1

I am an avid user of a reverse phone look up site (not naming any names) where you can look up a recent phone number that has called. One of the numbers involves the infamous "Windows Tech Support" phone scam.

Somebody had posted in the thread, claiming that they were able to form a "two-way connection" of sorts. They said that they allowed the scammer to connect to them in a sandbox OS via RDC, and he was able to gain access to the scammer's PC and see what he was doing while the scammer continued with the script.

I am wondering if this is possible, and how the "victim" could have accomplished that?

3
  • Given that what you're asking falls under the term "Hacking", I've voted for closing as: This question is not about computer hardware or software, within the scope defined in the help center.
    – LPChip
    Jul 12, 2014 at 13:17
  • 1
    I'd say it's fine to ask here. This is not necessarily about hacking, but also about preventing yourself from being scammed in a similar manner.
    – slhck
    Jul 12, 2014 at 17:07
  • That is a fantastic question and welcome to Super User! Anyone who works in security would be keen to learn about this (if they didn't already know). I apologise for the trigger-happy attitude of some of the other "moderators" on here. As a new user to this site you will soon learn that the biggest problem is over-zealous close votes. Once you learn how to phrase things in such a way as to avoid giving users like LPChip an excuse to close your question you will get more out of this site. The fact LPChip has the power to vote to close questions shows this site isn't perfect. Good luck! Jul 12, 2014 at 17:50

1 Answer 1

1

It's possible to "shadow" a rdp connection, but it would have to be on the "sandbox os" that was compromised... not on the remote attacker host. The person who is shadowing will be able to see everything the user is doing but only on the compromised host.

By default, a shadowee must explicitly give permission to allow their session to be shadowed. To be able to shadow without permission, the administrator must intentionally override this with a group policy set to allow shadowing without user permission.

There are limitations:

  • Only an administrator may shadow sessions.
  • Shadowing is not available in a workgroup.

How to shadow user? Must be on a server (Window Servers allow at least 2 remote connections). First get the SessionID of the user you want to shadow.

cmd prompt >query session

or open task manager and go to "Users" tab to find SessionID of a user.

Once you have the SessionID,

cmd prompt>shadow <-SessionID->

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .