4 ms·

Remote Desktop Coded in PowerShell

23 points by ithkuil 5y ago

dijit 5y ago
Probably a stupid question, but if it’s pure power shell, would it work on Linux? I suspect not since it will likely use a lot of .net stuff but I’d be happy if I was wrong.
- feldrim 5y ago
  Looking at the code, it utilizes Windows DLLs to implement RDP based connection. So the server is purely Windows only. But if you have xrdp[0] server on any Linux device, the client might be useful to connect to it. But the client must be Windows in this scenario too. [0] http://xrdp.org/ http://xrdp.org/
  - TYMorningCoffee 5y ago
    As far as I can tell, those dlls are only for getting the resolution in : ``` function Get-ResolutionScaleFactor { <# .SYNOPSIS Return the scale factor of target screen to capture. #> $hdc = [W.User32]::GetDC(0) try { return [W.GDI32]::GetDeviceCaps($hdc, 117) / [W.GDI32]::GetDeviceCaps($hdc, 10) } finally { [W.User32]::ReleaseDC(0, $hdc) | Out-Null } } ``` https://github.com/DarkCoderSc/PowerRemoteDesktop/blob/main/PowerRemoteDesktop_Server/PowerRemoteDesktop_Server.ps1#L822 https://github.com/DarkCoderSc/PowerRemoteDesktop/blob/main/...
    - feldrim 5y ago
      Everything in that code is Windows bound: Graphics, certificate creation and storing, etc. The use either Windows interop using DLLs or creating COM objects. It is possible to a cross platform or at least a Linux version, but it's not this one.
- TYMorningCoffee 5y ago
  Does the Linux powershell support `[System.Windows.Forms.Screen]::PrimaryScreen `? If so, I think the screen share will probably work. I'm not sure about the remote control. ``` $primaryDesktop = [System.Windows.Forms.Screen]::PrimaryScreen $size = New-Object System.Drawing.Size( ($primaryDesktop.Bounds.Size.Width * $ScaleFactor), ($primaryDesktop.Bounds.Size.Height * $ScaleFactor) ) $location = New-Object System.Drawing.Point( ($primaryDesktop.Bounds.Location.X * $ScaleFactor), ($primaryDesktop.Bounds.Location.Y * $ScaleFactor) ) $bitmap = New-Object System.Drawing.Bitmap($size.Width, $size.Height) $graphics = [System.Drawing.Graphics]::FromImage($bitmap) $graphics.CopyFromScreen($location, [System.Drawing.Point]::Empty, $size) return $bitmap ``` https://github.com/DarkCoderSc/PowerRemoteDesktop/blob/main/PowerRemoteDesktop_Server/PowerRemoteDesktop_Server.ps1 https://github.com/DarkCoderSc/PowerRemoteDesktop/blob/main/...
ronsor 5y ago
For added context, this is made by the same person who created the infamous DarkComet RAT.
fariss 5y ago
I wonder if this will be abused by malware authors in some way.
- feldrim 5y ago
  Not "if", but "when".
  - AnIdiotOnTheNet 5y ago
    Eh, why bother? This is basically just a pure-PowerShell VNC-like as far as I can tell. If an attacker wants that a reverse VNC shellcode is readily available and small.
    - feldrim 5y ago
      First of all, it's not a VNC protocol implementation but RDP. Second, it's PowerShell so it's easy to use as a payload in any exploitation tool, e.g. Metasploit, Cobalt Strike and such. If you have information about RDP, you have probably heard it's the first stop when you want to exploit any Windows device. If it doesn't work, you go for SMB, etc. So yes, it's valuable in that sense.
      - AnIdiotOnTheNet 5y ago
        It doesn't appear to be RDP. All this seems to be doing is taking screenshots of the Desktop, which is similar to how VNC works. RDP is a vastly more complicated protocol. Last I checked the reverse VNC shellcode was literally part of the Metasploit suite, so not really any easier there either.
mixtur2021 5y ago
Browsing the code, this looks like it is sending full screen JPEGs. Maybe someone can correct me, but I think RDP can be more sophisticated and send only the areas of the screen which has changed? From collection, they used to hook the GDI stack directly? This is why RDP has/had a better reputation than VNC for responsiveness. Maybe this server is working in the base case with no optimization?
- pjmlp 5y ago
  Modern proper RDP uses the DirectX stack. No idea about low level details, but it does perform much better than X Windows ever did.
- vb6sp6 5y ago
- viraptor 5y ago
  It's in the to-do list to improve the updates handling. Also it's even worse now - the whole content is base64'd https://github.com/DarkCoderSc/PowerRemoteDesktop/blob/main/PowerRemoteDesktop_Server/PowerRemoteDesktop_Server.ps1#L936 https://github.com/DarkCoderSc/PowerRemoteDesktop/blob/main/...
  - spl33n 5y ago
    Check out the dev branch, the Raw Bytes support was just added: https://github.com/DarkCoderSc/PowerRemoteDesktop/tree/dev https://github.com/DarkCoderSc/PowerRemoteDesktop/tree/dev It still optionally support Base64 tho.

23 points by ithkuil 5y ago

Probably a stupid question, but if it’s pure power shell, would it work on Linux? I suspect not since it will likely use a lot of .net stuff but I’d be happy if I was wrong.

feldrim 5y ago
Looking at the code, it utilizes Windows DLLs to implement RDP based connection. So the server is purely Windows only. But if you have xrdp[0] server on any Linux device, the client might be useful to connect to it. But the client must be Windows in this scenario too. [0] http://xrdp.org/ http://xrdp.org/
- TYMorningCoffee 5y ago
  As far as I can tell, those dlls are only for getting the resolution in : ``` function Get-ResolutionScaleFactor { <# .SYNOPSIS Return the scale factor of target screen to capture. #> $hdc = [W.User32]::GetDC(0) try { return [W.GDI32]::GetDeviceCaps($hdc, 117) / [W.GDI32]::GetDeviceCaps($hdc, 10) } finally { [W.User32]::ReleaseDC(0, $hdc) | Out-Null } } ``` https://github.com/DarkCoderSc/PowerRemoteDesktop/blob/main/PowerRemoteDesktop_Server/PowerRemoteDesktop_Server.ps1#L822 https://github.com/DarkCoderSc/PowerRemoteDesktop/blob/main/...
  - feldrim 5y ago
    Everything in that code is Windows bound: Graphics, certificate creation and storing, etc. The use either Windows interop using DLLs or creating COM objects. It is possible to a cross platform or at least a Linux version, but it's not this one.
TYMorningCoffee 5y ago
Does the Linux powershell support `[System.Windows.Forms.Screen]::PrimaryScreen `? If so, I think the screen share will probably work. I'm not sure about the remote control. ``` $primaryDesktop = [System.Windows.Forms.Screen]::PrimaryScreen $size = New-Object System.Drawing.Size( ($primaryDesktop.Bounds.Size.Width * $ScaleFactor), ($primaryDesktop.Bounds.Size.Height * $ScaleFactor) ) $location = New-Object System.Drawing.Point( ($primaryDesktop.Bounds.Location.X * $ScaleFactor), ($primaryDesktop.Bounds.Location.Y * $ScaleFactor) ) $bitmap = New-Object System.Drawing.Bitmap($size.Width, $size.Height) $graphics = [System.Drawing.Graphics]::FromImage($bitmap) $graphics.CopyFromScreen($location, [System.Drawing.Point]::Empty, $size) return $bitmap ``` https://github.com/DarkCoderSc/PowerRemoteDesktop/blob/main/PowerRemoteDesktop_Server/PowerRemoteDesktop_Server.ps1 https://github.com/DarkCoderSc/PowerRemoteDesktop/blob/main/...

ronsor 5y ago

For added context, this is made by the same person who created the infamous DarkComet RAT.

fariss 5y ago

I wonder if this will be abused by malware authors in some way.

feldrim 5y ago
Not "if", but "when".
- AnIdiotOnTheNet 5y ago
  Eh, why bother? This is basically just a pure-PowerShell VNC-like as far as I can tell. If an attacker wants that a reverse VNC shellcode is readily available and small.
  - feldrim 5y ago
    First of all, it's not a VNC protocol implementation but RDP. Second, it's PowerShell so it's easy to use as a payload in any exploitation tool, e.g. Metasploit, Cobalt Strike and such. If you have information about RDP, you have probably heard it's the first stop when you want to exploit any Windows device. If it doesn't work, you go for SMB, etc. So yes, it's valuable in that sense.
    - AnIdiotOnTheNet 5y ago
      It doesn't appear to be RDP. All this seems to be doing is taking screenshots of the Desktop, which is similar to how VNC works. RDP is a vastly more complicated protocol. Last I checked the reverse VNC shellcode was literally part of the Metasploit suite, so not really any easier there either.

mixtur2021 5y ago

Browsing the code, this looks like it is sending full screen JPEGs. Maybe someone can correct me, but I think RDP can be more sophisticated and send only the areas of the screen which has changed? From collection, they used to hook the GDI stack directly? This is why RDP has/had a better reputation than VNC for responsiveness. Maybe this server is working in the base case with no optimization?

pjmlp 5y ago
Modern proper RDP uses the DirectX stack. No idea about low level details, but it does perform much better than X Windows ever did.
vb6sp6 5y ago
viraptor 5y ago
It's in the to-do list to improve the updates handling. Also it's even worse now - the whole content is base64'd https://github.com/DarkCoderSc/PowerRemoteDesktop/blob/main/PowerRemoteDesktop_Server/PowerRemoteDesktop_Server.ps1#L936 https://github.com/DarkCoderSc/PowerRemoteDesktop/blob/main/...
- spl33n 5y ago
  Check out the dev branch, the Raw Bytes support was just added: https://github.com/DarkCoderSc/PowerRemoteDesktop/tree/dev https://github.com/DarkCoderSc/PowerRemoteDesktop/tree/dev It still optionally support Base64 tho.