* क्या आप **साइबर सुरक्षा कंपनी** में काम करते हैं? क्या आप अपनी **कंपनी को HackTricks में विज्ञापित** देखना चाहते हैं? या क्या आपको **PEASS के नवीनतम संस्करण या HackTricks को PDF में डाउनलोड करने का उपयोग** करने की इच्छा है? [**सदस्यता योजनाएं**](https://github.com/sponsors/carlospolop) की जांच करें!
* [**The PEASS Family**](https://opensea.io/collection/the-peass-family) की खोज करें, हमारा विशेष [**NFT संग्रह**](https://opensea.io/collection/the-peass-family)
* [**आधिकारिक PEASS & HackTricks swag**](https://peass.creator-spring.com) प्राप्त करें
* **शामिल हों** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord समूह**](https://discord.gg/hRep4RUj7f) या [**टेलीग्राम समूह**](https://t.me/peass) या मुझे **Twitter** पर **फ़ॉलो** करें [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
WTS Impersonator "यहां बिना सामान्य "टोकन अनुकरण तकनीक" का उपयोग किए बिना उपयोगकर्ताओं की गणना करने और अन्य उपयोगकर्ताओं के टोकन चुराने के लिए "बारीकी से विकसित" किया जाता है। यह अच्छा और आसान लैटरल मूवमेंट को संचालित रखने की अनुमति देता है, यह तकनीक [Omri Baso](https://www.linkedin.com/in/omri-baso/) द्वारा शोधित और विकसित की गई थी।
The WTS-Impersonator technique allows an attacker to remotely enumerate a machine using either an IP address or a hostname. This technique takes advantage of the Windows Terminal Server (WTS) service to impersonate a user session and gather information about the target machine.
## Steps
1.**Identify the target machine**: Obtain the IP address or hostname of the machine you want to enumerate.
2.**Check if the machine has the WTS service enabled**: Use a port scanning tool, such as Nmap, to check if the target machine has port 3389 open. This port is used by the WTS service.
3.**Enumerate the machine using RDP**: If the WTS service is enabled, you can use a Remote Desktop Protocol (RDP) client to connect to the target machine. Provide the IP address or hostname, along with valid credentials if required.
4.**Gather information**: Once connected to the target machine, you can gather information about the system, such as the operating system version, installed software, and network configuration. This information can be useful for further exploitation or reconnaissance.
## Example
```plaintext
$ nmap -p 3389 <target_ip>
Starting Nmap 7.80 ( https://nmap.org ) at 2021-01-01 00:00 UTC
Nmap scan report for <target_ip>
Host is up (0.001s latency).
PORT STATE SERVICE
3389/tcp open ms-wbt-server
$ rdesktop <target_ip>
Autoselected keyboard map en-us
Connected to <target_ip>:3389
```
## Mitigation
To mitigate the risk of enumeration through WTS-Impersonator, consider the following measures:
- Disable the WTS service if it is not required.
- Implement strong password policies to prevent unauthorized access to user accounts.
- Regularly update and patch the operating system and software to address any vulnerabilities that could be exploited through enumeration techniques.
- Monitor network traffic for any suspicious activity, such as repeated failed login attempts or unusual connections to the WTS service.
इसके लिए `exec-remote` के लिए कुछ अलग है, मैंने एक सेवा बनाई है जो `PsExec.exe` की तरह दूरस्थ पर स्थापित की जा सकती है
सेवा को एक `SessionId` और एक `बाइनरी को चलाने` के रूप में एक तर्क के रूप में प्राप्त करेगी और यदि सही अनुमतियाँ होंगी तो यह दूरस्थ पर स्थापित और निष्पादित की जाएगी
The WTS Impersonator technique allows an attacker to steal user credentials by impersonating a Windows Terminal Server (WTS) session. This technique takes advantage of the fact that WTS sessions can be redirected to the attacker's machine, allowing them to intercept and capture user credentials.
To exploit this technique, the attacker needs to have administrative access to the target machine. They can then use tools like `mstsc.exe` or `tscon.exe` to redirect a WTS session to their own machine. Once the session is redirected, the attacker can use tools like `mimikatz` to capture user credentials.
## Mitigation
To mitigate the risk of WTS Impersonator attacks, it is recommended to follow these best practices:
- Limit administrative access to the target machine to trusted individuals only.
- Implement strong password policies and enforce regular password changes.
- Monitor WTS session redirections and investigate any suspicious activity.
- Use multi-factor authentication to add an extra layer of security to user credentials.
