SharpRDPThief - GitLite

KO | EN

gitlite — search

#python #react #ai #rust #deep-learning #docker #java #kubernetes #vue #pytorch #security #ios #openai #open-source

SharpRDPThief

(★ 167)

A C# implementation of RDPThief to steal credentials from RDP.

File Explorer

Download Latest Version (.zip)

- - .signature.p7s
  - EasyHook.2.7.6035.nupkg
- - AssemblyInfo.cs
- EasyHook32.dll
- EasyHook32Svc.exe
- EasyHook64.dll
- EasyHook64Svc.exe
- EasyLoad32.dll
- EasyLoad64.dll
- InjectionEntryPoint.cs
- packages.config
- RDPHook.csproj
- ServerInterface.cs
- - AssemblyInfo.cs
- App.config
- EasyHook32.dll
- EasyHook32Svc.exe
- EasyHook64.dll
- EasyHook64Svc.exe
- EasyLoad32.dll
- EasyLoad64.dll
- FodyWeavers.xml
- FodyWeavers.xsd
- packages.config
- Program.cs
- SharpRDPThief.csproj
README.md
SharpRDPThief.sln

# Installation Guide

1. Get the code

git clone https://github.com/passthehashbrowns/SharpRDPThief

Downloads the entire project code from GitHub to your computer.

cd SharpRDPThief

Moves into the project folder you just downloaded.

2. .NET

Medium Recommended

Prerequisites

Git Needed to download the project code from GitHub.
.NET SDK The SDK required for the dotnet command.

cd RDPHook

This project's files live in a subfolder, so move into it first.

dotnet restore

Downloads the packages the project depends on.

dotnet run

Builds the project and runs it immediately.

✅ After dotnet run, check the message or address shown in the terminal.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# SharpRDPThief
SharpRDPThief is a C# implementation of RDPThief. It uses EasyHook to inject a DLL into mstsc.exe, which will then hook the CryptProtectMemory api call. The hook will grab the password from the address passed to CryptProtectMemory and then send it to the main process through EasyHook's IPC server.

Currently this is only a proof of concept implementation and requires RDPHook.dll to be in the same directory as SharpRDPThief.exe. The immediate plan is to allow for completely in memory execution, for use with tools like Cobalt Strike's execute-assembly.

You can read more about the original research from @0x09AL here: https://www.mdsec.co.uk/2019/11/rdpthief-extracting-clear-text-credentials-from-remote-desktop-clients/

![Proof of concept screenshot](https://pbs.twimg.com/media/EgUZZQVXYAEGMAw?format=png&name=large)

## TODO
Completely in-memory execution

Better parsing of memory for username/password

[Done] ~~Search for mstsc.exe processes and inject into them automatically.~~

## References
RDPThief: https://github.com/0x09AL/RdpThief

EasyHook FileMonitor: https://github.com/EasyHook/EasyHook-Tutorials/tree/master/Managed/RemoteFileMonitor

EasyHook remote process hook tutorial: https://easyhook.github.io/tutorials/remotefilemonitor.html