Remote security baseline inspection method and device, electronic equipment and medium

Abstract

The invention relates to a remote security baseline inspection method and device, electronic equipment and a medium, and the method comprises the steps: building a remote desktop protocol RDP session with a target host, and mapping a local directory where a security inspection script is located to the target host; injecting an execution command of a security check script into the RDP session, so that the target host executes the security check script and writes a check result file into the local directory; and reading the check result file from the local directory to complete result recovery. Hidden and automatic security baseline check of the Windows host only opening the RDP can be realized by only depending on the RDP, and the target host does not need to open additional services or deploy agents, so that the method has high adaptability and high concealment.

Description

Technical Field

[0001] This disclosure relates to the field of communication technology, and in particular to a remote security baseline inspection method, apparatus, electronic device, and medium. Background Technology

[0002] With increasingly stringent information security requirements, security baseline checks have become a core means of ensuring the security of information systems, especially widely deployed Windows servers and endpoints. A security baseline aims to define a minimum security configuration standard for systems, applications, and network devices. By regularly reviewing key configuration items such as account policies, service status, patch versions, and audit logs, it promptly identifies and corrects configuration deviations to comply with requirements such as graded protection systems and ISO 27001, and effectively prevents security risks caused by improper configuration.

[0003] Currently, the technical solutions for implementing remote security baseline checks mainly rely on remote management protocols with command-line interaction capabilities. Specifically, there are two main types of solutions: 1. SSH protocol-based solution (primarily for Linux / Unix systems): This solution establishes an encrypted connection via the SSH (Secure Shell) protocol, uses the SCP (SecureCopy) function to transmit the inspection script, and executes the script directly in the remote shell to obtain the inspection results. This solution is mature and efficient, and is a standard practice in Linux environments. However, its fundamental drawback is that it is not suitable for Windows operating system environments that primarily use graphical interfaces and the RDP (Remote Desktop Protocol), thus limiting its applicability.

[0004] 2. Solution based on Windows native management protocol (for Windows systems): To meet the inspection requirements of Windows systems, existing technologies typically employ a combined protocol approach: File transfer: The inspection script is uploaded using the SMB (Server Message Block) protocol or an RDP session with file transfer capabilities.

[0005] Command execution: Relies on WMI (Windows Management Instrumentation), WinRM (Windows Remote Management), or the traditional Telnet protocol to execute scripts remotely.

[0006] However, this approach has significant drawbacks: it heavily relies on the target host having multiple network services (such as SMB and WinRM) pre-enabled and configured. In many high-security or restricted network environments that adhere to the principles of "least privilege" and "least attack surface," system administrators proactively disable all unnecessary remote management services and ports, retaining only the core RDP protocol for necessary graphical remote maintenance. In such strictly restricted scenarios, the aforementioned approach, which relies on the collaboration of multiple protocols such as SMB and WMI, completely fails, making it impossible to perform automated online security baseline checks on these hosts and creating a blind spot in security operations.

[0007] As the de facto standard for remote graphical access to Windows systems, the RDP protocol was designed to support interactive desktop operation and does not provide a standard command-line channel or programmatic execution interface. Therefore, even if the target host has an open RDP port, traditional techniques cannot use this protocol to automate the entire check process of "script delivery, command execution, and result collection".

[0008] In summary, existing technologies lack an effective solution for achieving automated, agentless security baseline checks in an extremely restricted environment where only the RDP protocol is open on the target host and all other remote management services are disabled. Summary of the Invention

[0009] This disclosure provides a remote security baseline inspection method, apparatus, electronic device, and medium that can perform covert and automated security baseline inspections on Windows hosts with only RDP enabled, relying solely on the RDP protocol. It does not require the target host to enable additional services or deploy an agent, and has high adaptability and strong covertness.

[0010] According to one aspect of the embodiments of this application, a remote security baseline check method is disclosed, wherein the method includes: establishing a Remote Desktop Protocol (RDP) session with a target host, mapping a local directory containing a security check script to the target host; injecting an execution command of the security check script into the RDP session, so that the target host executes the security check script and writes the check result file to the local directory; reading the check result file from the local directory, and completing the result retrieval.

[0011] As in this embodiment of the invention, before injecting the execution command of the security check script into the RDP session, the method further includes: injecting a desktop minimize shortcut key into the RDP session to minimize all non-system windows on the desktop of the target host.

[0012] As in this embodiment of the invention, before injecting the execution command of the security check script into the RDP session, the method further includes: injecting an input method switching shortcut key into the RDP session to lock the input method of the target host to English.

[0013] As in this embodiment of the invention, before injecting the execution command of the security check script into the RDP session, the method further includes: injecting a shortcut key combination for opening a command-line interface into the RDP session, so that the target host opens the command-line interface.

[0014] As in this embodiment of the invention, injecting the execution command of the security check script into the RDP session includes: obtaining the window identifier corresponding to the RDP session; converting the text content of the execution command into a keyboard scan code sequence; and injecting the keyboard scan code sequence into the session window corresponding to the window identifier to simulate keyboard input.

[0015] As in this embodiment of the invention, the method further includes: after reading the inspection result file from the local directory, deleting the security inspection script and the inspection result file from the local directory.

[0016] As in this embodiment of the invention, establishing a Remote Desktop Protocol (RDP) session with the target host includes: establishing an RDP session with the target host via a command-line RDP client; The step of mapping the local directory where the security check script is located to the target host includes: specifying the RDP protocol driver mapping parameters when establishing the RDP session to complete the mapping of the local directory.

[0017] According to one aspect of the embodiments of this application, a remote security baseline inspection device is disclosed, wherein the device includes: a session establishment module configured to establish a Remote Desktop Protocol (RDP) session with a target host and map a local directory containing a security inspection script to the target host; a command injection module configured to inject an execution command of the security inspection script into the RDP session, so that the target host executes the security inspection script and writes the inspection result file to the local directory; and a directory reading module configured to read the inspection result file from the local directory and complete the result retrieval.

[0018] As in this embodiment of the invention, the device further includes: a desktop minimization module, configured to inject a desktop minimization shortcut key into the RDP session to minimize all non-system windows on the desktop of the target host.

[0019] As in this embodiment of the invention, the device further includes: an input method switching module, configured to inject an input method switching shortcut key into the RDP session, and lock the input method of the target host to English.

[0020] As in this embodiment of the invention, the device further includes: a command-line interface module configured to inject a shortcut key combination for opening the command-line interface into the RDP session, so that the target host opens the command-line interface.

[0021] In this embodiment of the invention, the command injection module is configured to obtain the window identifier corresponding to the RDP session; convert the text content of the execution command into a keyboard scan code sequence; and inject the keyboard scan code sequence into the session window corresponding to the window identifier to simulate keyboard input.

[0022] As in this embodiment of the invention, the device further includes a result deletion module, configured to read the inspection result file from the local directory and then delete the security inspection script and the inspection result file in the local directory.

[0023] As in this embodiment of the invention, the session establishment module is configured to establish an RDP session with the target host via a command-line RDP client, and to specify the RDP protocol driver mapping parameters when establishing the RDP session in order to complete the mapping of the local directory.

[0024] According to one aspect of the embodiments of this application, an electronic device is disclosed, including: one or more processors; and a storage device for storing one or more programs, which, when executed by the one or more processors, cause the electronic device to implement the methods provided in the various optional implementations described above.

[0025] According to one aspect of the embodiments of this application, a computer program medium is disclosed, on which computer-readable instructions are stored, which, when executed by a computer's processor, cause the computer to perform the methods provided in the various optional implementations described above.

[0026] In this embodiment of the invention, a Remote Desktop Protocol (RDP) session is established with the target host, mapping the local directory containing the security check script to the target host. An execution command for the security check script is injected into the RDP session, causing the target host to execute the script and write the check result file to the local directory. The check result file is then read from the local directory, completing the result retrieval. This embodiment of the invention enables automated security baseline checks on target hosts (especially Windows hosts) in a restricted environment where only the RDP protocol is open. It cleverly utilizes the directory mapping function built into the RDP protocol to replace traditional file transfer protocols (such as SMB and FTP), achieving agentless and port-free delivery of the security check script. Furthermore, by simulating keyboard events injected into the RDP session window, the problem that the RDP protocol itself cannot directly execute command-line instructions is solved, thereby remotely triggering script execution. Finally, the script execution result is automatically returned to the checking end through the same mapped directory, forming a complete closed-loop process of "file delivery → command execution → result retrieval." This method breaks through the dependence on conventional remote management protocols (such as SSH and WMI), achieving covert and automated security checks under a minimized attack surface configuration.

[0027] Other features and advantages of this application will become apparent from the following detailed description, or may be learned in part from practice of this application.

[0028] It should be understood that the above general description and the following detailed description are merely exemplary and do not limit this application. Attached Figure Description

[0029] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0030] Figure 1 A flowchart of the remote security baseline check method provided in this application is shown.

[0031] Figure 2 Another flowchart of the remote security baseline inspection method provided in this application is shown.

[0032] Figure 3 A block diagram of the remote security baseline inspection device provided in this application is shown.

[0033] Figure 4 A block diagram of the electronic device provided in this application is shown. Detailed Implementation

[0034] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that this disclosure will be more comprehensive and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0035] Furthermore, the accompanying drawings are merely illustrative of this disclosure, and the same reference numerals in the drawings denote the same or similar parts, thus repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0036] The remote security baseline inspection method proposed in this invention will be described in detail below with reference to specific embodiments. The executing entity of this invention is a device or system that implements the remote security baseline inspection method or carries the inspection device / electronic device. For example, the executing entity can be an automated system running on an "inspection terminal" (such as an administrator machine or security audit server). This system is typically based on operating systems such as Linux or Windows, and integrates or calls a command-line RDP client (such as xfreerdp) and a keyboard event injection tool (such as a self-developed KeyTool). The core responsibility of the executing entity is to proactively initiate and control the entire inspection process, including establishing an RDP session, mapping directories, injecting a series of keyboard events into the session to manipulate the remote target host, and finally collecting and processing the inspection results.

[0037] In this embodiment of the invention, the target host refers to a Windows operating system computer that needs to undergo security checks. In this embodiment, the host can be in a specific network configuration environment: only the RDP protocol port (such as 3389) is open, while all other services or ports used for remote management and file transfer, such as SSH, WinRM, WMI, SMB, FTP, etc., are closed or disabled. This makes the target host "immune" to traditional automated security baseline checks.

[0038] In this embodiment of the invention, the only formal and permitted network communication protocol between the executing entity and the target host is RDP. The executing entity does not rely on any additional background services or daemons on the target host, but utilizes the standard RDP functions that are already enabled and required on the target host to achieve its purpose.

[0039] The execution entity of this invention does not directly call remote APIs or execute commands via the RDP protocol. Instead, it establishes an RDP session (usually in silent or background mode) and utilizes RDP's drive mapping function to place the inspection script file into a virtual drive visible to the target host. Then, by injecting precise keyboard events (such as Win+R, entering a command, pressing Enter, etc.) into the RDP session window, it simulates the process of a user manually opening a command line and executing a script in a remote desktop. This relationship essentially uses the Graphical Interactive Protocol (RDP) for non-interactive automation tasks.

[0040] Figure 1 A flowchart of the remote security baseline check method provided in this application is shown. The execution subject of this method is illustrated using the client as an example. Figure 1 As shown, the method may include, but is not limited to, the following steps: Step S110: Establish a Remote Desktop Protocol (RDP) session with the target host and map the local directory where the security check script is located to the target host.

[0041] In this embodiment of the invention, the client, also known as the inspection end, establishes an RDP session with the target host via a command-line RDP client. Specifically, a command-line RDP client (such as the open-source tool xfreerdp) is used to initiate a connection to the target Windows host. When establishing the RDP session, drive mapping parameters for the RDP protocol are specified to complete the mapping of the local directory. Specifically, the key to establishing the connection command is specifying a mapping relationship through a specific parameter (such as / drive). The typical format of this command is: xfreerdp / v:[target host IP] / u:[username] / p:[password] / drive:[remote drive name],[local directory path] This command will perform two tasks simultaneously: 1. Establish a session. After successful authentication, an RDP session is established in the background. Importantly, this session can run in a minimized or hidden mode without popping up a graphical interface, thus laying the foundation for automated operations; 2. Complete the mapping. The parameter / drive:Checks, / home / local / path means that the / home / local / path directory on the execution subject's local machine will be mapped to the target host operating system and presented as a virtual drive named Checks: (similar to C: drive and D: drive).

[0042] This mapping takes effect instantly and transparently. For the target host, the Checks: drive behaves like a locally connected USB storage device or network drive, with its internal file structure and content perfectly synchronized in real-time with the client's local directory / home / local / path. Therefore, security check scripts placed in the local directory (such as detect.vbs or check.ps1) can be directly accessed in the target host's file system via the path Checks:\detect.vbs after the RDP session is established.

[0043] In this embodiment of the invention, the file transfer problem is transformed into a one-time RDP connection configuration problem. Traditional online detection solutions rely on independent file transfer protocols such as SMB, FTP, or SCP, which are often disabled on highly secure, locked hosts. This step completely avoids this dependency, utilizing only the widely supported and allowed functions of the RDP protocol itself to achieve the "delivery" of script files from the inspection end to the target host, thus removing the primary obstacle to performing automated inspections in extremely restricted environments where only RDP ports are open. This is not only a crucial step in achieving the functionality but also embodies the security design philosophy of this invention: "fully utilizing existing protocols without increasing the attack surface."

[0044] Step S120: Inject the execution command of the security check script into the RDP session so that the target host executes the security check script and writes the check result file to the local directory.

[0045] In this embodiment of the invention, before injecting the execution command of the security check script into the RDP session, the client (i.e. the execution subject) first performs a "desktop minimize" operation, injecting a desktop minimize shortcut key into the RDP session to minimize all non-system windows on the desktop of the target host.

[0046] After an RDP session is established, the remote desktop (i.e., the target host) may be in any state: it may be opening a web browser, text editor, file explorer, or other application window. If keyboard events are injected directly (such as opening the Run dialog box with Win+R), these keystrokes may be received and responded to by the currently focused foreground non-target window, causing commands to be entered in the wrong place, such as entering a script path in the browser address bar, and the entire check process will fail completely.

[0047] Therefore, injecting a desktop minimize shortcut (such as the Windows "Show Desktop" shortcut combination Win + D) into the RDP session minimizes all non-system windows on the target host's desktop. This forces all open application windows to be minimized to the taskbar, returning the focus to the cleanest, most basic "desktop" environment. This is a system-level operation that ensures all subsequent simulated keyboard inputs affect the system desktop itself, providing a stable and predictable starting point for the next step (such as bringing up the system run dialog box via Win + R).

[0048] In this embodiment of the invention, the client does not call the target host's window management functions through a remote API. Instead, it uses a keyboard event injection tool (such as KeyTool) to simulate the physical action of pressing the Win key and the D key. The injection tool then sends the keyboard scan code sequence corresponding to these two keys to the established RDP session window through the underlying system interface (such as xdotool in X11 or SendInput in Windows).

[0049] This process perfectly simulates the habitual action of a real user sitting in front of the target host and "clearing the desktop" before starting a new task. It does not rely on any special scripts or services running on the target host, but only on the general response of the Windows operating system to standard keyboard shortcuts.

[0050] This step, together with subsequent steps such as "locking the input method" and "opening the command line window," constitutes a robust pre-operation preparation stage. This stage is designed to overcome the inherent limitation of the RDP protocol itself, which was not designed for automated command-line operations. Through a series of precise simulation operations, a graphical user interface is transformed into a pseudo-command-line environment that can be driven by automated scripts.

[0051] This operation is far more than a simple interface cleanup. It is a fundamental safeguard to ensure that subsequent complex automated processes can be executed reliably and repeatedly, reflecting the invention's full consideration of the complexity of the actual operating environment and its refined control over the success rate of the operation.

[0052] In this embodiment of the invention, before injecting the execution command of the security check script into the RDP session, an input method switching shortcut key can also be injected into the RDP session to lock the input method of the target host in English mode. This step aims to solve a crucial but easily overlooked detail in automated text input: character ambiguity and command parsing failure caused by input method status. The target host (usually a Windows system) may be set to Chinese or other non-English input method status by default or by previous user operations. In this state, directly injected keyboard events (such as inputting the path Checks:\script\detect.vbs) may be recognized by the system as Pinyin encoding, thus outputting Chinese characters, or causing key separators such as backslashes \ and colons : in the path to be entered incorrectly, ultimately causing the script execution command to fail due to format errors.

[0053] To address this issue, this invention, before injecting the core command, simulates and injects specific input method switching shortcuts (such as Shift, Ctrl + Space, or Win + Space) into the RDP session, forcibly switching and locking the target host's current input method to English. This is a standard control operation for the operating system's Input Method Editor (IME). The injection tool KeyTool also converts this shortcut into a scan code sequence and sends it, ensuring that the remote system's text input context is preset to the ASCII character set before command input begins, thus guaranteeing that each subsequent simulated keystroke outputs the expected English letters, numbers, and symbols.

[0054] In this embodiment of the invention, before injecting the execution command of the security check script into the RDP session, the client may also inject a shortcut key combination for opening the command line interface into the RDP session, so that the target host can open the command line interface.

[0055] In this embodiment of the invention, a standard terminal environment capable of receiving and executing text commands is created within the target host's RDP graphical interface; this environment is either the Windows Command Prompt (CMD) or PowerShell window. Since the RDP protocol itself does not have an interface for directly executing remote commands, this invention employs a method that simulates the most common user operation path: by injecting the system-level shortcut key combination Win + R, the Windows Run dialog box is brought up. Subsequently, by injecting cmd or PowerShell command text into this dialog box and simulating pressing the Enter key, a command-line window can be successfully launched.

[0056] This process relies entirely on the precise simulation of keyboard events. The client uses tools like KeyTool to convert actions such as "pressing the Win key," "pressing the R key," "typing the characters c, m, d," and "pressing the Enter key" into corresponding keyboard scan code sequences, which are then injected into the focus window of the RDP session. This is equivalent to "creating" a command-line interface on the remote desktop, providing the essential command input carrier and execution engine for subsequently injecting and executing specific security check scripts.

[0057] It should be noted that the steps to open the command-line interface, together with the aforementioned steps of minimizing the window and switching the input method, constitute a tightly linked and logically rigorous pre-operation initialization sequence. Their execution order should be: minimize window → switch input method → ​​open command-line interface.

[0058] Step 1: Minimize the window (laying the physical foundation) Function: Injects Win+D, clearing all application windows that might be in the foreground and forcibly pulling the operating system's focus back to the bottom-level desktop. This is an absolute prerequisite for all subsequent system-level shortcuts (whether it's switching input methods or running dialog boxes) to be correctly captured and responded to by the operating system's global hooks. Without a clean desktop focus, subsequent shortcuts may be swallowed up by other applications.

[0059] Step 2: Switch input method (preset software environment) Function: After gaining focus on the desktop, injecting a shortcut like Ctrl+Space or Win+Space locks the system's text input mode to English. This operation must be completed before opening the command line interface because the input method mode applies to the entire user session. If you switch after opening the CMD window, the input method mode may already be in Chinese, potentially causing errors with the first character typed in CMD. Globally locking the English mode ensures that the input environment is correct from the moment the command line window appears.

[0060] Step 3: Open the command-line interface (enable the operation tool). Function: After ensuring a clean and stable state with "focus on the desktop" and "input method in English" in the first two steps, press Win+R to open the Run dialog box and type cmd to launch the command line. At this point, because the focus is on the desktop, Win+R can be recognized by the system; because the input method is in English, the entered c, m, and d characters can be accurately displayed as English commands. The command line window opened in this way has an initial input state in English, clearing the final obstacle for subsequently entering complex script path commands.

[0061] In this embodiment of the invention, the client injects a security check script execution command into the RDP session, which can be achieved by obtaining the window identifier corresponding to the RDP session, converting the text content of the execution command into a keyboard scan code sequence, and injecting the keyboard scan code sequence into the session window corresponding to the window identifier to simulate keyboard input.

[0062] In this embodiment of the invention, the injection of security check script execution commands from the client into the RDP session can be achieved using a dedicated input simulation tool (hereinafter referred to as KeyTool). This tool is responsible for converting the command text into underlying input events and injecting them into the target window. The specific execution flow is as follows: First, the window identifier is dynamically obtained.

[0063] KeyTool first automatically obtains the graphical window identifier (WindowID) corresponding to the current xfreerdp client process. This operation is achieved by querying the mapping relationship between operating system processes and windows (e.g., through xdotoolsearch in X11 environment or through the FindWindow series APIs in Windows environment), ensuring that subsequent input events can be accurately located to the target RDP session viewport, and avoiding events being intercepted or mistakenly received by other windows.

[0064] Second, character-by-character conversion from text to keyboard scan code.

[0065] KeyTool receives the input text string (e.g., Checks:\\script\\detect.vbs) and parses it character by character into the corresponding keyboard scan code sequence according to the system keyboard layout mapping table. This process not only handles visible characters but also includes accurate mapping of key symbols such as path separators (backslashes) and driver identifiers (colons), and generates two types of event data for each key: "pressed" and "released," to simulate the timing of real keyboard input.

[0066] Third, events are delivered through the underlying interfaces of the operating system.

[0067] KeyTool calls the low-level input injection interface provided by the operating system to send the generated keyboard scan code sequence to the session window corresponding to the specified window ID. In the X11 environment, the xdotool tool is usually used or the XTestFakeKeyEvent function is called directly; in the Windows environment, the SendInput function is used. These interfaces can bypass the user-mode input queue and directly insert events into the system input stream, ensuring that the events are captured and encapsulated for transmission by the RDP protocol stack.

[0068] Fourth, it automatically triggers command execution.

[0069] After injecting the script path string, KeyTool automatically appends a scan code event for the Enter key to simulate user confirmation and trigger the script execution process in the target host's command-line interface.

[0070] An example call is provided in this embodiment of the invention as follows: bash KeyTool --windowId=$id "Checks:\\script\\detect.vbs".

[0071] This technical approach offers the following advantages: it is entirely based on the existing keyboard event transmission capabilities of the RDP protocol, requiring no protocol extensions or reliance on other services. It eliminates the need to deploy agents or enable additional management interfaces on the target host, making it suitable for isolated environments with strict security policies and only open RDP ports. At the system auditing level, the injected event sequence shares the same characteristics as manual keyboard operations, enabling the covert execution of the automated process.

[0072] Step S130: Read the inspection result file from the local directory to complete the result collection.

[0073] In this embodiment of the invention, based on a bidirectional data flow design using the same mapping channel, when establishing an RDP session, the client maps a local directory (e.g., / home / local / path) to a virtual drive on the target host (e.g., Checks:). Here, "local directory" specifically refers to the directory mapped to the target host using the RDP protocol's drive mapping function (e.g., the / drive parameter) when establishing the RDP session. Locally, it is a regular folder; on the target host, it appears as a network drive letter (e.g., Checks: or E:). After the security check script executed by the target host finishes running, it actively writes to the path represented by the mapped drive letter. Due to the real-time nature of RDP mapping, this file will synchronously appear in the corresponding local directory after being written to the remote drive. This mapping establishes a logically unified shared storage space. Under this architecture: Input side: The security check script is stored in a subpath under this logical space (e.g., Checks:\\script\\, corresponding to local / home / local / path / script / ).

[0074] Output side: The security check script is pre-programmed to write its results to another specified subpath under this logical space (e.g., Checks:\\results\\, corresponding to local / home / local / path / results / ).

[0075] Although the script and results are logically stored separately, they are both accessed through the same RDP drive mapping. Therefore, the script's writing operation to the file Checks:\\results\\ on the target host is synchronized in real time to the client's local / home / local / path / results / directory via the RDP protocol.

[0076] After the client triggers script execution, it no longer needs to actively pull the result files from the target host via additional network protocols. Instead, the client can directly access the synchronized result files by monitoring the corresponding output subdirectories under the local mapped directory (such as / home / local / path / results / ). The client can implement polling or file system event listening mechanisms to confirm that the result files have been completely generated and synchronized. This process transforms result retrieval from a remote file transfer problem into a local file system read operation problem, significantly improving reliability and efficiency.

[0077] Once the result file is confirmed to be usable, the client reads its contents from the local directory for subsequent parsing and processing. After reading the inspection result file from the local directory, the client can delete the security inspection script and the inspection result file from the local directory to eliminate any trace of the operation, meeting the concealment requirements of security auditing. At this point, the entire automated closed-loop security detection process of "script delivery—remote execution—result feedback" is complete.

[0078] The core advantage of this technology lies in its ability to fully reuse existing RDP directory mapping channels for result recycling, without introducing any additional file transfer services or protocols, thus maintaining the simplicity and high applicability of the technical solution. Leveraging the RDP protocol's real-time synchronization support for mapped drives, it ensures that result files are accessible locally once generated, avoiding the risk of data inconsistency due to network latency or transmission interruptions. On the target host side, result writing behaves as a normal local disk I / O operation; at the network layer, no separate file transfer session is generated. This makes the entire recycling process difficult to detect in conventional system and network auditing, achieving true covert detection.

[0079] In this embodiment of the invention, the result retrieval mechanism cleverly uses the RDP directory mapping as both an input and output channel, and leverages its real-time synchronization characteristics between the target host and the client to achieve automated and localized collection of detection results. This not only completes the technical loop but is also one of the key design features of this solution enabling unattended security baseline detection in a strict environment where only RDP is open.

[0080] In existing technologies, the Remote Desktop Protocol (RDP) has been maturely deployed as a standardized solution for remote access to Windows systems' graphical interfaces. However, the core design goal of this protocol is to support interactive graphical sessions. Its data transmission model is based on bidirectional transmission of screen bitmap updates, pointer device events, and keyboard events, lacking native support for non-interactive, batch command execution and structured data return. In the field of automated security baseline detection, existing solutions generally rely on protocols with standard input / output stream management capabilities, such as SSH or WinRM, to achieve remote script execution and direct capture of results. Therefore, although RDP is prevalent in remote management scenarios, its protocol characteristics are incompatible with the machine-to-machine communication paradigm of automated detection, resulting in its exclusion from the mainstream online security baseline detection technology system.

[0081] This invention redefines the RDP protocol as a programmable, automated command execution channel by introducing a keyboard event injection mechanism. Specifically, this solution constructs a systematic method: First, utilizing the RDP protocol's drive mapping function, a logical association is established between the local detection script directory and the remote host file system, enabling seamless delivery of the detection payload. Then, a dedicated tool converts the text sequence of the command to be executed into a corresponding keyboard scan code sequence and calls the operating system's underlying input interface to precisely inject this event sequence into the specified RDP session window. This process simulates user keyboard input behavior, thereby triggering the command-line interpreter on the remote host to execute a preset security check script. Finally, the script output is redirected to the same mapped drive path and automatically returned to the local directory on the detection end through the protocol synchronization mechanism, completing the closed-loop recovery of results. The core advantage of this method is that it relies solely on the basic RDP service port, without requiring any additional management services or agent deployments on the target host, achieving non-invasive, covert, and automated detection even in environments with strict network policies.

[0082] In this embodiment of the invention, after the security check script is executed on the target host, its output mechanism is designed to write the structured detection results (such as JSON, XML, or plain text format) to a predefined output directory, such as the path Checks:\results\ under a mapped drive. This directory has established real-time logical synchronization with the corresponding directory of the local detection system through the drive mapping function of the RDP session. Therefore, the result files can be directly accessed in the local mapped directory the moment they are generated and written on the remote host, realizing instant localization of data. To reliably determine the script execution status, the detection end can implement a polling strategy to periodically check the existence and integrity of the result files in the local output directory, or combine it with a preset timeout threshold to prevent indefinite waiting due to script anomalies, thereby ensuring the robustness of the result retrieval process.

[0083] To ensure the concealment of the operation and maintain the cleanliness of the target host's system resources, remote trace cleanup is required after the script execution is complete and the results are confirmed to be successfully recovered. This process involves injecting a system shortcut key (such as Alt + F4) or the text command "exit" into the RDP session window via KeyTool to close the previously opened command-line interpreter window. This aims to terminate the user-space processes related to the detection, eliminating the possibility of leaving obvious audit trails in the target host's task manager or process list. Subsequently, the detection end proactively initiates an RDP session termination command to completely release the network connection and system session resources used in this inspection, ensuring that no persistent active sessions or processes remain on the remote host after the entire inspection activity is completed, complying with the principle of minimal trace security operation.

[0084] This invention enables automated security baseline checks on target hosts (especially Windows hosts) in a restricted environment where only the RDP protocol is open. It cleverly utilizes the directory mapping function built into the RDP protocol to replace traditional file transfer protocols (such as SMB and FTP), achieving agentless and port-free delivery of security check scripts. Furthermore, by simulating keyboard events injected into the RDP session window, it solves the problem that the RDP protocol itself cannot directly execute command-line instructions, thereby remotely triggering script execution. Finally, the script execution results are automatically returned to the checking end through the same mapped directory, forming a complete closed-loop process of "file delivery → command execution → result collection". This method breaks through the dependence on conventional remote management protocols (such as SSH and WMI), achieving covert and automated security checks with a minimized attack surface configuration.

[0085] The following is combined with Figure 2 The remote security baseline check method in the embodiments of the present invention will be described in more detail. For example... Figure 2 As shown, the method may include, but is not limited to, the following steps: Step S201: Establish a Remote Desktop Protocol (RDP) session with the target host and map the local directory where the security check script is located to the target host.

[0086] In this embodiment of the invention, the command-line client xfreerdp from the open-source FreeRDP project is used to initiate an RDP connection with the target Windows host. The local directory storing the security check scripts (e.g., / home / local / path) is mapped to a network drive (e.g., Checks:) on the remote host system using the / drive parameter. This mapping is automatically configured when the RDP session is established, allowing the target host to directly read files on the mapped drive as if they were local disks. An example command is: xfreerdp / v:192.168.1.100 / u:admin / p:password / drive:Checks, / home / local / path. This step achieves remote delivery of script files without relying on additional file transfer protocols such as SMB or FTP.

[0087] Step S202: Inject a desktop minimize shortcut into the RDP session to minimize all non-system windows on the desktop of the target host.

[0088] In this embodiment of the invention, to ensure that subsequent simulated keyboard events can be received by the correct system components, all open user application windows on the target host's remote desktop must first be minimized. By injecting the Win + D shortcut key combination into the RDP session window, the user can be simulated to perform a "show desktop" operation, thereby minimizing all non-system windows to the taskbar and forcing the focus to the system desktop. This step creates a clean initial interface environment for subsequent system-level operations.

[0089] Step S203: Inject an input method switching shortcut key into the RDP session to lock the input method of the target host to English.

[0090] In this embodiment of the invention, to avoid incorrect conversion or parsing of subsequently entered command text (especially special characters such as backslashes \ and colons : in paths) due to the target host's current input method state (such as Chinese input method), it is necessary to unify the input environment before executing critical commands. By injecting system-preset input method switching shortcuts such as Ctrl + Space or Win + Space into the RDP session, the target host's current input method can be forcibly switched and locked to English, thereby ensuring that all subsequent simulated keyboard input characters can be output as expected.

[0091] Step S204: Inject a shortcut key combination for opening the command-line interface into the RDP session so that the target host can open the command-line interface.

[0092] In this embodiment of the invention, to obtain a command-line environment for executing security check scripts, a command prompt (CMD) or PowerShell window needs to be launched on the target host. By injecting the Win + R shortcut into the RDP session to open the system's "Run" dialog box, and then injecting the cmd or PowerShell command text and simulating pressing the Enter key, the command-line interface can be successfully launched. This operation simulates a standard manual operation process and has good system version compatibility.

[0093] Step S205: Inject the execution command of the security check script into the RDP session.

[0094] In this embodiment of the invention, a dedicated keyboard event injection tool (hereinafter referred to as KeyTool) is used to inject complete script execution commands into an established xfreerdp session window. KeyTool's core functions include: a) automatically obtaining the window identifier (Window ID) corresponding to the current xfreerdp client process; b) converting the input command text string (e.g., Checks:\script\detect.vbs) character by character into the corresponding keyboard scan code sequence; c) accurately delivering the generated keyboard scan code event sequence to the target window by calling the operating system's underlying input interface (e.g., using xdotool in X11 environment, and SendInput in Windows environment). After command injection is complete, the tool automatically appends an Enter key event to trigger command execution. A typical calling format is: KeyTool --windowId=$id "Checks:\\script\\detect.vbs".

[0095] Step S206: Read the inspection result file from the local directory to complete the result collection.

[0096] In this embodiment of the invention, when the security check script is executed on the target host, it is configured to write its output detection results (usually in JSON, XML, or text format) to a preset mapped drive output directory (e.g., Checks:\results\). Since this directory is mapped to the local machine via RDP, the script write operation is synchronized to the corresponding local directory in real time. The detection end can determine whether the result file has been generated and synchronized by polling this local directory or by combining it with a timeout mechanism, and then directly read the result file from the local path, thereby completing the retrieval of result data without the need for additional network transmission protocols.

[0097] Step S207: Clean up remote execution traces.

[0098] In this embodiment of the invention, after the script execution and result collection are completed, in order to eliminate operation traces on the target host, it is necessary to inject the Alt + F4 shortcut key or the exit command text into the RDP session via KeyTool to close the previously opened command line interface window. This terminates the relevant user processes and avoids leaving obvious session traces. Subsequently, the detection end actively terminates the RDP session connection, releasing network and system resources.

[0099] Step S208: Clean up the local mapped directory.

[0100] In this embodiment of the invention, on the local detection end, used security check script files and recycled result files in the mapping directory are deleted, and temporary data stored locally during this check process is cleared. This step further enhances the stealth and security of the entire operation, ensuring that no unnecessary logs or cached information are left on the detection end.

[0101] This invention enables automated security baseline checks on target hosts (especially Windows hosts) in a restricted environment where only the RDP protocol is open. It cleverly utilizes the directory mapping function built into the RDP protocol to replace traditional file transfer protocols (such as SMB and FTP), achieving agentless and port-free delivery of security check scripts. Furthermore, by simulating keyboard events injected into the RDP session window, it solves the problem that the RDP protocol itself cannot directly execute command-line instructions, thereby remotely triggering script execution. Finally, the script execution results are automatically returned to the checking end through the same mapped directory, forming a complete closed-loop process of "file delivery → command execution → result collection". This method breaks through the dependence on conventional remote management protocols (such as SSH and WMI), achieving covert and automated security checks with a minimized attack surface configuration.

[0102] Figure 3 A block diagram of the remote security baseline inspection apparatus provided in this application is shown, the apparatus comprising: Session establishment module 310 is configured to establish a Remote Desktop Protocol (RDP) session with the target host and map the local directory where the security check script is located to the target host. Command injection module 320 is configured to inject an execution command of a security check script into the RDP session, so that the target host executes the security check script and writes the check result file to the local directory; The directory reading module 330 is configured to read the inspection result file from the local directory and complete the result collection.

[0103] In an exemplary embodiment of this application, the apparatus further includes a desktop minimization module 340, configured to inject a desktop minimization shortcut key into the RDP session to minimize all non-system windows on the desktop of the target host.

[0104] In an exemplary embodiment of this application, the device further includes: an input method switching module 350, configured to inject an input method switching shortcut key into the RDP session and lock the input method of the target host to English.

[0105] In an exemplary embodiment of this application, the apparatus further includes a command-line interface module 360, configured to inject a shortcut key combination for opening the command-line interface into the RDP session, so that the target host opens the command-line interface.

[0106] In an exemplary embodiment of this application, the command injection module 320 is configured to obtain the window identifier corresponding to the RDP session; convert the text content of the execution command into a keyboard scan code sequence; and inject the keyboard scan code sequence into the session window corresponding to the window identifier to simulate keyboard input.

[0107] In an exemplary embodiment of this application, the apparatus further includes a result deletion module 370, configured to delete the security check script and the check result file in the local directory after reading the check result file from the local directory.

[0108] As in this embodiment of the invention, the session establishment module 310 is configured to establish an RDP session with the target host through a command-line RDP client, and to specify the RDP protocol driver mapping parameters when establishing the RDP session in order to complete the mapping of the local directory.

[0109] This invention enables automated security baseline checks on target hosts (especially Windows hosts) in a restricted environment where only the RDP protocol is open. It cleverly utilizes the directory mapping function built into the RDP protocol to replace traditional file transfer protocols (such as SMB and FTP), achieving agentless and port-free delivery of security check scripts. Furthermore, by simulating keyboard events injected into the RDP session window, it solves the problem that the RDP protocol itself cannot directly execute command-line instructions, thereby remotely triggering script execution. Finally, the script execution results are automatically returned to the checking end through the same mapped directory, forming a complete closed-loop process of "file delivery → command execution → result collection". This method breaks through the dependence on conventional remote management protocols (such as SSH and WMI), achieving covert and automated security checks with a minimized attack surface configuration.

[0110] The following is for reference. Figure 4To describe the electronic device 40 according to an embodiment of this application. Figure 4 A block diagram of the electronic device provided in this application is shown. Figure 4 The electronic device 40 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0111] like Figure 4 As shown, the electronic device 40 is manifested in the form of a general-purpose computing device. The components of the electronic device 40 may include, but are not limited to: at least one processing unit 410, at least one storage unit 420, and a bus 340 connecting different system components (including storage unit 420 and processing unit 410).

[0112] The storage unit stores program code that can be executed by the processing unit 410, causing the processing unit 410 to perform the steps described in the exemplary method description section of this specification according to various exemplary embodiments of the present invention. For example, the processing unit 410 can perform actions such as... Figure 1 and Figure 2 The steps shown are as follows.

[0113] Storage unit 420 may include a readable medium in the form of a volatile storage unit, such as random access memory (RAM) 4201 and / or cache memory 4202, and may further include a read-only memory (ROM) 4203.

[0114] Storage unit 420 may also include a program / utility 4204 having a set (at least one) program module 4205, such program module 4205 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0115] Bus 430 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0116] Electronic device 40 can also communicate with one or more external devices 500 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 40, and / or with any device that enables electronic device 40 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 450. Input / output (I / O) interface 450 is connected to display unit 440. Furthermore, electronic device 40 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 460. As shown, network adapter 460 communicates with other modules of electronic device 40 via bus 430. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 40, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0117] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this application.

[0118] In an exemplary embodiment of this application, a computer-readable storage medium is also provided, on which computer-readable instructions are stored, which, when executed by a computer's processor, cause the computer to perform the methods described in the above method embodiments.

[0119] According to one embodiment of this application, a program product for implementing the methods in the above-described method embodiments is also provided. This product may employ a portable compact disc read-only memory (CD-ROM) and include program code, and may run on a terminal device, such as a personal computer. However, the program product of this invention is not limited thereto. In this document, a readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0120] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0121] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0122] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0123] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as JAVA and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0124] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0125] Furthermore, although the steps of the method in this application are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0126] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this application.

[0127] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the appended claims.

Claims

1. A remote security baseline inspection method, characterized in that, The method includes: Establish a Remote Desktop Protocol (RDP) session with the target host and map the local directory where the security check script is located to the target host; Inject a security check script execution command into the RDP session so that the target host executes the security check script and writes the check result file to the local directory; The inspection result file is read from the local directory to complete the result collection.

2. The method according to claim 1, characterized in that, Before injecting the execution command of the security check script into the RDP session, the method further includes: Inject a desktop minimize shortcut into the RDP session to minimize all non-system windows on the target host's desktop.

3. The method according to claim 1, characterized in that, Before injecting the execution command of the security check script into the RDP session, the method further includes: Inject an input method switching shortcut into the RDP session to lock the input method of the target host to English.

4. The method according to claim 1, characterized in that, Before injecting the execution command of the security check script into the RDP session, the method further includes: Inject a shortcut key combination for opening a command-line interface into the RDP session so that the target host can open the command-line interface.

5. The method according to claim 1, characterized in that, The execution command for injecting the security check script into the RDP session includes: Obtain the window identifier corresponding to the RDP session; The text content of the execution command is converted into a keyboard scan code sequence; The keyboard scan code sequence is injected into the session window corresponding to the window identifier to simulate keyboard input.

6. The method according to claim 1, characterized in that, The method further includes: After reading the inspection result file from the local directory, delete the security inspection script and the inspection result file from the local directory.

7. The method according to claim 1, characterized in that, The establishment of a Remote Desktop Protocol (RDP) session with the target host includes: Establish an RDP session with the target host using a command-line RDP client; The step of mapping the local directory where the security check script is located to the target host includes: When establishing the RDP session, specify the RDP protocol drive mapping parameters to complete the mapping of the local directory.

8. A remote security baseline inspection device, characterized in that, The device includes: The session establishment module is configured to establish a Remote Desktop Protocol (RDP) session with the target host and map the local directory where the security check script is located to the target host. The command injection module is configured to inject an execution command of a security check script into the RDP session, so that the target host executes the security check script and writes the check result file to the local directory; The directory reading module is configured to read the inspection result file from the local directory and complete the result collection.

9. An electronic device, characterized in that, include: One or more processors; A storage device for storing one or more programs, which, when executed by the one or more processors, cause the electronic device to perform the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, It stores computer-readable instructions that, when executed by the processor of a computer, cause the computer to perform the method described in any one of claims 1 to 7.

Images