‫The enable RTP module under the managed group enables the remote desktop service RTP, it provides the
‫options to create an account and configure it to be a member of the local administrators and remote
‫desktop users group.
‫It can also forward the target's port 389 DCP.
‫The module makes the value of the F tonight's Connections Registry key one.
‫Plus, if it's closed, the module opens the port, which is going to be used by RTP.
‫So in this demo, we have a Windows eight is a victim with the IP address, two to three, and here's
‫the attacker, Colly.
‫Now, let's start MSF console and open an interpreter session first.
‫We've done it several times and the subject of this demo is not exploiting, so I'll just open the session
‫as fast as I can.
‫OK, I have interpretor session on Windows eight now.
‫First, I want to know whether the remote desktop connection is allowed on the victim or not, I can
‫learn it by looking at the value of the F Dinni T.
‫S connections register key.
‫Thankfully, I have a Regg command and interpreter, let's create the appropriate Regg command and look
‫at the key.
‫Reg is the command itself, query val parameter is our intention.
‫We just want to query the value.
‫Now is the key path with K parameter, each key local machine system, current control set.
‫Control terminal server.
‫And now the value with the V parameter F deny it's Connexions.
‫And here is a ResultSet, the data of the value is one, which means the remote desktop connection is
‫not allowed on the machine at this time.
‫So let's go to the Windows eight system to check the configuration of the remote desktop, I want to
‫verify our finding.
‫So in the start menu, I'll search for the remote word select settings from the results I select, allow
‫remote access to your computer.
‫Now we are under the remote tab of system properties.
‫As you can see in the remote desktop frame, remote connections to this computer is not allowed.
‫So our finding is correct.
‫But now let's enable remote desktop connection on the victim.
‫We can run the post module directly under the maternity section using the run command, I run post windows,
‫manage, enable our DP and hit enter.
‫And it's finished to learn if it succeeded.
‫I'd like to query the F denied its connections again.
‫Now remember, you can call the previous commands by using the Arrow Keys.
‫And yes, the data of the value is zero now.
‫That means remote desktop is no longer denied.
‫So once again, I will want to double check it with our victim.
‫And again, I search for remote in the start menu, select settings and select allow remote access to
‫your computer.
‫And here it is.
‫As you see, the remote connection is allowed.
‫Now, we succeeded to enable our DP.
‫Well done.
‫But I am not comfortable unless I see the result with my own eyes.
‫I just want to make a remote connection to the victim.
‫So now I'm on my whole system, which is a matter now to be able to make a remote connection, I'll
‫go to the App Store to download Microsoft remote desktop.
‫And it looks like it's installing.
‫When the insulation is finished.
‫I'll open the app.
‫Now I click new and create a new remote connection IP address of the Windows eight machine is two to
‫three.
‫I'll assume that we already know a valid username password Perre.
‫And I'll leave the other setting with the default values.
‫Now, I'll double click the connection set up.
‫OK, I verify this certificate and continue.
‫And that's done, we have a remote desktop connection to the Windows eight machine.
‫We enabled the remote connection and connected the module is working like a charm.
‫Now, I want to show you something more.
‫Let's go back to the victim system that Windows eight VM.
‫Now, have a look at this, when we connect remotely, the current user is logged out because parallel
‫sessions are restricted by default.
‫So if you don't want to tip off the user of the victim machine, you'd better carry out the remote desktop
‫connection when he or she is away.
‫So to understand if the user of the computer is away or not, that's when we can use the idle time interpreter
‫command before the remote connection.
‫If the system is idle for a long time and it's probably safe to assume that the user is away.
‫Well, in fact, there is a way to have parallel sessions on Windows systems, so let's have a look
‫at the current users not logged out when you connect remotely to the system.
‫I'll just show you the method now and you can try it for yourself later.
‫So what I do is I'll open the Web browser and Google for enable parallel sessions and when Windows eight.
‫And click the first link.
‫How do enable concurrent sessions explained here now briefly, you should change the terms RV deal with
‫an appropriate one.
‫And add the F single session per user value and set it to zero.
‫I have to warn you here, though, do not download and use any file unless you trust the website 100
‫percent.
‫So if I were you, I wouldn't download the modified DSL file from this site because I just don't know
‫the user's.