One of the operations that can be done when you open a shell with Meterpreter in the Metasploit Framework is to implement the remote desktop connection. The getgui command is very useful for this. In this article, we will see how we can create a user in the system using the getgui command and then connect to this computer with the rdesktop command.

Remote Desktop Connection

We assume that you have opened a Meterpreter shell on the target computer with a vulnerability (for example ms17-010).

We need the username and password required to visually link using the “getgui” command. When you create a username and password, you will ensure permanence.

getgui Tool

First, we will get information about the tool by using the getgui -h command.

run getgui -h

Adding Users with getgui

In general, -u is used to indicating the username and -p to indicate the password. When you use the getgui command similar to the example below, you add a new user to the system.

run getgui -u omer -p password

Remote Connection with rdesktop

We created the user. Using this username and password, you can make a remote desktop connection from another computer on the same network.

rdesktop -u omer -p password 192.168.254.146

Log Cleaning

Finally, the more you manipulate the target system, the more likely you are to be logged. You should not take unauthorized action as much as possible or be content with intervening where necessary.

You may want to clear the log records of the user and session information you created with getgui. You can use the following command example for this. You can check the latest version of the “/root/.msf4/logs/scripts/getgui/clean_up__20210118.3139.rc” file used in the example from within the same folder.

run multi_console_command -r /root/.msf4/logs/scripts/getgui/clean_up__20210118.3139.rc