0x09AL/RdpThief

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1469 stars · 361 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

RdpThief is a standalone DLL that, when injected into the mstsc.exe (Remote Desktop client) process, uses API hooking to extract clear-text credentials and save them to a file. It includes a Cobalt Strike aggressor script that manages injection by monitoring for new mstsc.exe processes and converting the DLL to shellcode via sRDI.

Use cases

• extract clear-text passwords from mstsc.exe during red team engagements
• hook Windows API calls in the RDP client to capture credentials
• inject shellcode into mstsc.exe processes automatically
• dump captured RDP credentials from a Cobalt Strike session
• demonstrate credential theft risks from remote desktop clients

When to choose

• you are running an authorized red team or penetration test on Windows environments
• you need to demonstrate the impact of credential theft from RDP clients
• you want a Cobalt Strike-integrated tool for harvesting mstsc.exe credentials

When to avoid

• you need a defensive or detection tool rather than an offensive one
• your target platform is not Windows
• you require a maintained tool with an active license and ongoing support
• credential harvesting is not permitted in your engagement scope

Facets

library · maturity maintenance

security cryptography developer-tools security penetration-testing windows windows cpp red-team credential-harvesting api-hooking dll-injection rdp cobalt-strike offensive-security

Member repositories

For agents

markdown · JSON · MCP: product_card(name="0x09AL/RdpThief")