is currently logged on,
then they will see some activity that looks strange.
So this is something that you would do typically
through another user account.
So during a standard penetration test,
I would recommend creating another user account.
And then utilizing that.
However, in that particular case,
you will also need to add that other user
account to the Administrators group
so that you have administrative privileges.
Otherwise, you'll have standard user privileges.
All right, so that is how to enable RDP on a Windows target
and consequently gain access to the target system via RDP.
So that is going to conclude the practical demonstration aspect
or side of this video.
In the next video, we will be exploring
the process of performing key logging on a Windows target.
So we'll take a look at how to capture
the keys or the keyboard input on the target system
and consequently get back that keyboard input.
And the reason why this is so important
is because if you capture all the keyboard input that's
being input on the target system,
you have a good chance of capturing maybe a few usernames
and passwords that can allow you to compromise other systems.
So that's what we'll be exploring in the next video,
and I'll see you there.