RE: Windows Independant GUI

Yes, I have seen the link provided, and a million others like it... the
concurrent desktop "hack" for Windows XP does work to get multiple sessions
by using a older, less secure version of the dll file. However, without
physical access, it could be a safe bet that you would damage the system
instead of succeeding with the process; after all, every one of those sites
recommends re-booting the computer in safe mode to change the dll (while it
isn't already loaded).

Also, if the computer you're trying to do the concurrent sessions on is part
of a domain, that process will not work. Word to the hopeful.

Of course, that being said, I agree with the CLI comment. I'm a firm
believer in strong DOS and scripting and, if you think something can't be
done with those two things, then you just haven't tried hard enough or
learned enough.

Isaac Van Name

-----Original Message-----
From: Beauford, Jason [mailto:jbeauford@xxxxxxxxxxxxxxxxx]
Sent: Tuesday, September 05, 2006 3:40 PM
To: Isaac Van Name; Marios A. Spinthiras
Cc: pen-test@xxxxxxxxxxxxxxxxx
Subject: RE: Windows Independant GUI

Isaac Van Name wrote:
For the record, Remote Desktop Connection only spawns another
"virtual desktop" on a system running Terminal Services (Server 2003
and, I believe, Server 2000). Windows XP runs Terminal Services Lite
and, as such, Remote Desktop Connection used on a Windows XP box will
kick off the user currently logged in. WinConnect XP Server is an
option to get multiple RDP sessions, and I'm sure others know of
better ways (or, at least, I hope so), as WinConnect is not cheap.

Isaac Van Name

-----Original Message-----
From: Marios A. Spinthiras [mailto:mario@xxxxxxxxxxxxx]
Sent: Tuesday, September 05, 2006 5:02 AM
To: pen-test@xxxxxxxxxxxxxxxxx
Subject: Re: Windows Independant GUI

Remote Desktop Connection spawns another "virutal desktop" under the
account credentials you specify. This is unlike VNC which simply
connects to the active display of the user currently logged on. If
VNC is running as a system service it still means that you will be
connecting to the Administrator account. If the station is locked
(ALT CTRL DEL) then you will be looking at the same screen that the
user looks at when he looks at the monitor of the workstation.
Disregarding that simply for aesthetic purposes , what you need is a
RDP like connection.

Regards,
Mario A. Spinthiras

One2@xxxxxxxxxx wrote:
Hey All,

After compromising Windows workstations I am able to gain a remote
GUI via
either Terminal Services, VNC, GetScreen, etc.

However, this remote access gives me access to the user's GUI, which
limits me to using the GUI when they seem to have left for lunch. ;o)

Does anyone know of any way that I can gain an independant GUI so
that I
can use and install GUI software to continue the attack, without
having to worry about whether the user is using their GUI?

All ideas are welcome.

My opinion is that the more programs you install, the more likely you
are to be detected. CLI equivalents should be used instead of trying to
use GUI interfaces.

That aside, this hack may help you. I've never tried myself so I cannot
report on it. Just putting it out there for you to try.

http://sig9.com/articles/concurrent-remote-desktop


Kind Regards,

JMB



------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------

Relevant Pages

  • Re: Splash Screens , how could something so basic still be hard?
    ... You say that there "is no message pump to allow for further GUI ... Note that by "there is no message pump", I mean that because of the way the code is written, no message pump is working while the "splash screen" is displayed. ... In a normal Forms app, there would be a message pump loop, and there's no reason to believe that in those examples, one doesn't exist. ... The same technique is possible in Windows, ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Wiseman and McGhie are Ranting Again
    ... >>>rest of the system by dropping Word's run time priority in stages. ... Nearly everything with a GUI has something like an event ... That part of the OS is the windows manager and is typically a ... That is your event loop. ...
    (microsoft.public.mac.office.word)
  • Re: MFC & Guis
    ... The fact that so many GUI wheels are reinvented by so many devs is an ... Users of Windows software form expectations ... > to learn to use your app. ... > while the client areas exhibit behaviour specific to the application domain. ...
    (microsoft.public.vc.mfc)
  • Re: How to make Forth interesting?
    ... trying to deny that I wrote and distributed lots of software ... I think GUI is a good example. ... Humm, Windows Forth ... to the flash files etc. to create flash images for the target ...
    (comp.lang.forth)
  • Re: A little musing on Linux ( was Re: Zip files to multiple floppies)
    ... > various distributions Of linux have made me think a little harsh about ... > and troubles far more than Windows. ... The amount of extra work to program a gui ... Mounting filesystems for example - windows computers only ...
    (Fedora)