Did you know this also works in the browser?
A version of this library is included in the in-browser pentest suite Octopwn
This project is aimed to play around the RDP and VNC protocols.
Project contains no GUI, for a GUI client please check out aardwolfgui
This is a headless client, for GUI functionality use the aardwolfgui
package.
- Supports credssp auth via NTLM/Kerberos.
- Built-in proxy client allows SOCKS/HTTP proxy tunneling without 3rd part software
- PtH via CredSSP+Restricted admin mode
- Scriptable Keyboard, Mouse input and Clipboard input/output
- Can run in headless mode, no GUI required (read: no need for Qt)
- Support for Duckyscript files to emulate keystrokes
ardpscan
Multi-purpose scanner for RDP and VNC protocols. (screenshot/capabilities/login scanner)
As usual the scripts take the target/scredentials in URL format. Below some examples
rdp+kerberos-password:https://TEST\Administrator:[email protected]/?dc=10.10.10.2&proxytype=socks5&proxyhost=127.0.0.1&proxyport=1080
CredSSP (akaHYBRID
) auth using Kerberos auth + password viasocks5
towin2016ad.test.corp
, the domain controller (kerberos service) is at10.10.10.2
. The socks proxy is on127.0.0.1:1080
rdp+ntlm-password:https://TEST\Administrator:[email protected]
CredSSP (akaHYBRID
) auth using NTLM auth + password connecting to RDP server10.10.10.103
rdp+ntlm-password:https://TEST\Administrator:<NThash>@10.10.10.103
CredSSP (akaHYBRID
) auth using Pass-the-Hash (NTLM) auth connecting to RDP server10.10.10.103
rdp+plain:https://Administrator:[email protected]
Plain authentication (No SSL, encryption is RC4) using password connecting to RDP server10.10.10.103
vnc+plain:https://[email protected]
VNC client with VNC authentication using password connecting to RDP server10.10.10.103
vnc+plain:https://[email protected]
VNC client with VNC authentication using password connecting to RDP server10.10.10.103
vnc+plain:https://:admin:[email protected]
VNC client with VNC authentication using passwordadmin:aaa
connecting to RDP server10.10.10.103
. Note that if the password contains:
char you will have to prepend the password with:
- Sylvain Peyrefitte (@citronneur)
rdpy
. The decompression code and the QT image magic was really valuable. - Marc-André Moreau (@awakecoding) for providing suggestions on fixes