The RdpStrike
is basically a mini project I built to dive deep into Positional Independent Code (PIC) referring to a blog post written by C5pider, chained with RdpThief tool created by 0x09AL. The project aims to extract clear text passwords from mstsc.exe,
and the shellcode uses Hardware Breakpoint to hook APIs. It is a complete positional independent code, and when the shellcode injects into the mstsc.exe
process, it is going to put Hardware Breakpoint onto three different APIs (SspiPrepareForCredRead
, CryptProtectMemory
, and CredIsMarshaledCredentialW
), ultimately capturing any clear-text credentials and then saving them to a file.
An aggressor script makes sure to monitor for new processes; if the process mstsc
is spawned, it injects the shellcode into it.
When the aggressor script is loaded on CobaltStrike, three new commands will be available:
rdpstrike_enable
– Enables the heartbeat
check of new mstsc.exe processes and injects into them.rdpstrike_disable
– Disables the heartbeat
check of new mstsc.exe but is not going to remove the hooks and free the shellcode.rdpstrike_dump
– Reads the file and prints the extracted credentials if any.
PsSetCreateThreadNotifyRoutine/PsSetCreateThreadNotifyRoutineEx
GetThreadContext
& SetThreadContext
the calls are executed from an un-backed memory.C:\Windows\Temp
) with a name as {7C6A0555-C7A9-4E26-9744-5C2526EA3039}.dat
LoadLibraryA
loading dpapi.dll
which is again from un-backed memory.NtQuerySystemInformation
syscall is used to to get a list of threads in the process.Introduction to the Model Context Protocol (MCP) The Model Context Protocol (MCP) is an open…
While file extensions in Linux are optional and often misleading, the file command helps decode what a…
The touch command is one of the quickest ways to create new empty files or update timestamps…
Handling large numbers of files is routine for Linux users, and that’s where the find command shines.…
Managing files and directories is foundational for Linux workflows, and the mv (“move”) command makes it easy…
Creating directories is one of the earliest skills you'll use on a Linux system. The mkdir (make…