2

Is anyone aware of a windows 7 procedure where the attacker is able to access the host machine remotely via RDP on port 3389, and implement the utilman and/or stickykey exploit?

afaik the utilman exploit was a local attack. I was not aware it could be implemented remotely.

-

Facts:

  • Host machine is a server, always on, running 7 ultimate

  • Host machine had a 9+ digit numeric password that was not in the top 1000 worst passwords, but was in the top 10000 list.

  • Host machine had port 3389 open and RDC was enabled.

  • First RDC attempt happened the previous night, and the host machine was on the lock screen all night.

-

The attack was noticed when the user came into work and noticed the server was on the lock screen. The user immediately attempted to unlock the computer via utilman>osk.exe and was successful. Seconds later the host machine was put into the login screen. User attempted to unlock via utilman but this time a message popped up saying "Enter password for encrypted file: C:\Windows\wpmsvc.exe" User was able to log in after attaching a physical keyboard and immediately disabled the network adapter.

A number of files were created at the time of the incident, as well as a new administrator account.

The files that were created are as follows: newFiles

After checking the event logs it was confirmed that the new user account was created at this time, not any earlier, despite the connection attempt happening the previous night. (Another guy noticed this as he was leaving the previous niht but confirmed this but did not know this was abnormal, and thusly did not report it. The AM guy however knew that this machine should always be logged on and unlocked)

Upon reviewing the RDPWrap.ini file it was confirmed that the attacker was trying to allow multiple simultaneous connections to remote desktop. Presumably to be able to connect without locking the screen.

I first guessed this was an automated attack or worm that searches the internet for open RDP ports. I assumed this because it appears that the attack required the user to initiate by clicking on the utilman button, (the timestamp on the new user account creation was the time of the incident). There was only one account on the host machine before the incident and only two after (Administrator was disabled) so I first assumed the attacker was unable to access the main account (if he could then utilman would be unnecessary, right?)

After viewing the logs however I noticed an eventID 25 "Remote Desktop Services: Session reconnection succeeded:" with a russian IP, as well as one two hours earlier.

And under terminal services - remote connection manager logs I see hundreds of random users under eventID 1149 "Remote Desktop Services: User authentication succeeded:" all from european IPs and with names that indicate they are from business and point of sale computes from random businesses, spanning the previous days.

I understand how this was done for the most part, with the exception of how it was possible to switch utilman out with another file remotely over RDC (without an active login) to start the hack.

And if they were able to login under the main and only user account (why else would it go to lock screen unless there was a successful login?), then why did they need to do the utilman exploit to create another account? Couldn't they just create it the normal way?

Any ideas?

btw, I was able to find only one reference to this method, specifically pages 20-26 of this Chinese pdf guide that I cannot fully read.

http://hitcon.org/2014/downloads/P1_11_Orange%20-%20RDP.pdf

  • I think in that papaer you attached the machine as already been backdoored even Before the RDP connection is made by attacker – Sravan Mar 25 '16 at 5:20
  • It's been a couple years. Did you find anything out? – mbomb007 Jun 25 '18 at 22:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.