Hacker News new | ask | show | jobs
by AnIdiotOnTheNet 1627 days ago
Eh, why bother? This is basically just a pure-PowerShell VNC-like as far as I can tell. If an attacker wants that a reverse VNC shellcode is readily available and small.
1 comments

First of all, it's not a VNC protocol implementation but RDP. Second, it's PowerShell so it's easy to use as a payload in any exploitation tool, e.g. Metasploit, Cobalt Strike and such. If you have information about RDP, you have probably heard it's the first stop when you want to exploit any Windows device. If it doesn't work, you go for SMB, etc. So yes, it's valuable in that sense.
It doesn't appear to be RDP. All this seems to be doing is taking screenshots of the Desktop, which is similar to how VNC works. RDP is a vastly more complicated protocol.

Last I checked the reverse VNC shellcode was literally part of the Metasploit suite, so not really any easier there either.