Hidden Desktop facilitates interaction with remote Windows desktops without user awareness, mimicking VNC functionality. This Cobalt Strike Beacon Object File (BOF) implementation provides an alternative to existing solutions built in C++. It achieves this by injecting HVNC shellcode into the Beacon process, establishing a connection to a remote server, and presenting a remote desktop session to the operator.
This project offers a lightweight and effective remote desktop solution integrated directly into Cobalt Strike. It builds upon existing HVNC implementations, leveraging the Beacon job interface for seamless deployment. The architecture allows for customization through Malleable C2 profiles and process injection techniques.
- Remote Desktop Session: Provides a fully functional remote desktop environment.
- Cobalt Strike Integration: Designed for use within Cobalt Strike frameworks.
- Reverse Port Forwarding: Utilizes reverse port forwarding for secure, outbound communication.
- Application Launching: Supports launching applications via command-line interface.
- Cross-Architecture Support: Tested across multiple Windows versions and architectures.
The project is relatively mature, with a clear implementation and documented usage. It has been tested on various Windows Server and desktop versions, indicating reasonable stability. However, known issues such as the non-functional start menu suggest ongoing development and potential areas for refinement. Active community support and regular updates indicate continued maintenance.
Hidden Desktop benefits security professionals requiring covert remote access within a compromised environment. It provides a value-added capability for post-exploitation activities, allowing for seamless execution of tasks on remote systems. It offers a practical approach for bypassing traditional remote access detection mechanisms and enabling persistent access.