net localgroup "Remote Desktop Users" UserLoginName /add
自动化工具
AutoRDPwn 是一个使用 Powershell 创建的后渗透框架,主要设计用于自动化对 Microsoft Windows 计算机进行 Shadow 攻击。这个漏洞(被微软列为一个功能)允许远程攻击者在未经同意的情况下查看受害者的桌面,甚至可以根据需要控制受害者的桌面,使用操作系统本身的工具。
从命令行以自动化方式控制鼠标和键盘
从命令行以自动化方式控制剪贴板
从客户端生成一个通过 RDP 将网络通信引导到目标的 SOCKS 代理
在目标上执行任意 SHELL 和 PowerShell 命令,无需上传文件
即使目标上禁用文件传输,也可以与目标之间上传和下载文件
HackTricks 自动化命令
Protocol_Name: RDP #Protocol Abbreviation if there is one.
Port_Number: 3389 #Comma separated if there is more than one.
Protocol_Description: Remote Desktop Protocol #Protocol Abbreviation Spelled out
Entry_1:
Name: Notes
Description: Notes for RDP
Note: |
Developed by Microsoft, the Remote Desktop Protocol (RDP) is designed to enable a graphical interface connection between computers over a network. To establish such a connection, RDP client software is utilized by the user, and concurrently, the remote computer is required to operate RDP server software. This setup allows for the seamless control and access of a distant computer's desktop environment, essentially bringing its interface to the user's local device.
https://book.hacktricks.xyz/pentesting/pentesting-rdp
Entry_2:
Name: Nmap
Description: Nmap with RDP Scripts
Command: nmap --script "rdp-enum-encryption or rdp-vuln-ms12-020 or rdp-ntlm-info" -p 3389 -T4 {IP}