riski11234 / rdpersistence

A script for SOC operators' first analysis. Add new player in the game.

RDPerci RDPersistence

Usage

• Choose username and password and the RDP port.
• Run RDPerci.bat on victim
• Connect to victim with the username&password created and the specified port

Description

RDPerci is ideal for SOC operators' first analysis. It's a simple script able to enable RDP and add new admin user with the access over it. It's inspired from famous malware that works with RDP. To allow multple RDP sessions it uses termsrv_rdp_patch.ps1 from winposh repository.

How it works

RDPerci.bat will ask for admin's privileges, when it obtain that it will run. It create new user with a new password (Percin0 and Password123! by default), and try to add to Administrator's group using the default name in different languages. Then enable RDP on the target and change the default port (port 8888 by default). It creates an ACL on WindowsFirewall for RDP connection over the selected port.

References

https://github.com/maxbakhub/winposh

https://attack.mitre.org/techniques/T1021/001/

https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1021.001/T1021.001.md

Disclaimer

Only for analysis do not use without authorization. Only for educational purpose.

Contact

If you want to help me with any suggestions please contact me to [email protected] :) Be patient, I'll update the ngrok component!

Screenshot

RDPerci on victim without RDP enable.

Connection with the new user's credentials and the new port from remote host.

You can do all you want, you are admin!