One of the keys to becoming a professional and successful hacker is to think creatively. There is always a way to get into any network or system if you think creatively. In previous tutorials, I have demonstrated ways to crack passwords on both Linux and Windows systems, but in this case, I will show you a way to get the sysadmin password by intercepting it from a Remote Desktop session.
As you know, RDP, better known as Remote Desktop Protocol, is a protocol that enables a sysadmin or tech support staff to take control of the end user's system to help or troubleshoot some issue or problem. When implemented correctly, interception of RDP traffic is difficult, but few companies implement it correctly. In fact, I have found that in MOST companies, RDP is vulnerable to the following attack, so pay close attention here as this attack is rather complex and requires your close attention and patience.
Read More: New Twitter CEO: पराग अग्रवाल की होगी छुट्टी, Elon Musk ने खोजा नया सीईओ
Note: We will be using Cain and Abel to conduct this MitM attack, so without a CACE Technologies proprietary wireless adapter, this attack will only work on a wired network.
Enable RDP Server on a One System
First, we need a system with RDP enabled. If you are using this in your lab, enable one Windows machine's RDP server. Go to Control Panel then System and Security. Below the System section, you will see "Allow remote access". Click there.
Next, click on the "Allow Remote Assistance connections to this computer" and click "Apply."
Step 2Install Cain on Windows System
You should have Cain and Abel installed on your attack system. I have it on my Windows 7 system that I will be using to attack RDP on another Windows 7 system. In this case, we will not be using BackTrack as Cain and Abel is one of the few hacking tools developed originally for Windows and has never been ported to Linux.
Cain and Abel, besides being a great password cracking tool (albeit a bit slow) is probably the best MiTM tool on the market—and it is free!
Read More: কল রেকর্ডিং ফিচার বন্ধ করবে Google! কী আছে অ্যান্ড্রয়েড ফোন ইউজারদের কপালে?
Step 3Use ARP Scan on Systems with Cain
Now that we have Cain and Abel running on our attack system and the RDP server enabled on another, we need to do an ARP scan. In this way, we will find all the systems on the network by sending out ARP requests and the systems on the network will respond with their IP address and MAC addresses. Choose a range that is appropriate for your target network.
Step 4ARP Poison
Next, now that know all the machines, IP addresses and MAC addresses on the network from the ARP scan, we are in a position to be able to poison the ARP. We poison the ARP so that our attack system sits between the RDP server and the RDP client. In this way, all of either machine's traffic must travel through our attack machine.
Read More: Motorola Moto E32s Price in India: Moto E32S Launched in India with Extra Features
Click on the Sniffer button on Cain, then select the Sniffer tab, then select the Hosts tab at the bottom, then click on the blue + on the top menu, select the Radio button, select the target IP range, and click OK.
Here, we see the hosts on the network.
Step 5Choose the Server and Client You Want to Poison
Select the APR button at the bottom next to the host's tab you used above, press the blue + button, select the targets, and press OK.
Step 6Connect RDP Client to the RDP Server
Now, we wait for the RDP client to connect to the RDP server. This is likely to happen when an individual calls tech support and tech support needs to configure and demonstrate something on their machine. As you might guess, this requires some patience. When they do, we can then intercept its traffic.
Read More: Download Latest Movies Full HD
Below, we are connecting to the RDP server called Null Byte.
Step 7Intercept Traffic
With our Cain and Abel MiTM attack in place, all of the traffic between the RDP server and the RDP client will pass through our attack system.
Cain and Abel are now capturing the entire session and saving it into a file named in the far right column. We can now right-click on that filename and choose View to open the decrypted file in Notepad.
Step 8Search for Traffic
Now that all the traffic on the RDP connect is travelling through our attack system, we can search for the traffic of interest to us.
Ideally, we want the sysadmin password for RDP. If we can find the sysadmin password for RDP, we will likely be able to use RDP on any of the network's machines as usually, the sysadmin will set up RDP with the same password on every system for convenience.
Even better, many sysadmins use the same password to remote into client machines as they use on their system and other accounts. This means that when we capture this password we may own the entire domain and network!
To find any keys pressed in the hexadecimal file capture, use the Find feature in Notepad to search for "key pressed". This will find each of the keystrokes, one by one, of any keystrokes entered by the sysadmin including their password. This is tedious work, but you will be rewarded with a pot of gold for your patience!
I hope you understand How to Hack Remote Desktop Protocol (RDP) to Snatch the Sysadmin Password. If you have any queries about this please comment to us or mail us.