Remote desktop/VNC

[BlakeTnr]

We run a cyber security competition at our university. It would be a cool feature to be able to remote desktop or VNC into the machines we have connected. Connecting with RDP or VNC may be best according to its-a-feature, which could be done using apache guacamole or novnc possibly. I know there are possibly other solutions, but those are the 2 ones I know off the top of my head. Guacamole is especially good because it claims to support VNC and RDP.

[its-a-feature]

The crux of this would be finding a way to do this that's better than just using SOCKS and connecting via an actual RDP/VNC client.

Having it be available through the UI would be pretty cool. I'd have to look into what would be required to hook in Guacamole via some sort of Docker container and having it part of the reverse proxy

[BlakeTnr]

The crux of this would be finding a way to do this that's better than just using SOCKS and connecting via an actual RDP/VNC client.

Having it be available through the UI would be pretty cool. I'd have to look into what would be required to hook in Guacamole via some sort of Docker container and having it part of the reverse proxy

I've never used SOCKS so I have no idea. Though, I've used NoVNC in my applications which seems similar to guacamole. I could possibly do a POC for the guacamole stuff.

[its-a-feature]

So, you have an agent that's running on your target host and you want to access that host over RDP or another host over RDP. Typically, what you do is you start a SOCKS proxy through the agent. This allows you to tunnel arbitrary traffic to/from anything on the host/remote hosts and traffic originates from your agent. This also opens up a port on the Mythic server. You'd then use your own RDP/VNC thick client and point it to that port, like proxychains xfreerdp .... and then you're accessing remote services through your local RDP client.

The crux of this to happen at all is that the agent has to be sending traffic from this remote stream back to you fairly quickly, and your movements /clicks locally need to be sent to the agent fairly quickly as well. This is why we do things like sleep 0 so that we have an "almost" constant connection. Even if we had a web GUI front end, the agent and connections would still have to do this, so I'm just not sure what benefit we get out of trying to do the RDP in a browser vs an actual thick client. Does that make sense?

[BlakeTnr]

So, you have an agent that's running on your target host and you want to access that host over RDP or another host over RDP. Typically, what you do is you start a SOCKS proxy through the agent. This allows you to tunnel arbitrary traffic to/from anything on the host/remote hosts and traffic originates from your agent. This also opens up a port on the Mythic server. You'd then use your own RDP/VNC thick client and point it to that port, like proxychains xfreerdp .... and then you're accessing remote services through your local RDP client.

The crux of this to happen at all is that the agent has to be sending traffic from this remote stream back to you fairly quickly, and your movements /clicks locally need to be sent to the agent fairly quickly as well. This is why we do things like sleep 0 so that we have an "almost" constant connection. Even if we had a web GUI front end, the agent and connections would still have to do this, so I'm just not sure what benefit we get out of trying to do the RDP in a browser vs an actual thick client. Does that make sense?

I think I see what you're saying, either way Mythic would have to proxy a lot of traffic.

Honestly the only reason I suggest RDP in a browser is because it's just nice to have a browser option (but that is just my opinion, so it's up to you).

Either way if you have a frontend or backend we have to do these connection streams, correct? So I don't see any technical downside to having it in the browser if guacamole works well (assuming it does). The only solution to proxying the traffic I can think of would be to use a full client like you are saying and make it so that full client just directly connects (and at that point it has nothing to do with mythic, unless there was some link to open the application).