diff --git a/TTPs/Persistence/rdp.py b/TTPs/Persistence/rdp.py index c7504d7..7a4eefe 100644 --- a/TTPs/Persistence/rdp.py +++ b/TTPs/Persistence/rdp.py @@ -31,92 +31,117 @@ def source_event_logs(): """ print_info(title, content) -def destination_event_logs(target_ip, open_ports): - title = "Destination Event Logs" - content = ( - f"- **Security Event Log** – `security.evtx`\n" - f" - 4624: Logon Type 10\n" - f" - Source IP/Logon User Name\n" - f" - 4778/4779\n" - f" - IP Address of Source/Source System Name\n" - f" - Logon User Name\n" - f"- `Microsoft-Windows-RemoteDesktopServices-RdpCoreTS%4Operational.evtx`\n" - f" - 131: Connection Attempts (Source IP)\n" - f" - 98: Successful Connections\n" - f"- `Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx`\n" - f" - 1149: Source IP/Logon User Name (Blank user name may indicate Sticky Keys)\n" - f"- `Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx`\n" - f" - 21, 22, 25: Source IP/Logon User Name\n" - f" - 41: Logon User Name" - ) - run_command(title, content, target_ip, open_ports) +def destination_event_logs(): + title = "RDP Destination Event Logs" + content = """ +- **Security Event Log** – `security.evtx` + - `4624` Logon Type 10 + - Source IP/Logon User Name + - `4778/4779` + - IP Address of Source/Source System Name + - Logon User Name +- `Microsoft-Windows-RemoteDesktopServices-RdpCoreTS%4Operational.evtx` + - `131` - Connection Attempts + - Source IP + - `98` - Successful Connections +- `Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx` + - `1149` + - Source IP/Logon User Name + - Blank user name may indicate use of Sticky Keys +- `Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx` + - 21, 22, 25 + - Source IP/Logon User Name + - 41 + - Logon User Name +""" + print_info(title, content) -def source_registry(target_ip, open_ports): - title = "Source Registry" - content = ( - f"- `NTUSER\\Software\\Microsoft\\Terminal Server Client\\Servers`: Remote desktop destinations (per-user)\n" - f"- `ShimCache` – SYSTEM: Tracks `mstsc.exe` (Remote Desktop Client)\n" - f"- `BAM_DAM` – SYSTEM: Last Time Executed (`mstsc.exe`)\n" - f"- `AmCache.hve`: First Time Executed (`mstsc.exe`)\n" - f"- `UserAssist` – `NTUSER.DAT`\n" - f" - Tracks execution of `mstsc.exe` (Remote Desktop Client)\n" - f"- `RecentApps` – `NTUSER.DAT`\n" - f" - Tracks `mstsc.exe` and connection destinations" - ) - run_command(title, content, target_ip, open_ports) -def destination_registry(target_ip, open_ports): - title = "Destination Registry" - content = ( - f"- `ShimCache` - SYSTEM\n" - f" - Tracks `rdpclip.exe` and `tstheme.exe`\n" - f"- `AmCache.hve`: First Time Executed\n" - f" - Tracks `rdpclip.exe` and `tstheme.exe`" - ) - run_command(title, content, target_ip, open_ports) +def source_registry(): + title = "RDP Source Registry" + content = """ +- Remote desktop destinations are tracked per-user + - `NTUSER\\Software\\Microsoft\\Terminal Server Client\\Servers` +- [[ShimCache]] – SYSTEM + - `mstsc.exe` Remote Desktop Client +- [[BAM_DAM]] – SYSTEM – Last Time Executed + - `mstsc.exe` Remote Desktop Client +- [[AmCache.hve]] - First Time Executed + - `mstsc.exe` +- UserAssist – `NTUSER.DAT` + - `mstsc.exe` Remote Desktop Client execution + - Last Time Executed + - Number of Times Executed +- RecentApps – `NTUSER.DAT` + - `mstsc.exe` + - Remote Desktop Client execution + - Last Time Executed + - Number of Times Executed + - RecentItems subkey tracks connection destinations and times +""" + print_info(title, content) -def source_artifacts(target_ip, open_ports): - title = "Source File System Artifacts" - content = ( - f"- Jumplists: `C:\\Users\\\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\`\n" - f" - Tracks remote desktop connection destinations and times\n" - f"- Prefetch: `C:\\Windows\\Prefetch\\`\n" - f" - Tracks execution of `mstsc.exe`\n" - f"- Bitmap Cache: `C:\\Users\\\\AppData\\Local\\Microsoft\\TerminalServer Client\\Cache`\n" - f"- Default.rdp file: `C:\\Users\\\\Documents\\`" - ) - run_command(title, content, target_ip, open_ports) +def destination_registry(): + title = "RDP Destination Registry" + content = """ +- [[ShimCache]] - SYSTEM + - `rdpclip.exe` + - `tstheme.exe` +- [[AmCache.hve]] - First Time Executed + - `rdpclip.exe` + - `tstheme.exe` +""" + print_info(title, content) -def destination_artifacts(target_ip, open_ports): - title = "Destination File System Artifacts" - content = ( - f"- Prefetch: `C:\\Windows\\Prefetch\\`\n" - f" - Tracks execution of `rdpclip.exe` and `tstheme.exe`" - ) - run_command(title, content, target_ip, open_ports) -def extra_info(target_ip, open_ports): - title = "Extra Information" - content = ( - f"- [RDP Authentication vs. Authorization - 13Cubed](https://youtu.be/OlENso8_u7s)\n" - f"- Key Concepts:\n" - f" - RDP_NLA (Network Level Authentication)\n" - f" - RDP_successful_logon event codes\n" - f" - 1149 > 4624 type 10 (established) OR 7 (reconnect) > 21 > 22\n" - f" - Understand authentication failures vs. authorization successes" - ) - run_command(title, content, target_ip, open_ports) +def source_artifacts(): + title = "RDP Source File System Artifacts" + content = """ +- Jumplists - `C:\\Users\\\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\` + - `{MSTSC-APPID}-automaticDestinations-ms` + - Tracks remote desktop connection destination and times +- [[Prefetch]] – `C:\\Windows\\Prefetch\\` + - `mstsc.exe-{hash}.pf` +- [[Bitmap_Cache]] – `C:\\Users\\\\AppData\\Local\\Microsoft\\TerminalServer Client\\Cache` + - bcache##.bmc + - cache####.bin +- Default.rdp file – + - `C:\\Users\\\\Documents\\` +""" + print_info(title, content) -def run_all_rdp_checks(target_ip, open_ports): - title = "Run All RDP Checks" - content = "Executing all RDP persistence checks. Please wait..." - run_command(title, content, target_ip, open_ports) - # Sequentially run all functions - source_event_logs(target_ip, open_ports) - destination_event_logs(target_ip, open_ports) - source_registry(target_ip, open_ports) - destination_registry(target_ip, open_ports) - source_artifacts(target_ip, open_ports) - destination_artifacts(target_ip, open_ports) - extra_info(target_ip, open_ports) +def destination_artifacts(): + title = "RDP Destination File System Artifacts" + content = """ +- Prefetch – `C:\\Windows\\Prefetch\\` +- `rdpclip.exe-{hash}.pf` +- `tstheme.exe-{hash}.pf` +""" + print_info(title, content) + + +def extra_rdp_info(): + title = "RDP Extra Information" + content = """ +# RDP Authentication vs. Authorization +- RDP authentication happens prior to session establishment (NLA). +- Know when authentication can fail and authorization can succeed. + +# RDP Event Flow +1149 > 4624 (type 10) OR 7 (reconnect) > 21 > 22 +- 1149: Authentication succeeded +- 4624: Account successfully logged on +- 21: Session logon succeeded +- 22: Shell start notification received +""" + print_info(title, content) + +def all_rdp_info(): + source_event_logs() + destination_event_logs() + source_registry() + destination_registry() + source_artifacts() + destination_artifacts() + extra_rdp_info() \ No newline at end of file