Remote desktop protocol expert, OSS contributor and entrepreneur. I love designing products with Rust, C# and PowerShell. Proud to be CTO at Devolutions
Get-RdpLogonEvent: extract the list of recent RDP logons from the event viewer and become a magician 🧙♀️ that can answer impossible questions like "is it really using Kerberos (nope), or did it downgrade to NTLM (again)"? 👇
I have just updated my Wireshark guide to decrypting RDP traffic with notes on FreeRDP, IronRDP, and instructions on how to export a .pcapng file with embedded TLS session keys such that it can easily be shared with other people!
PSA: the list of DNS servers in Windows is not supposed to be an ordered list of DNS servers to try - if you put 8.8.8.8 (Google) or 1.1.1.1 (Cloudflare) as a "fallback" after your internal DNS server, you'll just cause random name resolution failures for internal DNS
Do you need to create a local user account on a Windows 11 test VM? Try using "no
@thankyou
.com" with password "nope", let it fail, and then the installer will let you create a local user account 👇
Do you want a *FREE* ARM server with 4 CPUs, 24GB of RAM and 200GB storage, in the cloud? 😮
It's possible using the Oracle Cloud Free Tier! Here's how 👇
The full OCR text with the temporarily visible password is available in the %LocalAppData%\CoreAIPlatform.00\UKP\{<UUID>}\ukg.db SQLite database, nicely gift wrapped 🎁 for infostealer malware to exfiltrate:
Here's Recall capturing temporarily visible passwords from Remote Desktop Manager in a test Azure VM. It's less effective that I would have thought, the search results are screenshots, and it's unclear how one can obtain the full OCR text it used for the match
Achievement unlocked:
#PowerShell
RDP client 🚀
Yes, you read that right: launch *and control* multiple RDP connections from
#PowerShell
scripts! I needed a way to automate MsRdpEx () for stress testing, so here it is:
TIL: [HKEY_USERS\.DEFAULT\Control Panel\International\🌎🌏🌍] is a valid registry key.
Yes, you read that right - emojis are used (🌎🌏🌍) as part of a Windows registry path, because why not?
What's next? C:\Program Files (🤡)? 📀:\?
Here's how to decrypt RDP live traffic in Wireshark!
I will keep expanding on these notes, there are so many tips and tricks to know to get it right
Shout-out to
@BoreanJordan
for his awesome script using PSDetour that I've imported and adapted
I just added a "resize to fit window" option to mstsc using MsRdpEx, enabling the use of the RDP 8.1 dynamic resizing feature introduced over a *decade* ago with Windows 8.1. Grab a copy of MsRdpEx today to try it out for yourself! 👇
Do you want to hide the Microsoft Edge first run experience and change the default tab to Google instead of random news?
Go under HKLM:\Software\Policies\Microsoft\Edge
Then set:
HideFirstRunExperience = 1
NewTabPageLocation = ""
Enjoy!
How can I skip the Microsoft Edge first run experience for all users in a lab environment? I have to go through 4 (!) manual steps every single time I open Edge the first time in a test VM for a new user. The "HideFirstRunExperience" registry key doesn't even show up in ProcMon:
If you are still using PowerShell 5, you are missing one of the greatest features
In PowerShell 7, we have the option to do
$something | ForEach-Object -Parallel { "do the thing"
Read all about it here:
If you're a 7-Zip user, I highly recommend trying NanaZip from
@MouriNaruto
instead: it's built on top of 7-Zip, but adds more features like Windows 11 top-level context menu integration. I've been using it for a few weeks and I love it 👇
binwalk: the dream binary extraction tool I wish I knew about earlier. "binwalk -e firmimg.d7" found and extracted the embedded squashfs filesystem from an iDRAC firmware update file:
Wow, when I see a GitHub issue opened on a repository that hasn't seen an update in 10 years, I expect spam, not someone telling me how much my code is garbage and accusing me of filling GitHub with garbage 🗑️
I'm sorry for sharing code that was helpful to people other than you!
I'm thrilled to announce that I've been promoted to Chief Technology Officer (CTO) at
@DevolutionsInc
! 🍾🥳
After almost 9 years of hard work, I can't wait to help take the company to the next level! 💪🚀
@bitfield
Code is static, a debugger gives you a dynamic view of the execution with real values in memory, which you can't accurately predict otherwise. Good luck finding what's happening with your code at runtime without running it
Wireshark now has an easy way to embed TLS pre-master secrets (SSLKEYLOGFILE) into a capture file from the GUI:
Edit -> Inject TLS Secrets
This will make it MUCH easier to save decrypted TLS sessions in a .pcapng file to share with others!
Did you know Remote Desktop Manager 2023.1 added several RDP client security hardening options?
✅ Enforce Network Level Authentication (NLA)
✅ Enforce Kerberos authentication (no NTLM!)
These are all options in FreeRDP, as the first-party RDP client does not support them 👇
🚀 Exciting world first! 🌐 True Kerberos support in an RDP web client! 🛡️
Devolutions: 1
Microsoft: 0
Here's a demo showing IronRDP with Devolutions Gateway connecting using an account member of the Protected Users group in Active Directory 👇
If you want to diagnose weird, random internal DNS resolution failures, I suggest you try the Nirsoft DNS Query Sniffer tool, it's a real lifesaver 🛟, much easier to use than Wireshark:
@mikeroySoft
With everything going on at Broadcom/VMware, I had to read that 5 times just to be sure I understood it correctly. It's good news, but where's the catch? 🧐
@Spshulem
@arcsincall
Hum... if you're putting "new display type similar to eInk but with a high refresh rate, something that's always been a limiting factor of eInk" in the same bucket as an AI pin, you're officially living in a parallel universe
To finish an evening of reverse engineering:
Here's raw YUV dumped from the RDP server H.264 encoder through undocumented registry keys, which is then played using VLC. It's not definitely not production-grade session recording, but it's still something!
RDP NLA delegates the *full* system credentials (interactive logon), except when using:
* Restricted Admin Mode
* Remote Credential Guard
* Smartcard Authentication
It has always been the case, by design, so this was obviously bound to happen:
So
#mimikatz
wanted passwords, and Terminal Server has some for us🥝
Cleartext passwords *decrypted* on a fully, up to date Windows 2019 Server
No library, no previous code injection, and doesn't use junk part of memory😉
Ping
@jonasLyk
, still in testing ... 🤪
New blog post! 📰 Decompiling Hyper-V Manager to rebuild it from source 🔨 Help me convince Microsoft to save Hyper-V Manager by open sourcing it! Until then, here's how to patch it locally from decompiled code! ☀️💻👇
@MalwareJake
Recall is a melting pot of everything wrong with modern Windows:
Per-user app and settings
MSIX app setting virtualization
Intune MDM per-user policies
WinRT generated proxy code
Enabled by default, opt-out
If you hate it, it's in there, I tell you
New blog post! 📰 Mac RDP Client: Kerberos and Protected Users Guide 🍎 Are you trying to harden your Active Directory environment by eliminating NTLM usage, but RDP from Macs stands in the way? Read this! ☀️💻👇
RDP smartcard emulation is coming to Remote Desktop Manager 2024.2, with support for mstsc!
Import your X.509 client certificate, set a PIN, associate it with your RDP connection entry, enable emulated smartcards and then 🪄 watch the magic happen! 🥳
Dreaming of X.509 client certificate auth in RDP without dealing with smartcard limitations? We've got you covered with *application-level* virtual smartcards that wrap X.509 certificates! Here is MsRdpEx injecting sspi-rs into mstsc.exe instead of credssp.dll and winscard.dll 👇
I found something a bit odd inside WsmSvc.dll (WinRM library). It appears to connect to
http://127.0.0.1:80
for proxy auto-detection with a special user agent. Do all Windows machines have such a special localhost HTTP listener on port 80? How does that work exactly? 🤔
Wait, what? If you launch vmconnect.exe without any parameters, you get a simple connection dialog to select the Hyper-V server and target virtual machine from a drop-down list. I had no idea this was even there
Pssst.🤫
Active Directory still allows unauthenticated LDAP binds (empty password) by default. ⚠️
If you don't need it (hint: you don't) then disable it right now. ⚡️
Here's a reference blog post and
#PowerShell
code snippet to do it. Please share! 🥰
Are you tired of manually downloading and installing the Windows SDK just so you can copy dbghelp.dll, srcsrv.dll, symsrv.dll from it and get clean stack traces in Process Monitor and Process Explorer? I made a script to download and extract those!
@pavandavuluri
"Secure by design and secure by default" the preview version of Recall was made without proper security, so how can it be secure by *design*? Security was an afterthought, you're rushing to *add* security to Recall only *after* it's been pointed out how it was seriously lacking
Remote Desktop Manager supports Remote Credential Guard, but did you know that unlike the Microsoft RDP client, it also accepts explicit credentials? This means you are no longer restricted to just the *current* user to benefit from RCG and avoid exposing credentials to mimikatz!
Something wrong with Azure AD registration on a device, dsregcmd /status looks good, but something's off? DSRegTool.ps1 is the right diagnostic tool for the job, it solved another issue today for me:
New blog post! 📰 Active Directory LDAPS certificate selection deep dive 🚀 The ULTIMATE guide to figuring out why your certificate isn't getting picked up for LDAPS, and how to ensure it picks exactly the certificate you want! ☀️💻👇
@techspence
There are three possible scenarios:
1) Admin is still logged in, so you bump him and take over his session (very noticeable)
2) Admin is disconnected, but RDP session is inactive, you reactivate it and take over
3) Admin has signed out, so you create a new RDP session
I have just updated my Wireshark RDP decryption instructions and included a first set of sample decrypted capture files to show different RDP authentication scenarios:
Proxy servers edited through the Windows Settings app remain in the registry after being disabled *and removed* in the UI, where it still gets picked up by WinHTTP APIs
Remove-Item HKLM:\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\ProxyMgr -Recurse -EA SilentlyContinue
New blog post! 📰 PowerShell Remoting Trusted Hosts: What does it even mean? 😱 Everything you need to know to make WinRM work properly without cryptic errors, and more! ☀️💻👇
@SwiftOnSecurity
Fun fact: the dancing banana gif is small and has low entropy, so it compresses well and can serve as a good animated sample for codec testing. I've recorded it in my Apple Remote Desktop reversing work to get an MVS codec message sequence that could be replayed to the client:
Remote Desktop Manager ❤️ Remote Credential Guard
I finally figured it out! Here's a preview showing RDM successfully connecting with an RCG-enabled embedded RDP session! Stay tuned for an upcoming release 😁
New blog post! 📰 Enable PowerShell WinRM Remoting in PowerShell 7 😱 Yes, you can use PowerShell 7 in the server without switching to SSH-based remoting, and here's how to do it for WinRM and Hyper-V PowerShell Direct! ☀️💻👇
@ShawnWildermuth
@markrussinovich
It's very hard to unlearn C/C++, but it doesn't matter, young developers can pick up Rust quite fast, and that makes it vastly easier than trying to find talented C/C++ developers.
Am I weird to like Rust as a language for which I mostly have *other* developers write the actual code? I still feel vastly more comfortable in C/C++ myself, but I would would take Rust deliverables any day over C/C++ deliverables. Code safety, quality and stability is higher
Dreaming of X.509 client certificate auth in RDP without dealing with smartcard limitations? We've got you covered with *application-level* virtual smartcards that wrap X.509 certificates! Here is MsRdpEx injecting sspi-rs into mstsc.exe instead of credssp.dll and winscard.dll 👇
Remote Desktop Manager 2023.3 includes revamped X.509 certificate support! The new credential entry can import/export to/from PEM/PFX formats (no OpenSSL!), but it can also link to the Windows certificate store, and even automatically select an RDP smartcard with PIN injection!👇
How can I skip the Microsoft Edge first run experience for all users in a lab environment? I have to go through 4 (!) manual steps every single time I open Edge the first time in a test VM for a new user. The "HideFirstRunExperience" registry key doesn't even show up in ProcMon:
I know Windows 11 is making it increasingly harder to create an *initial* local user account, but I hadn't noticed the new dark patterns that make it harder to create additional local user accounts. This is just bad for testing:
sspi-rs is taking form: here's FreeRDP using a pure
@rustlang
Kerberos SSPI module on Linux to perform RDP NLA with Windows Server. This supports both TCP and HTTP(S) transports for Kerberos. KDC detection is still a work in progress, but it's coming! 💪
@pati_gallardo
Want to feel old? When my colleague in the security team mentioned it was the biggest OpenSSL vulnerability in the last ten years, I wanted to contradict him with heartbleed, only to realize that was in 2012. It is literally 10 years ago already 😭
@kelseyhightower
It was already a problem 10 years ago, and it's probably only worse now. I feel like most low-level developers coming out of school today learned it by themselves
My new blog post "Finding Secret RDP Registry Keys Using
@HexRaysSA
IDA Free" is finally out, showing the thought process behind simple reverse engineering tasks. If you've never decompiled programs and don't know how to get started, this is for you! 🚀
Do you sometimes use RDP through an SSH tunnel? Are you aware that this specific use case is not properly covered by the current NTLM deprecation plan from Microsoft? Even with IAKerb and the TryIPSPN solution, connecting to "localhost:<local port>" will never work for Kerberos
SUCCESS! 🥳
As I suspected, rdclientax.dll from the modern Microsoft Remote Desktop client (msrdc.exe) is basically the same ActiveX component as mstscax.dll from the classic Microsoft Terminal Services client (mstsc.exe). They are binary compatible, and here's proof:
Simply put, the annoying mstsc certificate prompt users have ignored for years by habit has zero value since the CredSSP protocol not only doesn't care about it, but the RDP client will begin NTLM authentication with the server *before it even validates it* - by design, won't fix
Our latest blog post is out. After years of RDP research, I decided that it was time that googling "Is RDP safe to use over untrusted networks?" had a good answer with the biggest risk clearly laid out. Spoiler: the answer is no.
Adding the missing RDP in-process virtual channel APIs Microsoft forgot to add all those years ago - I've had to register MsRdpEx.dll as a "plugin" with a per-session CLSID to then find a registered IWTSPlugin pointer from a global table to make it happen, but it finally works!
Oh, the Microsoft legendary RDP error handling.
With the Protected Users Group:
Invalid password = "A user account restriction is preventing you from logging on"
Invalid PIN + smartcard = "Your credentials did not work"
Is it really that hard to return a proper error message?
I just published a reversing project of the Hyper-V VMBusPipe (a special host/guest named pipe transport over the VMBus) that I worked on back in 2014. I hope this can be useful to reversers and security researchers, so please share!
@gerhart_x
@aionescu
New blog post! 📰 Active Directory Kerberos KDC certificate selection 🚀 Yes, it is possible to select a specific Kerberos KDC (PKINIT) certificate that isn't the same as the LDAPS certificate, and here's how! ☀️💻👇
@SwiftOnSecurity
I think the biggest mistake here is assuming that all Windows installations are for personal devices, or used by a single person. I don't care if the local account setup is hidden behind dark patterns, I still want clean lab/test VMs unattached to a Microsoft account
Is your Windows Hello for Business deployment gone wrong with users unable to login from home after the initial setup? Have you checked that they didn't end up with a key trust deployment when a cloud Kerberos trust deployment was expected? New blog☀️💻👇
My RDP authentication training at was a success, the attendees were quite interested in the material I presented. Here are the slides (in French) for "Démystifier l'authentification RDP: techniques avancées de diagnostic":
@bettersafetynet
@SwiftOnSecurity
No copy/paste = manually typed passwords = low entropy passwords
It's extremely important to support copy/pasting passwords, or injecting passwords, otherwise they make strong, generated passwords unusable
@GossiTheDog
To add on top of this: how does Recall in its current form fit with GDPR? Things like *customer email addresses* are hidden from user interfaces to facilitate GDPR compliance, and here Recall just captures everything visible at the screen with OCR text like it's no big deal
I just fixed the same issue on a Windows 10 machine: it prevents Windows Update until you resize your recovery partition with enough free space. This isn't the kind of thing regular users can figure out on their own, so prepare yourself to fix a lot of PCs from friends and family
Here we go a 'goggle-ing...among the leaves so greeeennnnnn... Both My Server 2022 machines wont take the automatic update.
@WSV_GUY
any ideas? Reddit agrees:
I finally have Internet fiber optic cable installed all the way through a 400 feet trench I had to dig myself to put the PVC tubing in place. It wasn't easy digging through roots and rocks and all kinds of obstacles, but it's finally done 💪
@grhmc
@MalwareTechBlog
That's what baffles me - how can a bug so severe be discovered multiple times but only gain attention once people use it in Minecraft? Not only the bug has to be found, but it has to be "promoted" somehow. That doesn't make any sense
@GossiTheDog
Is it still just a per-user setting, with no device-wide group policy? There's so much being said about Recall that I'm no longer sure if that part is true, even the docs only mention the per-user setting:
@RonnyTNL
@GossiTheDog
The user can manually exclude applications by executable path, but only through the GUI, and it stores the settings in MSIX virtualized registry hives that can't be accessed directly, meaning there's no way for application vendors to automatically exclude their apps on install
Windows code signing has one big problem: it's too expensive 🫰 and difficult to deal with for most open source projects, where it's often coming out of someone's personal money, not from a business that can well afford it
Have you ever wanted to query Azure AD (Entra ID) join information in
#PowerShell
without calling dsregcmd.exe /status and parsing the textual output? I've got you covered with this code snippet that calls the underlying Windows APIs directly:
My dream: every single Windows Server ISO by OS Build number available for download. Just select something like Windows Server 2022 Version 21H2 (OS Build 20348.887) or (OS Build 20348.1726) and bootstrap a temporary VM to reproduce a customer issue. It would save so much time
I hooked the RDP input window (different from the output window), registered a WM_TIMER that calls PostMessage for F15 WM_KEYDOWN, WM_KEYUP, then set AllowBackgroundInput to 1 and it works even when the RDP ActiveX window is not in focus!
Has anyone ever implemented a "mouse jiggler" for RDP connections that works with mstsc, forcing a session to be kept alive from the client, without touching server-side settings? I don't care how sketchy the solution is, I'm just curious to see if someone's done it and how
@hoyty
I don't know if I should laugh or cry at the irony of "Windows App" on Windows being literally unable to connect to Windows unless it's Azure Virtual Desktop, Windows 365 or Microsoft DevBox. Might as well call it "Windows-but-only-in-Azure App" 🤷
How does Windows determine which DNS servers to use? Each network interface can have a different one, and there doesn't seem to be a globally "chosen" one in the registry? It looks a lot more complicated than resolv.conf on other platforms 🤔
Does anybody understand how to access a path like \REGISTRY\A\{e3a59865-c117-3e84-7ce0-61287be4c1b8}\LocalState\.ScreenUnderstanding.Settings\CaptureExclusion as shown in ProcMon with regedit.exe? It's such an odd registry path:
@sinclairinat0r
The scripts are here with instructions, I've been maintaining it for years for developers at Devolutions but recently a few external users gave it a try with success. It's built using Hyper-V PowerShell Direct, entirely driven from the Hyper-V host:
@GossiTheDog
Disable Recall with a PowerShell one-liner:
Set-ItemProperty HKLM:\SOFTWARE\Microsoft\PolicyManager\default\WindowsAI\DisableAIDataAnalysis -Name Value -Value 1
I'm confused - this is a per-user setting, yet it's apparently stored under HKEY_LOCAL_MACHINE?