{"id":3812,"date":"2016-08-26T20:02:00","date_gmt":"2016-08-26T20:02:00","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=3812"},"modified":"2016-08-26T22:35:55","modified_gmt":"2016-08-26T22:35:55","slug":"beyond-good-ol-run-key-part-45","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2016\/08\/26\/beyond-good-ol-run-key-part-45\/","title":{"rendered":"Beyond good ol\u2019 Run key, Part 45"},"content":{"rendered":"<p>RDP was a feature guest in the last <a href=\"https:\/\/www.hexacorn.com\/blog\/2016\/08\/19\/beyond-good-ol-run-key-part-44\/\">two<\/a> <a href=\"https:\/\/www.hexacorn.com\/blog\/2016\/07\/28\/beyond-good-ol-run-key-part-43\/\">parts<\/a> of the series. Time for the third visit as there is still something to write about&#8230;<\/p>\n<p>Using dedicated addins one can change the behavior of RDP session by leveraging a mechanism that Microsoft calls <a href=\"https:\/\/msdn.microsoft.com\/en-us\/library\/aa383509(v=vs.85).aspx\">Virtual Channels<\/a>.<\/p>\n<p>Quoting directly from the web site:<\/p>\n<p style=\"padding-left: 30px;\"><em>Virtual channels<\/em> are software extensions that can be used to add functional enhancements to a Remote Desktop Services application. Examples of functional enhancements might include: support for special types of hardware, audio, or other additions to the core functionality provided by the Remote Desktop Services Remote Desktop Protocol (RDP). The RDP protocol provides multiplexed management of multiple virtual channels.<\/p>\n<p>The mechanism is implemented using DLLs, and since it is a legitimate feature its implementation and persistence mechanism are very well documented on the <a href=\"https:\/\/msdn.microsoft.com\/en-us\/library\/aa383583(v=vs.85).aspx\">web site<\/a>.<\/p>\n<p>While the web site describes the HKCU keys only:<\/p>\n<ul>\n<li>HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default\\Addins<\/li>\n<li>HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\<em>connection<\/em>\\Addins<\/li>\n<\/ul>\n<p>the HKLM works as well (at least for the <em>Default<\/em>; I have not tested the <em>connection<\/em> ones cuz it&#8217;s Friday \ud83d\ude42 ).<\/p>\n<p>f.ex.:<\/p>\n<ul>\n<li>HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Terminal Server Client\\Default\\Addins\\Malware<br \/>\nName\u00a0 = c:\\test\\test.dll<\/li>\n<\/ul>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/08\/virtchan3.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-3816\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/08\/virtchan3-300x42.png\" alt=\"virtchan3\" width=\"502\" height=\"70\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/08\/virtchan3-300x42.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/08\/virtchan3-768x107.png 768w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/08\/virtchan3-1024x143.png 1024w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/08\/virtchan3.png 1118w\" sizes=\"(max-width: 502px) 100vw, 502px\" \/><\/a><\/p>\n<p>Unlike the ClxDllPath Path presented in <a href=\"https:\/\/www.hexacorn.com\/blog\/2016\/08\/19\/beyond-good-ol-run-key-part-44\/\">part 44<\/a>, the Addins DLLs are loaded not immediately after mstsc.exe is launched:<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/08\/virtchan1.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-3813 size-full\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/08\/virtchan1.png\" alt=\"virtchan1\" width=\"407\" height=\"253\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/08\/virtchan1.png 407w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/08\/virtchan1-300x186.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/08\/virtchan1-80x50.png 80w\" sizes=\"(max-width: 407px) 100vw, 407px\" \/><\/a><\/p>\n<p>but only after the actual connection with the remote system is established:<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/08\/virtchan2.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-3814 size-full\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/08\/virtchan2.png\" alt=\"virtchan2\" width=\"425\" height=\"359\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/08\/virtchan2.png 425w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/08\/virtchan2-300x253.png 300w\" sizes=\"(max-width: 425px) 100vw, 425px\" \/><\/a>Note: If you want to test it, make sure that the DLL you want to load matches the mstsc.exe architecture (32- or 64-bit)<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>RDP was a feature guest in the last two parts of the series. Time for the third visit as there is still something to write about&#8230; Using dedicated addins one can change the behavior of RDP session by leveraging a &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2016\/08\/26\/beyond-good-ol-run-key-part-45\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[13,35,15,19,9],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3812"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=3812"}],"version-history":[{"count":5,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3812\/revisions"}],"predecessor-version":[{"id":3820,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3812\/revisions\/3820"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=3812"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=3812"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=3812"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}