Everyone knows that one person on the team who’s inexplicably lucky, the one who stumbles upon a random vulnerability seemingly by chance. A few days ago, my coworker Michael Weber was telling me about a friend like this who, on a recent penetration test, pressed the shift key five times at an RDP login screen and discovered the system had the sticky keys backdoor configured, giving him unauthenticated remote code execution as NT AUTHORITY\SYSTEM. This post covers how we built automated RDP sticky keys backdoor detection into Brutus, our open-source credential testing tool.
