attack_technique: T1021.001
display_name: 'Remote Services: Remote Desktop Protocol'
atomic_tests:
- name: RDP to DomainController
  auto_generated_guid: 355d4632-8cb9-449d-91ce-b566d0253d3e
  description: |
    Attempt an RDP session via Remote Desktop Application to a DomainController.
  supported_platforms:
  - windows
  input_arguments:
    logonserver:
      description: ComputerName argument default %logonserver%
      type: String
      default: $ENV:logonserver.TrimStart("\")
    domain:
      description: domain argument default %USERDOMAIN%
      type: String
      default: $Env:USERDOMAIN
    username:
      description: Username argument default %username%
      type: String
      default: $ENV:USERNAME
    password:
      description: Password
      type: String
      default: 1password2!
  dependencies:
  - description: |
      Computer must be domain joined
    prereq_command: |
      if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain) { exit 0} else { exit 1}
    get_prereq_command: |
      Write-Host Joining this computer to a domain must be done manually
  executor:
    command: |
      $Server=#{logonserver}
      $User = Join-Path #{domain} #{username}
      $Password="#{password}"
      cmdkey /generic:TERMSRV/$Server /user:$User /pass:$Password
      mstsc /v:$Server
      echo "RDP connection established"
    cleanup_command: |
      $p=Tasklist /svc /fi "IMAGENAME eq mstsc.exe" /fo csv | convertfrom-csv
      if(-not ([string]::IsNullOrEmpty($p.PID))) { Stop-Process -Id $p.PID }
    name: powershell
- name: RDP to Server
  auto_generated_guid: 7382a43e-f19c-46be-8f09-5c63af7d3e2b
  description: |
    Attempt an RDP session via Remote Desktop Application over Powershell
  supported_platforms:
  - windows
  input_arguments:
    logonserver:
      description: ComputerName
      type: String
      default: WIN-DC
    username:
      description: Username
      type: String
      default: Administrator
    password:
      description: Password
      type: String
      default: 1password2!
  executor:
    command: |
      $Server="#{logonserver}"
      $User="#{username}"
      $Password="#{password}"
      cmdkey /generic:TERMSRV/$Server /user:$User /pass:$Password
      mstsc /v:$Server
      echo "RDP connection established"
    cleanup_command: |
      $p=Tasklist /svc /fi "IMAGENAME eq mstsc.exe" /fo csv | convertfrom-csv
      if(-not ([string]::IsNullOrEmpty($p.PID))) { Stop-Process -Id $p.PID }
    name: powershell
- name: Changing RDP Port to Non Standard Port via Powershell
  auto_generated_guid: 2f840dd4-8a2e-4f44-beb3-6b2399ea3771
  description: |
    Changing RDP Port to Non Standard Port via Remote Desktop Application over Powershell
  supported_platforms:
    - windows
  input_arguments:
    OLD_Remote_Port:
      description: Default RDP Listening Port
      type: String
      default: "3389"
    NEW_Remote_Port:
      description: New RDP Listening Port
      type: String
      default: "4489"
  executor:
    command: |
      Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "PortNumber" -Value #{NEW_Remote_Port}
      New-NetFirewallRule -DisplayName 'RDPPORTLatest-TCP-In' -Profile 'Public' -Direction Inbound -Action Allow -Protocol TCP -LocalPort #{NEW_Remote_Port}
    cleanup_command: |
      Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "PortNumber" -Value #{OLD_Remote_Port}
      Remove-NetFirewallRule -DisplayName "RDPPORTLatest-TCP-In" -ErrorAction ignore 
    name: powershell
- name: Changing RDP Port to Non Standard Port via Command_Prompt
  auto_generated_guid: 74ace21e-a31c-4f7d-b540-53e4eb6d1f73
  description: |
    Changing RDP Port to Non Standard Port via Command_Prompt
  supported_platforms:
    - windows
  input_arguments:
    OLD_Remote_Port:
      description: Default RDP Listening Port
      type: String
      default: "3389"
    NEW_Remote_Port:
      description: New RDP Listening Port
      type: String
      default: "4489"
  executor:
    command: |
      reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d #{NEW_Remote_Port} -f
      netsh advfirewall firewall add rule name="RDPPORTLatest-TCP-In" dir=in action=allow protocol=TCP localport=#{NEW_Remote_Port}
    cleanup_command: |
      reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d #{OLD_Remote_Port} -f >nul 2>&1
      netsh advfirewall firewall delete rule name="RDPPORTLatest-TCP-In" >nul 2>&1
    name: command_prompt
    elevation_required: true    
