#remoteapp

RDP hijacking — how to hijack RDS and RemoteApp sessions transparently to move through an organisation

( Original text by Kevin Beaumont )

How you can very easily use Remote Desktop Services to gain lateral movement through a network, using no external software — and how to defend against it.

Alexander Korznikov demonstrates using Sticky Keys and tscon to access an administrator RDP session — without even logging into the server. Brief background on RDP session connection

If you’ve…

https://www.solutionssquad.com/blog/deploy-azure-remoteapp-with-vnet-using-powershell/?utm_source=TR&utm_medium=POSTID11698&utm_campaign=BLOG

Deploy Azure RemoteApp with VNET using PowerShell

https://www.solutionssquad.com/blog/using-remoteapp-with-azure-ad-domain-services/?utm_source=TR&utm_medium=POSTID11586&utm_campaign=BLOG

Using RemoteApp with Azure AD Domain Services

In this entry I’m going to describe how to remotely open an application for multiple computers on the same local network. In order to do this you will need to utilize a few different tools called SSH Pass and SSH Sudo. This is specifically for Mac OSX. To do this for windows it is a much more difficult approach using Powershell (as far as I know).

Install SSH Pass: This is required in order to utilize SSH Sudo which is the main script you will need in order for this to work. So go ahead and open up terminal and type the following:

(note: You will need Homebrew for Mac OSX)

brew install https://raw.githubusercontent.com/kadwanev/bigboybrew/master/Library/Formula/sshpass.rb

Download SSH Sudo: This is the main tool that will allow us to send a command, enter our password once, then have that command automate without having to enter the password again on multiple computers on the same network. Note: For each computer you want to run a command remotely on, they will require the same username and password for this script to execute. I will go through that setup later in this entry.

You'll first need to download the sshsudo script.

Now, place this somewhere accessible. Example:

~/Desktop/ShellScripts/sshsudo

Now that you have downloaded the file you need to make the script executable by running the following command in terminal. chmod +x ~/Desktop/ShellScripts/sshsudo

3.Setup Computers: As I said previously, we will only be using Apple computers for this so that is what I will be describing.

Go to System Preferences >> Users and Accounts.

Unlock to make changes using your admin credentials.

Click on the + sign to add a new user.

It is very important that all your computers have the same username and password, also they should all have admin access, which is just a check box when creating a new user.

Now that you have created a new user open System Preferences >> Network and write down your IP address. You'll need this to access the computer later.

Make sure every computer you set up is connected to the same Wifi or LAN network.

Place an application or file on your ~/Desktop/SomeFileToTest.app

4.Run Terminal Commands across Multiple Computers: Now that you have installed SSHPass, SSHSudo, and set up all your computers on the same network with the same usernames and passwords it's time to run a command across all of them with ease. Do the following:

Create a file within the directory of your sshsudo file. Open up terminal and do the following: cd ~/Desktop/ShellScripts/ touch myAppRunner chmod u+x myAppRunner

Now you should have a file in the directory that you can run. If you double click on myAppRunner nothing will happen because we need to give it some code to work with. Open myAppRunner in a text editor like Sublime Text or Xcode.

Enter the following code in myAppRunner and click save. #!/bin/sh IP[0]=192.168.1.1 # Computer 1 IP[1]=192.168.1.2 # Computer 2 IP[2]=192.168.1.3 # Computer 3 ~/Desktop/ShellScripts/sshsudo -u myUsername ${IP[0]},${IP[1]},${IP[2]} open ./Desktop/SomeFileToTest.app

Now that you have entered and saved the previous code to your myAppRunner file you can go into terminal within the same directory as myAppRunner and type the following:

open myAppRunner

https://www.solutionssquad.com/blog/publishing-azure-remoteapp-programs-to-selected-users/?utm_source=TR&utm_medium=POSTID11215&utm_campaign=BLOG

Publishing Azure RemoteApp Programs to Selected Users