Hack Forums
[TuT] How to Secure a Hacked / Rented RDP [TuT] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [TuT] How to Secure a Hacked / Rented RDP [TuT] (/showthread.php?tid=3892781)

[TuT] How to Secure a Hacked / Rented RDP [TuT] - NoodleBot™ - Nov 27, 2013


Written By NoodleBot™ on HackForums

Advertisement:
If you are going to be involving yourself with any Keylogger, RAT, stresser, bruteforce or cracker tool, definitely consider some form of protection to cover yourself.
Check out my latest program Absolution, aimed at providing a safer environment and settings that are easy to configure.
[Image: tm6j5Ea.jpg]


For use on Hacked RDP/VPS.

This tutorial goes for Windows XP, Vista, 7, Windows Server 2008/2012, and possibly Windows 8. I have not tested. (You can hide your own accounts as well using this method, useful at school perhaps?)



Step 1




First of all, when you obtain your RDP connection it appears as such:

200.100.20.10 (example IP server)

@daniel ; P@ssw0rd (Example (admin) username followed by password.)

Before logging in, make sure you are ready to move quickly.

After logging in, go to the control panel QUICKLY.

Now quickly create a BRAND NEW ADMINISTRATOR ACCOUNT

Any username and password, this is yours and keep it private.

You will no longer need the details you purchased or hacked after you have set this up.

Step 2

This is where the real hiding happens, and where you are ready to begin covering up your RDP account.
Follow these steps carefully.

Hide User Accounts in windows Vista and Windows 7 + more

Hit the start button, and type "regedit" and hit enter.

[Image: 5voOF.png]

Once in regedit go to

Code
HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon

[Image: 5vpts.jpg]

In the left panel, right click on Winlogon and click New and click Key.

Type SpecialAccounts (if you don't already have this folder visible) and press Enter

In the left panel, right click on SpecialAccounts and click New and click Key.

Type UserList and press Enter.

[Image: 5vpaw.png]

In right panel of UserList, right click on a empty area and click New then click DWORD (32bit) Value.

Type in the name of the user account that you want to hide and press Enter

In the right panel, right click on the user account name and click Modify.

To hide the user account – Type 0 and click OK. (number zero not the letter)

[Image: 5vpdg.png]

You're done. Enjoy your longer lasting RDP!

Remember,
This is only a walkthrough related to the RDP/Windows status itself. You must still use proxies, VPN's and any other applications of your self security to remain as anonymous as possible.

Now that you have your secure RDP admin account, why not consider installing openvpn / VM's?


* - VladHQ - Nov 28, 2013

This is really cool. But I do think that VPS maintainers completely reset the VPS as in deleting everything and reinstalling Windows. Do you think you could do this, with say GoDaddy VPS?

* - NoodleBot™ - Nov 28, 2013

Only if you were to gain access to someone elses paid subscription and then do this.

Then the resetting depends on them extending their license or not.

* - WhiteDm - Apr 14, 2015

thanks,are sure the owner will not notice this for "windows server 2012" because i am sure if they will notice what i will do in above steps they will permanently block my paid RDP account!

* - NoodleBot™ - Apr 14, 2015

Just be quick when doing the steps, as you never know when it's being watched. If you do everything properly you could remain an admin of the RDP for months.

* - WhiteDm - Apr 15, 2015

i will try because i know the admin and support work time maybe this will help me,beside as i mention before they use win serve 2012 maybe its already have updates or somthing prevent thats'!

* - startitit2 - Apr 15, 2015

thank you for sharing. It's so good