Problem with RDP via mstsc client of Server 2025 (24H2) to Windows 10

[pmehax0r]

Hey,

Thanks for your great tool!

I just noticed that There is a problem for BitBlt to take a full screen capture when I have beacon on a machine via RDP, created by Server 2025 mstsc client.

I get the error "[-] [DEBUG] BitBlt failed for full screen capture". If i exit full screen (i.e freely resizeable RDP window) it captures it without a problem.

The problem exists with all 3 saving methods. The saving with all 3 methods completes but the end result is a captured image in black.

Would it be possible to have a look at it? I am not 100% sure if its the mstsc client on Server 2025 or all RDP clients.

Thanks !

[CodeXTF2]

Was the beacon injected into a process within the active desktop session/running in the desktop session?

[pmehax0r]

Yes, the beacon was spawned after initiating the RDP sessiod. I used CS generated executable with shellcode in it.

[pmehax0r]

Also, just confirmed that it works with full screen when I use an older mstsc client (the most visible difference between new vs old mstsc clients is the status bar on top, during the RDP session - the new is black, the old is blue)

[CodeXTF2]

I dont have a win server 2025 up right now to test, could you try changing line 740 and 741 (the failing line) on your end to

if (!pBitBlt(hDC, 0, 0, w, h, hScreen, x1, y1, SRCCOPY)) {
    DWORD errorCode = GetLastError();
    BeaconPrintf(CALLBACK_ERROR, "[DEBUG] BitBlt failed for full screen capture. Error code: %lu", errorCode);
}

and send the output error code

[pmehax0r]

having troubles with PW_RENDERFULLCONTENT. Any tips on fixing it ?

entry.cpp:660:46: error: 'PW_RENDERFULLCONTENT' was not declared in this scope
660 | success = pPrintWindow(hwnd, hdcMem, PW_RENDERFULLCONTENT);

[CodeXTF2]

weird im not getting that error. il add the debug message to the entry.cpp on the repo and you can try that i guess

EDIT: ok you can pull the change and try compiling it now

[pmehax0r]

It is not related to the changes, it is there for me, for some reason

[pmehax0r]

okay, compiled on another platform :)
Here is the error:

[CodeXTF2]

Error code 6 looks like a handle issue. il add some more error checking tomorrow and if i have time and push it, which may help.

[CodeXTF2]

ok pushed some additional debug prints, could you run it again and send the output? Thanks!

[pmehax0r]

Thanks for that mate :) Here is the result
[-] [DEBUG] BitBlt failed for full screen capture. Error code: 6
[-] [DEBUG] hDC: 0000000024013A26, hScreen: FFFFFFFFB2011645, old_obj: 000000000085000F
[-] [DEBUG] Screen region: x1: 0, y1: 0, width: 1920, height: 1200
[-] [DEBUG] hScreen appears invalid (pGetHandleInformation failed)
[-] [DEBUG] hDC appears invalid (pGetHandleInformation failed)

[CodeXTF2]

Ok pushed 2 more GetLastErrors at the GetHandleInformation parts. try running it again and send the error codes for those :D

Edit: wait lemme add some more stuff

[CodeXTF2]

ok try now

[pmehax0r]

I was maybe a bit too fast :D , will pull again

[pmehax0r]

I think its the same but let me know if I am missing something