Skip to content

Several fixes and improvements on oilrig.yaml#47

Open
mgonzcast wants to merge 1 commit into
attackevals:mainfrom
mgonzcast:patch-3
Open

Several fixes and improvements on oilrig.yaml#47
mgonzcast wants to merge 1 commit into
attackevals:mainfrom
mgonzcast:patch-3

Conversation

@mgonzcast

Copy link
Copy Markdown

After several tests, the main issue with the current code is that most of the time xdotool loses focus on the xfreerdp windows or the Linux host, where Caldera runs, grabs the keys sent to xfreerdp window like the Super_L or Ctrl+Shift+Escape keys.

This proposal has several advantages:

  • The main one: It´s better to use the Task Manager to run a cmd.exe. In case your Windows Server is running without GUI you can still RDP but Super_L key has no effect. This approach of running the Task Manager can work on both versions, with or without GUI.
  • The xdotool search command has been improved trying to avoid other xfreerdp windows opened by using head -n 1 filter.
  • Make sure you don´t lose focus on the window before you send the hot keys by setting the mouse right in the middle of the windows before sending any key.

The final Alt+F4 combination closes the Task Manager after spawning the cmd.exe window.

There are more changes:

  • ps.exe first time needs to accepteula, so I added the option to the command /accepteula

  • plink needs to accept the key the first time is run or run cmd.exe /c echo yes | plink ...

  • contact.aspx needs to be cleaned up from waterfalls in the cleanup via RDP

After several tests, the main issue with the current code is that most of the time xdotool loses focus on the xfreerdp windows or the Linux host, where Caldera runs, grabs the keys sent to xfreerdp window like the Super_L or Ctrl+Shift+Escape keys.

This proposal has several advantages:

- The main one:  It´s better to use the Task Manager to run a cmd.exe. In case your Windows Server is running without GUI you can still RDP but Super_L key has no effect. This approach of running the Task Manager can work on both versions, with or without GUI. 
- The xdotool search command has been improved trying to avoid other xfreerdp windows opened by using head -n 1 filter.
- Make sure you don´t lose focus on the window before you send the hot keys by setting the mouse right in the middle of the windows before sending any key. 

The final Alt+F4 combination closes the Task Manager after spawning the cmd.exe window.


There are more changes:

- ps.exe first time needs to accepteula, so I added the option to the command /accepteula

- plink needs to accept the key the first time is run or run cmd.exe /c echo yes | plink ...

- contact.aspx needs to be cleaned up from waterfalls in the cleanup via RDP

Signed-off-by: mgonzcast <63349279+mgonzcast@users.noreply.github.com>
@mgonzcast mgonzcast changed the title oilrig.yaml Several fixes and improvements on oilrig.yaml Jun 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant