A security tool that scans for Windows accessibility tools backdoors via automated RDP sessions.
Sticky-Keys-Slayer is a security tool that automates the detection of Windows accessibility tools backdoors via Remote Desktop Protocol (RDP). It connects to target hosts, simulates key presses to trigger tools like StickyKeys at the login screen, and identifies systems where a command prompt opens, indicating vulnerability. The tool helps security professionals efficiently scan for this classic attack vector in Windows environments.
Penetration testers, red teamers, and security researchers focused on Windows network security and vulnerability assessment.
Developers choose Sticky-Keys-Slayer for its automated, parallel scanning capabilities and visual detection of backdoors, offering a reliable and scriptable alternative to manual RDP testing for a specific but critical Windows security flaw.
Scans for accessibility tools backdoors via RDP
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
It handles multiple hosts in parallel via the 'parallel' dependency, enabling efficient batch testing of RDP-accessible systems as described in the README.
Uses imagemagick and xdotool to analyze screenshots and console output, flagging vulnerable systems when command prompt windows are detected and organizing results in './rdp-screenshots/discovered'.
Provides containerized execution with build and run examples, ensuring consistent environments and easy screenshot saving via volume mounts, as detailed in the Docker section.
Automatically saves screenshots in structured folders, segregating confirmed discoveries for quick review, which streamlines post-assessment analysis.
The 'To Do' list acknowledges issues like buggy handling of specified ports and whitespacing problems, which can reduce reliability in certain scanning scenarios.
Requires specific packages (imagemagick, xdotool, parallel, bc) that are Kali-centric, complicating installation on non-Kali Linux distributions without manual configuration.
Only targets Windows accessibility tool backdoors via RDP, making it ineffective for modern systems with patched vulnerabilities or non-Windows environments.