rapid7/metasploit-framework — pull request #3730 by TomSellers (2014-08-31 19:08:10+00:00)
Title: Module: Credentials - Remote Desktop Connection Manager

**Description**

This is a new post module that extracts and decrypts saved Microsoft Remote Desktop Connection Manager (RDCMan) [1] passwords the .RDG files of users. The module will attempt to find the files configured for all users on the target system. Passwords for managed hosts are encrypted by default. In order for decryption of these passwords to be successful, this module must be executed under the same account as the user which originally encrypted the password. Passwords that have been stored in plain text will be captured and documented irrespective of the context of the Meterpreter session.

The module will also document any configured RDP gateways or custom port numbers.

**Verification**

- [ ] Install and configure MS Remote Desktop Connection Manager [1][2]
- [ ] Configure/mockup test connections in various configurations [3]
- [ ] Launch msfconsole
- [ ] Verify that the database is connected
- [ ] Establish Meterpreter on Windows target running in context your test user, migrate if needed
- [ ] ```use post/windows/gather/credentials/rdcmanager_creds````
- [ ] ````set SESSION ````
- [ ] ````run````
- [ ] Results including passwords should be printed to console
- [ ] ````creds````
- [ ] __VERIFY__ that information in the module's console output is listed correctly in the output of ````creds````
- [ ] __VERIFY__ that the configuration of the test RDC Manager is listed correctly in the output of ````creds````

My testing was performed using 'exploit/windows/smb/psexec' with 'payload windows/meterpreter/reverse_tcp' against Windows 2008 R2 using MS Remote Desktop Connection Manager 2.2. Testing was performed as SYSTEM, as a user that created the file, and as a user who could read the .RDG files but did not create them.

References:
1. Installer - http://www.microsoft.com/en-us/download/details.aspx?id=21101

2. Setup Instructions: http://blogs.msdn.com/b/stuartleeks/archive/2014/01/15/using-remote-desktop-connection-manager-rdc-man-with-windows-azure-virtual-machines.aspx

3. Sample complex .RDG file - https://gist.github.com/TomSellers/64c9624c59ea5951130e
- [ ] Download the contents of the link above and save to 'RDCMan_test.rdg'.
- [ ] Open with RDC Manager and view settings.
- [ ] Close RDC Manager.