0x09al/rdpthief

Extracting Clear Text Passwords from mstsc.exe using API Hooking.

RdpThief

RdpThief by itself is a standalone DLL that when injected in the mstsc.exe process, will perform API hooking, extract the clear-text credentials and save them to a file.

An aggressor script accompanies it, which is responsible for managing the state, monitoring for new processes and injecting the shellcode in mstsc.exe. The DLL has been converted to shellcode using the sRDI project (https://github.com/monoxgas/sRDI). When enabled, RdpThief will get the process list every 5 seconds, search for mstsc.exe, and inject to it.

When the aggressor script is loaded on Cobalt Strike, three new commands will be available:

• rdpthief_enable – Enables the hearbeat check of new mstsc.exe processes and inject into them.
• rdpthief_disable – Disables the hearbeat check of new mstsc.exe but will not unload the already loaded DLL.
• rdpthief_dump – Prints the extracted credentials if any.

Screenshot

Demonstration Video : https://www.youtube.com/watch?v=F77eODhkJ80

More details can be found on : https://www.mdsec.co.uk/2019/11/rdpthief-extracting-clear-text-credentials-from-remote-desktop-clients/

rdpthief's Issues

Crashes RDP upon injection

Running into an issue when Cobalt Strike injects the .tmp file, it crashes RDP. Has this been patched?

Never see the injection happen

victim is a windows 10 (local admin user) - seems like the injection is never done. RDP is turned on, and I can RDP into the machine from another machine...

beacon> sleep 0
[*] Tasked beacon to become interactive
[+] host called home, sent: 16 bytes
beacon> rdpthief_enable
[+] RdpThief enabled

[+] host called home, sent: 12 bytes
[+] host called home, sent: 12 bytes
[+] host called home, sent: 12 bytes
[+] host called home, sent: 12 bytes
[+] host called home, sent: 12 bytes
[+] host called home, sent: 12 bytes
[+] host called home, sent: 12 bytes
[+] host called home, sent: 12 bytes
[+] host called home, sent: 12 bytes
[+] host called home, sent: 12 bytes
[+] host called home, sent: 12 bytes
[+] host called home, sent: 12 bytes
[+] host called home, sent: 12 bytes
[+] host called home, sent: 12 bytes
beacon> rdpthief_disable
[+] Disabling RdpThief
beacon> rdpthief_dump
[*] Tasked beacon to run: type %temp%\data.bin
[+] host called home, sent: 51 bytes
[+] received output:
The system cannot find the file specified.

Issue hooking mstsc.exe on windows 10 1903

I compiled the DLL (RdpThief.dll) and injected it into mstsc.exe process. It is able to hook ADVAPI32!CredIsMarshaledCredentialW but is unable to hook SSPICLI!SspiPrepareForCredRead and dpapi!cryptprotectmemory. I was able to verify this by attaching a debugger and looking at the assembly. Only the CredIsMarshaledCredentialW function has jump into the loaded dll. Any pointers on how do I debug this issue or have you encountered this before?

Are some DLLs immune to hooking?