HN Explorer

16 comments

[ 4.7 ms ] story [ 13.7 ms ] thread
dijit
Probably a stupid question, but if it’s pure power shell, would it work on Linux? I suspect not since it will likely use a lot of .net stuff but I’d be happy if I was wrong.
feldrim
Looking at the code, it utilizes Windows DLLs to implement RDP based connection. So the server is purely Windows only.

But if you have xrdp[0] server on any Linux device, the client might be useful to connect to it. But the client must be Windows in this scenario too.

[0] http://xrdp.org/

TYMorningCoffee
As far as I can tell, those dlls are only for getting the resolution in :

``` function Get-ResolutionScaleFactor { <# .SYNOPSIS Return the scale factor of target screen to capture. #>

        $hdc = [W.User32]::GetDC(0)
        try
        {
            return [W.GDI32]::GetDeviceCaps($hdc, 117) / [W.GDI32]::GetDeviceCaps($hdc, 10)
        }
        finally
        {
            [W.User32]::ReleaseDC(0, $hdc) | Out-Null
        }        
    }
``` https://github.com/DarkCoderSc/PowerRemoteDesktop/blob/main/...
feldrim
Everything in that code is Windows bound: Graphics, certificate creation and storing, etc. The use either Windows interop using DLLs or creating COM objects.

It is possible to a cross platform or at least a Linux version, but it's not this one.

TYMorningCoffee
Does the Linux powershell support `[System.Windows.Forms.Screen]::PrimaryScreen `? If so, I think the screen share will probably work. I'm not sure about the remote control.

``` $primaryDesktop = [System.Windows.Forms.Screen]::PrimaryScreen

            $size = New-Object System.Drawing.Size(
                ($primaryDesktop.Bounds.Size.Width * $ScaleFactor),
                ($primaryDesktop.Bounds.Size.Height * $ScaleFactor)
            )

            $location = New-Object System.Drawing.Point(
                ($primaryDesktop.Bounds.Location.X * $ScaleFactor),
                ($primaryDesktop.Bounds.Location.Y * $ScaleFactor)
            )

            $bitmap = New-Object System.Drawing.Bitmap($size.Width, $size.Height)
            $graphics = [System.Drawing.Graphics]::FromImage($bitmap)
                        
            $graphics.CopyFromScreen($location, [System.Drawing.Point]::Empty, $size)
            
            return $bitmap
``` https://github.com/DarkCoderSc/PowerRemoteDesktop/blob/main/...
ronsor
For added context, this is made by the same person who created the infamous DarkComet RAT.
fariss
I wonder if this will be abused by malware authors in some way.
feldrim
Not "if", but "when".
AnIdiotOnTheNet
Eh, why bother? This is basically just a pure-PowerShell VNC-like as far as I can tell. If an attacker wants that a reverse VNC shellcode is readily available and small.
feldrim
First of all, it's not a VNC protocol implementation but RDP. Second, it's PowerShell so it's easy to use as a payload in any exploitation tool, e.g. Metasploit, Cobalt Strike and such. If you have information about RDP, you have probably heard it's the first stop when you want to exploit any Windows device. If it doesn't work, you go for SMB, etc. So yes, it's valuable in that sense.
AnIdiotOnTheNet
It doesn't appear to be RDP. All this seems to be doing is taking screenshots of the Desktop, which is similar to how VNC works. RDP is a vastly more complicated protocol.

Last I checked the reverse VNC shellcode was literally part of the Metasploit suite, so not really any easier there either.

mixtur2021
Browsing the code, this looks like it is sending full screen JPEGs. Maybe someone can correct me, but I think RDP can be more sophisticated and send only the areas of the screen which has changed? From collection, they used to hook the GDI stack directly? This is why RDP has/had a better reputation than VNC for responsiveness. Maybe this server is working in the base case with no optimization?
pjmlp
Modern proper RDP uses the DirectX stack.

No idea about low level details, but it does perform much better than X Windows ever did.