{"id":15130500,"url":"https://github.com/0x09al/rdpthief","last_synced_at":"2025-05-16T00:06:11.770Z","repository":{"id":41423600,"uuid":"219341917","full_name":"0x09AL/RdpThief","owner":"0x09AL","description":"Extracting Clear Text Passwords from mstsc.exe using API Hooking.","archived":false,"fork":false,"pushed_at":"2024-07-20T06:58:02.000Z","size":123,"stargazers_count":1319,"open_issues_count":1,"forks_count":362,"subscribers_count":35,"default_branch":"master","last_synced_at":"2025-05-16T00:05:23.195Z","etag":null,"topics":["api-hooking","cpp","pentesting-windows","redteaming"],"latest_commit_sha":null,"homepage":null,"language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/0x09AL.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-11-03T17:54:38.000Z","updated_at":"2025-05-15T21:45:49.000Z","dependencies_parsed_at":"2024-09-26T03:00:58.659Z","dependency_job_id":null,"html_url":"https://github.com/0x09AL/RdpThief","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0x09AL%2FRdpThief","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0x09AL%2FRdpThief/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0x09AL%2FRdpThief/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0x09AL%2FRdpThief/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/0x09AL","download_url":"https://codeload.github.com/0x09AL/RdpThief/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254442854,"owners_count":22071878,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["api-hooking","cpp","pentesting-windows","redteaming"],"created_at":"2024-09-26T03:00:51.066Z","updated_at":"2025-05-16T00:06:11.752Z","avatar_url":"https://github.com/0x09AL.png","language":"C++","funding_links":[],"categories":[],"sub_categories":[],"readme":"# RdpThief\n\nRdpThief by itself is a standalone DLL that when injected in the mstsc.exe process, will perform API hooking, extract the clear-text credentials and save them to a file. \n\nAn aggressor script accompanies it, which is responsible for managing the state, monitoring for new processes and injecting the shellcode in mstsc.exe. The DLL has been converted to shellcode using the sRDI project (https://github.com/monoxgas/sRDI). When enabled, RdpThief will get the process list every 5 seconds, search for mstsc.exe, and inject to it.\n\nWhen the aggressor script is loaded on Cobalt Strike, three new commands will be available:\n\n* rdpthief_enable – Enables the hearbeat check of new mstsc.exe processes and inject into them.\n* rdpthief_disable – Disables the hearbeat check of new mstsc.exe but will not unload the already loaded DLL.\n* rdpthief_dump – Prints the extracted credentials if any.\n\n## Screenshot\n\n![Example Usage](images/screenshot.png)\n\nDemonstration Video : https://www.youtube.com/watch?v=F77eODhkJ80\n\nMore details can be found on : https://www.mdsec.co.uk/2019/11/rdpthief-extracting-clear-text-credentials-from-remote-desktop-clients/\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0x09al%2Frdpthief","html_url":"https://awesome.ecosyste.ms/projects/github.com%2F0x09al%2Frdpthief","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0x09al%2Frdpthief/lists"}