The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides a variety of shell commands for different stages of an RDP attack, including Nmap scanning with NSE scripts, credential spraying using tools like crowbar and hydra, and session manipulation using tscon.\n- [PERSISTENCE]: In Section 5.2, the skill describes 'Sticky Keys' and 'Utilman' backdoor techniques. These involve the replacement of system binaries (sethc.exe or utilman.exe) with cmd.exe to provide a SYSTEM shell from the login screen, representing a high-risk persistence mechanism.\n- [PRIVILEGE_ESCALATION]: The skill details RDP session hijacking using the tscon utility and Mimikatz, which allows an attacker with SYSTEM permissions to intercept active or disconnected user sessions. It also includes instructions for adding arbitrary users to the 'Remote Desktop Users' group via 'net localgroup'.\n- [EXTERNAL_DOWNLOADS]: The documentation references and links to several third-party exploitation tools on GitHub, including JoelGMSec/AutoRDPwn, skelsec/evilrdp, 0xthirteen/SharpRDP, and linuz/Sticky-Keys-Slayer, which are recommended for automating post-exploitation activities.

rdp-pentesting