3 ms·
Windows displays a "Welcome" screen with all user accounts listed when you connect via RDP. I don't know how to automate enumeration, though. Perhaps scraping a
by peterwwillis 11y ago
Windows displays a "Welcome" screen with all user accounts listed when you connect via RDP. I don't know how to automate enumeration, though. Perhaps scraping a screenshot after connecting and then OCRing the usernames.
- hamburglar 11y agoIt might be even easier than that, since RDP remotes the screen at the GDI level, so if you're looking at the protocol, you'll see a regular pattern of DrawText calls.
- voltagex_ 11y agoOut of interest, is there something like a Wireshark dissector that'd show this level of detail?
- yuhong 11y agoIt is encrypted I think.
- hamburglar 11y agoyuhong is correct: RDP rides inside a TLS connection (if I recall, pre-Vista didn't use TLS but there was some other encryption scheme). I'm not sure how much work it would be to sniff/log session keys and display the decrypted traffic in a nice format. I've never seen a tool for it. I'd be surprised if Microsoft doesn't have at least some netmon.exe tooling for it but it may not be released.
- peterwwillis 11y agoThere is a dissector, but no, it doesn't show this level of detail.