[Nurox2019]

Hi Guys,

Great forum, long time lurker been in and out but finally decided to spend some more time on here and learn from the community :)

This probably is a noobish question but say if I reverse shelled into a victim's computer, how would I proceed to set it up for RDP access?

As in create a new user on the device, and use simultaneously while the victim is logged in. Is this possible or is that why servers are targetted more because multiple people can be signed in simultaneously?

Thanks, guys.

[lesstech]

Hi Guys,

Great forum, long time lurker been in and out but finally decided to spend some more time on here and learn from the community :)

This probably is a noobish question but say if I reverse shelled into a victim's computer, how would I proceed to set it up for RDP access?

As in create a new user on the device, and use simultaneously while the victim is logged in. Is this possible or is that why servers are targetted more because multiple people can be signed in simultaneously?

Thanks, guys.

This can be accomplished in RAT's pretty often.

[SIM-4294714]

This can be accomplished in RAT's pretty often.

RATs are a sloppy and obvious trick that peaked in 2000ish. If you're using someone elses, it's gonna get flagged by AV - and if you're writing your own, you're better off just using a dedicated payload to add an RDP-capable user. Or, better still, just modify the shellcode of the exploit you're using.

[lesstech]

Obvious trick

Obvious trick how ? Of course that is why crypters exist.

[Nurox2019]

RATs are a sloppy and obvious trick that peaked in 2000ish. If you're using someone elses, it's gonna get flagged by AV - and if you're writing your own, you're better off just using a dedicated payload to add an RDP-capable user. Or, better still, just modify the shellcode of the exploit you're using.

Yeah I'm planning on writing my own. May I know the difference between a reverse TCP shell and a RAT?

As for the AV detection, isn't it just bypassed with a different signature?

[SIM-4294714]

Yeah I'm planning on writing my own. May I know the difference between a reverse TCP shell and a RAT?

As for the AV detection, isn't it just bypassed with a different signature?

Depends on the AV, most use behavior analysis too these days.
A reverse shell is just like a remote command prompt, a RAT has other features (that are usually noticed by AV)

---

Obvious trick how ? Of course that is why crypters exist.

Obvious in that they require leaving a payload on the targets hard disk, which is a tell-tale sign of a compromise. Crypters too - hell, most crypters I've tested increase a payloads AV hit rate.

[Nurox2019]

Depends on the AV, most use behavior analysis too these days.
A reverse shell is just like a remote command prompt, a RAT has other features (that are usually noticed by AV)

---

Obvious in that they require leaving a payload on the targets hard disk, which is a tell-tale sign of a compromise. Crypters too - hell, most crypters I've tested increase a payloads AV hit rate.

Thanks for that, makes sense, do you mind also explaining what a FUD (and what it stands for haha) is, as in the association with an FUD and crypter. Thanks for the help sorry for the noobish questions.

[SIM-4294714]

Thanks for that, makes sense, do you mind also explaining what a FUD (and what it stands for haha) is, as in the association with an FUD and crypter. Thanks for the help sorry for the noobish questions.

Hey, we were all noobs once. So long as someone's willing to learn, I don't look down on em for not knowing.

FUD stands for two things - normally it means Fear, Uncertainty, and Doubt - but in malware development, it means Fully Undetectable. It has a 0% AV hit rate, it's stealthy, and it gets the job done without arousing suspicion. It's very hard to do nowadays, but it can be done if you've got the skills.

[bexpr9]

Please try follow tunnel mode.
    victim rdp port <----------- tunnel payload on victim pc --------->  your server <----------- your pc : 8888 (port open) <---------- RDP client.
If you is interesting this tunnel scenario, I'll explain detail in technology.