Hey Brett, <div><br></div><div>Good question, I didn&#39;t cover this part in the blog. The difference you&#39;re seeing has to do with the fact that User X was logged into the console and then you connected via RDP as User X. In this case, applications in both sessions would run as User X. Thus there&#39;s no need for isolation and the two are merged together. In the example used in the blog, User X was logged into the console and User Y logged in via RDP. That way the attacker was able to connect and use the system without the user at the console being aware (I&#39;m sure you noticed when you logged into RDP as User X, it &quot;stole&quot; the display away from the console user). So what we did was analyze User Y&#39;s session and saw it included rdpclip.exe and RDPDD.dll, telling us User Y was logged in over RDP and not the console. If User Y was logged in from the console *and* at some point RDP, and had started applications on both sessions, we wouldn&#39;t really have a good way to determine which application was started from which session.</div>
<div><br></div><div>Hope that makes sense?</div><div>MHL</div><div><br></div><div><br><div class="gmail_quote">On Thu, Oct 4, 2012 at 6:31 PM, Brett Cunningham <span dir="ltr">&lt;<a href="mailto:brettcu@gmail.com" target="_blank">brettcu@gmail.com</a>&gt;</span> wrote:<br>

<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div>I RDP&#39;ed into another VM, opened notepad, regedit and cmd in order to reenact the sessions plugin. I didn&#39;t get the expected output as was on the blog post (<a href="http://volatility-labs.blogspot.com/2012/09/movp-11-logon-sessions-processes-and.html" target="_blank">http://volatility-labs.blogspot.com/2012/09/movp-11-logon-sessions-processes-and.html</a>). It shows up under the main RDP console ID. I&#39;m guessing that this is because I&#39;m using WinXP and it doesn&#39;t support multiple logins. Is this the reason?</div>


<div><br></div><div>$ vol.py sessions -f ~/vmware/VD/VD.vmem --profile=WinXPSP2x86</div><div>Volatile Systems Volatility Framework 2.2_rc2</div><div>**************************************************</div><div>Session(V): f7b0f000 ID: 0 Processes: 27</div>


<div>PagedPoolStart: bb800000 PagedPoolEnd bbbfffff</div><div> Process: 656 csrss.exe 2012-09-27 01:15:38 </div><div> Process: 680 winlogon.exe 2012-09-27 01:15:38 </div><div> Process: 724 services.exe 2012-09-27 01:15:38 </div>


<div> Process: 736 lsass.exe 2012-09-27 01:15:38 </div><div> Process: 888 vmacthlp.exe 2012-09-27 01:15:39 </div><div> Process: 900 svchost.exe 2012-09-27 01:15:39 </div><div> Process: 984 svchost.exe 2012-09-27 01:15:39 </div>


<div> Process: 1076 svchost.exe 2012-09-27 01:15:39 </div><div> Process: 1120 svchost.exe 2012-09-27 01:15:39 </div><div> Process: 1196 svchost.exe 2012-09-27 01:15:40 </div><div> Process: 1412 spoolsv.exe 2012-09-27 01:15:41 </div>


<div> Process: 1544 svchost.exe 2012-09-27 01:15:50 </div><div> Process: 1616 jqs.exe 2012-09-27 01:15:50 </div><div> Process: 1652 PortReporter.ex 2012-09-27 01:15:50 </div><div> Process: 1820 vmtoolsd.exe 2012-09-27 01:15:53 </div>


<div> Process: 1880 VMUpgradeHelper 2012-09-27 01:15:53 </div><div> Process: 508 alg.exe 2012-09-27 01:16:01 </div><div> Process: 1512 explorer.exe 2012-09-27 18:39:34 </div><div> Process: 1156 wscntfy.exe 2012-09-27 18:39:35 </div>


<div> Process: 1472 VMwareTray.exe 2012-09-27 18:39:58 </div><div> Process: 628 jusched.exe 2012-09-27 18:39:59 </div><div> Process: 1312 cmd.exe 2012-09-27 18:51:10 </div><div> Process: 2040 jucheck.exe 2012-09-27 18:51:17 </div>


<div> Process: 252 wuauclt.exe 2012-09-29 17:28:35 </div><div> Process: 824 rdpclip.exe 2012-09-29 17:28:43 </div><div> Process: 388 notepad.exe 2012-10-04 22:24:31 </div><div> Process: 268 regedit.exe 2012-10-04 22:24:34 </div>


<div> Image: 0x829596a0, Address bf800000, Name: win32k.sys</div><div> Image: 0x82abc2d8, Address bf000000, Name: dxg.sys</div><div> Image: 0x829d66e0, Address bffa0000, Name: ATMFD.DLL</div><div> Image: 0x82955e20, Address bff60000, Name: RDPDD.dll</div>


<div> Image: 0xbeff009c, Address c07bd878, Name: </div><div>**************************************************</div><div>Session(V): f7b6f000 ID: 3 Processes: 2</div><div>PagedPoolStart: bb800000 PagedPoolEnd bbbfffff</div>


<div> Process: 1032 csrss.exe 2012-09-29 17:28:42 </div><div> Process: 2004 winlogon.exe 2012-09-29 17:28:42 </div><div> Image: 0x82b83788, Address bf800000, Name: win32k.sys</div><div> Image: 0x8299eb70, Address bf000000, Name: dxg.sys</div>


<div> Image: 0x82b9de80, Address bf012000, Name: vmx_fb.dll</div><div> Image: 0x82a084c8, Address bffa0000, Name: ATMFD.DLL</div><div> Image: 0xbeff009c, Address c07bdb78, Name: </div><div>**************************************************</div>


<div>Session(V): f7b43000 ID: 1 Processes: 0</div><div>PagedPoolStart: bb800000 PagedPoolEnd bbbfffff</div></div><div><br></div>
<br>_______________________________________________<br>
Vol-users mailing list<br>
<a href="mailto:Vol-users@volatilityfoundation.org" target="_blank">Vol-users@volatilityfoundation.org</a><br>
<a href="http://lists.volatilityfoundation.org/mailman/listinfo/vol-users" target="_blank">http://lists.volatilityfoundation.org/mailman/listinfo/vol-users</a><br>
<br></blockquote></div><br></div>