DOCSEARCHbyAlgolia
Submit Docs

Aardwolf

repository·main·Indexed 42 days ago

https://github.com/skelsec/aardwolf

A headless, asynchronous Python client for interacting with RDP and VNC protocols, designed for security testing and protocol experimentation. Features include CredSSP authentication (NTLM or Kerberos), Pass-the-Hash support, SOCKS/HTTP proxy tunneling, and scriptable input/output via Duckyscript. Includes ardpscan for scanning protocol capabilities, screenshots, and logins.

Tokens
595
Snippets
1
Records
3
Agent score
4%

What's inside Aardwolf

  1. Overview of Aardwolf features

    main

    Aardwolf is a headless, asynchronous RDP and VNC client written in Python. It is designed for protocol experimentation and pentesting without requiring a GUI (no Qt dependency).

    Key features include:

    • Authentication: Supports CredSSP (via NTLM or Kerberos) and plain authentication.
    • Pass-the-Hash (PtH): Supported via CredSSP in Restricted Admin mode.
    • Proxy Support: Built-in proxy client for SOCKS/HTTP proxy tunneling.
    • Automation: Scriptable keyboard, mouse, and clipboard input/output, including support for Duckyscript files to emulate keystrokes.
    • Headless Operation: Can run entirely without a GUI.

  2. Use URL format for Aardwolf targets and credentials

    main

    Aardwolf scripts accept targets and credentials using a specific URL format. This allows you to specify the protocol, authentication method, credentials, target host, and proxy settings in a single string.

    RDP URL Formats

    • CredSSP (Kerberos) with Proxy: rdp+kerberos-password://DOMAIN\User:Password@host/?dc=DC_IP&proxytype=socks5&proxyhost=PROXY_IP&proxyport=PORT
    • CredSSP (NTLM) with Password: rdp+ntlm-password://DOMAIN\User:Password@host
    • CredSSP (NTLM) Pass-the-Hash: rdp+ntlm-password://DOMAIN\User:<NThash>@host
    • Plain RDP (No SSL, RC4): rdp+plain://User:Password@host

    VNC URL Formats

    • Plain VNC: vnc+plain://Password@host
    • VNC with Username and Password: vnc+plain://:User:Password@host (Note: If the password contains a : character, you must prepend the password with an additional :).
    # CredSSP (Kerberos) via SOCKS5 proxy
rdp+kerberos-password://TEST\Administrator:Passw0rd!1@win2016ad.test.corp/?dc=10.10.10.2&proxytype=socks5&proxyhost=127.0.0.1&proxyport=1080

# CredSSP (NTLM) Pass-the-Hash
rdp+ntlm-password://TEST\Administrator:<NThash>@10.10.10.103

# VNC with username and password
vnc+plain://:admin:aaa@10.10.10.103