Week 5 ‐ Initial Access and Execution (Task 4) - sophialevasseur/SEC-335 GitHub Wiki

😱Main DOC 😱

💻Pre-lab Setup💻

  1. Enable Remote Desktop on your Windows 10 VM through System Properties or Group Policy
  2. Verify RDP is listening on port 3389 using the command below on Windows 10:
    • netstat -an | findstr 3389
  • If no output, double-check that you enabled RDP.

🌲Steps🌲

  1. From your attack VM, use xfreerdp3 or equivalent RDP client to connect to the Windows 10 VM
  2. Authenticate using the champuser credentials
  3. Verify successful connection by viewing the Windows desktop remotely
  4. Record the entire RDP session from connection to logout of the RDP session

🌹Windows🌹

⚡Enable RDP on the Windows 10 VM⚡

  • Enable Remote Desktop via System Properties, Group Policy, or the registry/firewall commands below.
    • REG ADD "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
    • netsh advfirewall firewall set rule group="remote desktop" new enable=yes

⚡Ensure that RDP is listening on port 3389⚡

  • netstat -an | findstr 3389

🌹Kali🌹

⚡Connect from kali to windows using xfreerdp3⚡

  • xfreerdp3 /u:champuser /p:<CHAMPUSER_PASSWORD> /v:10.0.17.66 /cert:ignore

💯Submission💯

Submit the following:

  1. a video of the RDP client connection command from the attack VM through to the desktop appearing with a brief exploration of the remote desktop to prove interactive access,
  2. an explanation of how RDP is used by threat actors for initial access and lateral movement, and
  3. the MITRE ATT&CK technique ID.

  • An explanation of how RDP is used by threat actors for initial access and lateral movement:

    • RDP is optimal for threat actors in the initial access phase because they are able to brute force credentials and perform executables to gain knowledge on the system. Once learning more about the system, credentials, etc. the attacker is able to move laterally through the network.

  • MITRE ATT&CK technique ID:

Step Technique MTIRE ATT&CK ID
RDP for initial access External Remote Services T1133
RDP for lateral movement Remote Services: Remote Desktop Protocol T1021.001
Enable RDP via registry Modify Registry T1112

❓Questions❓

  1. How does an RDP session differ from a Meterpreter session in terms of attacker capabilities?
    • RDP offers the attacker direct access to the users computer, which is convienent but not as stealthy as a meterpreter session. Meterpreter sessions provide the attacker no GUI but access to user cmdlet, operating entirely behind the scenes.
  2. Why is RDP a preferred method for attackers who want to interact with a graphical environment?
    • RDP is a preferred method for attackers who want to interact with a graphical environment because they are able to directly operate via the users interface. Meterpreter does not have a GUI option, making RDP the optimal choice.
  3. What network monitoring indicators would suggest unauthorized RDP access?
    • The network monitoring indicators that suggest unauthorized RDP access is activity on port 3389, checking windows event logs for specific RDP session logs, and there is also a script that you could use (In the first source linked) for creating alerts for unexpected RDP session events.
  4. How can organizations restrict RDP access to reduce the attack surface?
    • An organization can restrict RDP access to reduce the attack surface by removing RDP from devices that don't require it, change firewall rules around RDP access, and changing the default port.

Sources: