Remote Desktop Coded in PowerShell | Hacker News Reader

Remote Desktop Coded in PowerShell

github.com

23 pointsithkuil15 comments

I wonder if this will be abused by malware authors in some way.

Not "if", but "when".

Eh, why bother? This is basically just a pure-PowerShell VNC-like as far as I can tell. If an attacker wants that a reverse VNC shellcode is readily available and small.

First of all, it's not a VNC protocol implementation but RDP. Second, it's PowerShell so it's easy to use as a payload in any exploitation tool, e.g. Metasploit, Cobalt Strike and such. If you have information about RDP, you have probably heard it's the first stop when you want to exploit any Windows device. If it doesn't work, you go for SMB, etc. So yes, it's valuable in that sense.

It doesn't appear to be RDP. All this seems to be doing is taking screenshots of the Desktop, which is similar to how VNC works. RDP is a vastly more complicated protocol.

Last I checked the reverse VNC shellcode was literally part of the Metasploit suite, so not really any easier there either.

Browsing the code, this looks like it is sending full screen JPEGs. Maybe someone can correct me, but I think RDP can be more sophisticated and send only the areas of the screen which has changed? From collection, they used to hook the GDI stack directly? This is why RDP has/had a better reputation than VNC for responsiveness. Maybe this server is working in the base case with no optimization?

Modern proper RDP uses the DirectX stack.

No idea about low level details, but it does perform much better than X Windows ever did.

It's in the to-do list to improve the updates handling. Also it's even worse now - the whole content is base64'd https://github.com/DarkCoderSc/PowerRemoteDesktop/blob/main/...

Check out the dev branch, the Raw Bytes support was just added: https://github.com/DarkCoderSc/PowerRemoteDesktop/tree/dev It still optionally support Base64 tho.

For added context, this is made by the same person who created the infamous DarkComet RAT.

Probably a stupid question, but if it’s pure power shell, would it work on Linux? I suspect not since it will likely use a lot of .net stuff but I’d be happy if I was wrong.

Looking at the code, it utilizes Windows DLLs to implement RDP based connection. So the server is purely Windows only.

But if you have xrdp[0] server on any Linux device, the client might be useful to connect to it. But the client must be Windows in this scenario too.

[0] http://xrdp.org/

As far as I can tell, those dlls are only for getting the resolution in :

``` function Get-ResolutionScaleFactor { <# .SYNOPSIS Return the scale factor of target screen to capture. #>

        $hdc = [W.User32]::GetDC(0)
        try
        {
            return [W.GDI32]::GetDeviceCaps($hdc, 117) / [W.GDI32]::GetDeviceCaps($hdc, 10)
        }
        finally
        {
            [W.User32]::ReleaseDC(0, $hdc) | Out-Null
        }        
    }

``` https://github.com/DarkCoderSc/PowerRemoteDesktop/blob/main/...

Everything in that code is Windows bound: Graphics, certificate creation and storing, etc. The use either Windows interop using DLLs or creating COM objects.

It is possible to a cross platform or at least a Linux version, but it's not this one.

Does the Linux powershell support `[System.Windows.Forms.Screen]::PrimaryScreen `? If so, I think the screen share will probably work. I'm not sure about the remote control.

``` $primaryDesktop = [System.Windows.Forms.Screen]::PrimaryScreen

            $size = New-Object System.Drawing.Size(
                ($primaryDesktop.Bounds.Size.Width * $ScaleFactor),
                ($primaryDesktop.Bounds.Size.Height * $ScaleFactor)
            )

            $location = New-Object System.Drawing.Point(
                ($primaryDesktop.Bounds.Location.X * $ScaleFactor),
                ($primaryDesktop.Bounds.Location.Y * $ScaleFactor)
            )

            $bitmap = New-Object System.Drawing.Bitmap($size.Width, $size.Height)
            $graphics = [System.Drawing.Graphics]::FromImage($bitmap)
                        
            $graphics.CopyFromScreen($location, [System.Drawing.Point]::Empty, $size)
            
            return $bitmap

``` https://github.com/DarkCoderSc/PowerRemoteDesktop/blob/main/...

Reply on news.ycombinator.com