RDP "Banner Grab"

[dhoelzer at enclaveforensics.com (David Hoelzer)]

It's not what you're really asking for but it might be a start.  You are aware of TSGrinder, right?

---------------------------------------------------------
David Hoelzer
Director of Research, Enclave Forensics
dhoelzer at enclaveforensics.com





On Mar 12, 2010, at 1:26 AM, Robin Wood wrote:

> I haven't got time to test this but I'm thinking of some kind of
> script that starts rdesktop passing in the credentials you have then
> uses the import tool from imagemagick to screenshot. It should be
> fairly simple to create something that does a basic job of it, start
> the connection, sleep a few seconds, take the screenshot then kill the
> connection and move on.
>
> Robin
>
> On 11 March 2010 12:40, Ron Gula <rgula at tenablesecurity.com> wrote:
> > On 3/10/2010 4:54 PM, Chris Merkel wrote:
> > > Let's say I have a bunch of windows boxes that can only be reached via
> > > RDP - is there an automated way that one could get screen grabs of a
> > > large group of hosts and, ideally, pulling down the domain list as it's
> > > done?
> > >
> > > --
> > > - Chris Merkel
> >
> > Hi Chris,
> >
> > Nessus has a pure RDP OS fingerprinting module that is ideal for this
> > case. It does not grab screen shots but it does delve deep enough into
> > RDP to fingerprint it. This is ideal for those stand-alone, lights-out
> > Windows systems that aren't part of a domain. Here is a Tenable blog
> > post from 2007 about it:
> >
> > http://blog.tenablesecurity.com/2007/10/windows-operati.html
> >
> > --
> > Ron Gula, CEO
> > Tenable Network Security
> >
> >
> > _______________________________________________
> > Pauldotcom mailing list
> > Pauldotcom at mail.pauldotcom.com
> > http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
> > Main Web Site: http://pauldotcom.com
> _______________________________________________
> Pauldotcom mailing list
> Pauldotcom at mail.pauldotcom.com
> http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
> Main Web Site: http://pauldotcom.com