RDP image recognition/login completion research

[mssalvatore]

Spike

Objective

Complete the image processing prototype that was started in #3376 or formulate another plan for identifying when login is complete.

Time Remaining: 0d

• Check the RDP protocol to see if there's a better option than image processing.
• Branstorm with @stiv-kupchik

[ilija-lazoroski]

After a brainstorm with @stiv-kupchik we decided that the cleanest solution for now will be a simple clipboard check on the remote machine.

We can have something in the clipboard from the machine and check whatever matches the command string we added. The prototype for this is in this commit.

The above will be a good solution along with some timeouts.

Note: this still might take some time because it is Windows and the machine might be a slower one. From the tests I did, from the time we RDP connected to the time we got a Screen is up message, the time changed but it was approx around 20 seconds. This is something to think about when doing the exploiter or if I remember correctly we had some timeout on how much the exploits can run.

Another note: On the time above I didn't add the time we use to RDP connect to the machine, which is around a second when the machine is Up and running, and possibly a mechanism to retry the connecting if the machine is not up and we know the actual credentials. Aaardwolf raises different exceptions for each step.

[cakekoa]

Note: It is possible to have the clipboard disabled, but it is enabled by default

[akam-skupchik]

We discussed that as well, and said it's probably good enough to fall back on timeout in case the clipboard is disabled.
There's also this PDU in the protocol that notifies on logon - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/885c1879-e0c8-4e2d-80c4-81acea9b51fb
I couldn't see how we can tap into it with the python library, but if you're having too many clipboard issues it might be a good place to start looking at alternatives.
Also, and it's something we didn't discuss but I just thought of, since the clipboard disabling is through the registry, it might be possible to affect that using remote registry, to ensure clipboard redirection

[cakekoa]

We can make the amount of time we're willing to wait for the desktop to load a configurable option in our exploiter

[akam-skupchik]

yeah having that configurable should be good

[ilija-lazoroski]

Follow up issue: #3522