base on Remote Desktop Protocol .NET Console Application for Authenticated Command Execution ### SharpRDP - Remote Desktop Protocol Console Application for Authenticated Command Execution #### Building To compile open the project in Visual Studio and build for release. Two DLLs will be output to the Release directory, you do not need those because the DLLs are in the assembly. If you do not want to use the provided DLLs you will need to .NET SDK to create the AxMSTSCLib.dll DLL. To create it you'll need to run aximp from the SDK on mstscax.dll. `%<SDK dir>%\aximp.exe %windir%\system32\mstscax.dll`. Those DLLs will need to be referenced by the project to get the Interop DLLs created. You will also need to compress the DLLs with Deflate and name them AxInterop.MSTSCLib.dll.bin and Interop.MSTSCLib.dll.bin #### Usage ``` Regular RDP connection and execution SharpRDP.exe computername=target.domain command="C:\Temp\file.exe" username=domain\user password=password ``` ``` Exec program as child process of cmd or powershell SharpRDP.exe computername=target.domain command="C:\Temp\file.exe" username=domain\user password=password exec=cmd ``` ``` Use restricted admin mode SharpRDP.exe computername=target.domain command="C:\Temp\file.exe" ``` ``` Connect first host drives SharpRDP.exe computername=domain.target command="\\tsclient\C\Temp\file.exe" username=domain\user password=password connectdrive=true ``` ``` Execute command elevated through Run Dialog - CURRENTLY BUGGED SharpRDP.exe computername=domain.target command="C:\Temp\file.exe" username=domain\user password=password elevated=winr ``` ``` Execute command elevated through task manager SharpRDP.exe computername=domain.target command="C:\Temp\file.exe\" username=domain\user password=password elevated=taskmgr ``` ``` Add Network Level Authentication SharpRDP.exe computername=domain.target command="C:\Temp\file.exe\" username=domain\user password=password nla=true ``` ``` Ask to take over logon session SharpRDP.exe computername=domain.target command="C:\Temp\file.exe\" username=domain\user password=password takeover=true ``` If restricted admin mode is enabled on the target do not specify any credentials and it will use the current user context. Can `PTH` or `make_token` in beacon or `runas /netonly` on a Windows system. All execution starts with the Windows run dialog (Win+R). There will be a registry key created at `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU` with the command that you executed. If you want to remove this you can use: [CleanRunMRU: Get or clear RunMRU values](https://github.com/0xthirteen/CleanRunMRU) Keep in mind if you execute a program like msbuild (I'm sure there are others) a cmd window will pop up while the process is running. If you do it would probably be best to migrate the process and kill the original. The required DLLs are compiled into the assembly and app domain assembly resolve event is used. Because of the size of the DLLs they are compressed and decompressed at runtime (so they could meet beacon's 1MB size limit). Blog about it found here [SharpRDP](https://0xthirteen.com/2020/01/21/revisiting-remote-desktop-lateral-movement/) Also part of [MoveKit](https://github.com/0xthirteen/MoveKit) ", Assign "at most 3 tags" to the expected json: {"id":"6933","tags":[]} "only from the tags list I provide: [{"id":77,"name":"3d"},{"id":89,"name":"agent"},{"id":17,"name":"ai"},{"id":54,"name":"algorithm"},{"id":24,"name":"api"},{"id":44,"name":"authentication"},{"id":3,"name":"aws"},{"id":27,"name":"backend"},{"id":60,"name":"benchmark"},{"id":72,"name":"best-practices"},{"id":39,"name":"bitcoin"},{"id":37,"name":"blockchain"},{"id":1,"name":"blog"},{"id":45,"name":"bundler"},{"id":58,"name":"cache"},{"id":21,"name":"chat"},{"id":49,"name":"cicd"},{"id":4,"name":"cli"},{"id":64,"name":"cloud-native"},{"id":48,"name":"cms"},{"id":61,"name":"compiler"},{"id":68,"name":"containerization"},{"id":92,"name":"crm"},{"id":34,"name":"data"},{"id":47,"name":"database"},{"id":8,"name":"declarative-gui "},{"id":9,"name":"deploy-tool"},{"id":53,"name":"desktop-app"},{"id":6,"name":"dev-exp-lib"},{"id":59,"name":"dev-tool"},{"id":13,"name":"ecommerce"},{"id":26,"name":"editor"},{"id":66,"name":"emulator"},{"id":62,"name":"filesystem"},{"id":80,"name":"finance"},{"id":15,"name":"firmware"},{"id":73,"name":"for-fun"},{"id":2,"name":"framework"},{"id":11,"name":"frontend"},{"id":22,"name":"game"},{"id":81,"name":"game-engine "},{"id":23,"name":"graphql"},{"id":84,"name":"gui"},{"id":91,"name":"http"},{"id":5,"name":"http-client"},{"id":51,"name":"iac"},{"id":30,"name":"ide"},{"id":78,"name":"iot"},{"id":40,"name":"json"},{"id":83,"name":"julian"},{"id":38,"name":"k8s"},{"id":31,"name":"language"},{"id":10,"name":"learning-resource"},{"id":33,"name":"lib"},{"id":41,"name":"linter"},{"id":28,"name":"lms"},{"id":16,"name":"logging"},{"id":76,"name":"low-code"},{"id":90,"name":"message-queue"},{"id":42,"name":"mobile-app"},{"id":18,"name":"monitoring"},{"id":36,"name":"networking"},{"id":7,"name":"node-version"},{"id":55,"name":"nosql"},{"id":57,"name":"observability"},{"id":46,"name":"orm"},{"id":52,"name":"os"},{"id":14,"name":"parser"},{"id":74,"name":"react"},{"id":82,"name":"real-time"},{"id":56,"name":"robot"},{"id":65,"name":"runtime"},{"id":32,"name":"sdk"},{"id":71,"name":"search"},{"id":63,"name":"secrets"},{"id":25,"name":"security"},{"id":85,"name":"server"},{"id":86,"name":"serverless"},{"id":70,"name":"storage"},{"id":75,"name":"system-design"},{"id":79,"name":"terminal"},{"id":29,"name":"testing"},{"id":12,"name":"ui"},{"id":50,"name":"ux"},{"id":88,"name":"video"},{"id":20,"name":"web-app"},{"id":35,"name":"web-server"},{"id":43,"name":"webassembly"},{"id":69,"name":"workflow"},{"id":87,"name":"yaml"}]" returns me the "expected json"