‫The Enable RTP module under the managed group enables the remote desktop service RTP.
‫It provides the options to create an account and configure it to be a member of the local administrators
‫and Remote Desktop Users Group.
‫It can also forward the Target Port 389 DCP.
‫The module makes the value of the left and its connections registry key.
‫One.
‫Plus, if it's closed, the module opens the port, which is going to be used by RTP.
‫So in this demo, we have a Windows eight as a victim with the IP address two, two three.
‫And here is the attacker calling.
‫Now, let's start MSF console and open an interpreter session first.
‫We've done it several times and the subject of this demo is not exploiting, so I'll just open the session
‫as far as I can.
‫OK, I have interpreter session on Windows eight now.
‫First, I want to know whether the remote desktop connection is allowed on the victim or not.
‫I can learn it by looking at the value of the EFT, deny its connections registry key.
‫Thankfully, I have a reg command interpreter who let's create the appropriate reg command and look
‫at the key.
‫Reg, is the command itself query Val parameter is our intention.
‫We just want to query the value.
‫Now is the key path with K Parameter H HKEYLOCALMACHINE System CurrentControlSet.
‫Control terminal server.
‫And now the value with the V parameter f deny PTS connections.
‫And here is a result.
‫The data of the value is one, which means the remote desktop connection is not allowed on the vector
‫machine at this time.
‫So let's go to the Windows eight system to check the configuration of the remote desktop.
‫I want to verify our finding.
‫So in the Start menu, I'll search for the remote word.
‫Select settings from the results I say like allow remote access to your computer.
‫Now we are under the remote tab of system properties.
‫As you can see in the remote desktop frame, remote connections to this computer is not allowed.
‫So our finding is correct.
‫But now let's enable remote desktop connection on the victim.
‫We can run the post module directly under the interpreter session using the run command type, run post
‫windows, manage, enable, RDP and hit enter.
‫And it's finished to learn if it succeeded.
‫I'd like to query the denied T-S connections again.
‫Now remember, you can call the previous commands by using the Arrow keys.
‫And yes, the data of the value is zero now.
‫That means remote desktop is no longer denied.
‫So once again, I will want to double check it with our victim.
‫And again, I search for remote in the start menu.
‫Select settings and select Allow Remote Access to your computer.
‫And here it is.
‫As you see, the remote connection is allowed now.
‫We succeeded to enable RDP.
‫Well done.
‫But I am not comfortable unless I see the result with my own eyes.
‫I just want to make a remote connection to the victim.
‫So now I'm on my host system, which is a Mac now to be able to make a remote connection.
‫I'll go to the App Store to download Microsoft Remote Desktop.
‫I found it.
‫And it looks like it is installing.
‫When the installation is finished.
‫I'll open the app.
‫Now I click new and create a new remote connection IP address of the Windows eight machine is two to
‫three.
‫I'll assume that we already know a valid username, password, pair.
‫And I'll leave the other setting with the default values.
‫Now, I'll double click the connection set up.
‫OK.
‫I verify the certificate and continue.
‫And that's done, we have a remote desktop connection to the Windows eight machine.
‫We enabled the remote connection and connected the module is working like a charm.
‫Now I want to show you something more.
‫Let's go back to the victim system, the Windows eight p.m..
‫Now, have a look at this when we connect remotely, the current user is logged out because parallel
‫sessions are restricted by default.
‫So if you don't want to tip off the user of the Viking machine, you'd better carry out the remote desktop
‫connection when he or she is away.
‫So to understand if the user of the computer is away or not, that's when we can use the idle time interpreter
‫command before the remote connection.
‫If the system is idle for a long time, then it's probably safe to assume that the user is away.
‫Well, in fact, there is a way to have parallel sessions on Windows systems.
‫So let's have a look.
‫The current is not logged out when you connect remotely to the system.
‫I'll just show you the method now and you can try for yourself later.
‫So what I do is I'll open the Web browser and Google for enable parallel sessions in Windows eight.
‫And click the first link.
‫How to enable concurrent sessions explained here.
‫Now, briefly, you should change the terms Arviat deal with an appropriate one.
‫And add the f single session per user value and set it to zero.
‫I have to warn you here, though, do not download and use any file unless you trust the website 100
‫percent.
‫So if I were you, I wouldn't download the modified DLL file from this site because I just don't know
‫the user's.