1

I'm curious to how an attacker would enable RDP/SSH and use it to gain further access to the compromised windows server after achieving remote command/code execution on the server. (Using cmd.exe)

  • 1
    If you have remote code execution you can enable anything from there. Your question does not make much sense. – Overmind Sep 19 at 12:10
  • I'm asking how an attacker would do so, yes it does. – Jake Leroy Sep 19 at 22:58
  • reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f - this enables RDP – Overmind Sep 20 at 5:11
  • I think your question boils down to: how do you enable RDP or SSH via the commandline. That's not a security question, regardless of the intent or how someone gained access to the commandline in the first place. – schroeder Sep 20 at 6:38