security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

RDP on Non Standdard Port (#1643)

Browse Source 
Co-authored-by: Priya <dpriya@NTI.local>
This commit is contained in:
devapriya16
2021-10-07 20:58:04 -05:00
committed by GitHub
parent 57bf589ab7
commit dc251e8ee5
1 changed files with 22 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
atomics/T1021.001/T1021.001.yaml
+22
View File
@@ -74,3 +74,25 @@ atomic_tests:
$p=Tasklist /svc /fi "IMAGENAME eq mstsc.exe" /fo csv | convertfrom-csv
if(-not ([string]::IsNullOrEmpty($p.PID))) { Stop-Process -Id $p.PID }
name: powershell
- name: Changing RDP Port to Non Standard Port
description: |
Changing RDP Port to Non Standard Port via Remote Desktop Application over Powershell
supported_platforms:
- windows
input_arguments:
OLD_Remote_Port:
description: Default RDP Listening Port
type: String
default: "3389"
NEW_Remote_Port:
description: New RDP Listening Port
type: String
default: "4489"
executor:
command: |
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "PortNumber" -Value #{NEW_Remote_Port}
New-NetFirewallRule -DisplayName 'RDPPORTLatest-TCP-In' -Profile 'Public' -Direction Inbound -Action Allow -Protocol TCP -LocalPort #{NEW_Remote_Port}
cleanup_command: |
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "PortNumber" -Value #{OLD_Remote_Port}
Remove-NetFirewallRule -DisplayName "RDPPORTLatest-TCP-In"
name: powershell