Articles
-
Spying on users using Remote Desktop Shadowing - Living off the Land
A while ago on a Sunday afternoon I was playing with an old laptop to repurpose it to be a media center for the TV. Because I prefer to use Windows’ built-in solutions over 3rd party tools, after a quick online research, I discovered that Microsoft Remote Desktop Protocol (RDP) supports a so-called “shadowing” feature and RDP is available in all Windows Server Operating Systems and the business editions of end-user Windows versions.
-
Extracting credentials from a remote Windows system - Living off the Land
Recently we performed a red teaming engagement where we wanted to dump the credentials from a remote host. We got the credentials of a user which has administrative privileges on the victim host and wanted to get more credentials from that host. Because we felt that the blue team was closely observing the environment this needed to be done in a stealthy manner and preferably only involving native Windows tooling. That is when we came up with the following approach in order to obtain a remote system’s
SYSTEM,SECURITYandSAMfiles from%SystemRoot%\System32\Configmaking use of WMI and SMB. This approach can also be used to obtain thentds.ditfile from a Domain Controller in order to obtain the credentials of the complete organization.
