How can an attacker programmatically obtain the remote assistance connection password from the invitation popup window?

Question

Onedaysec · Accepted Answer

The attacker can enumerate child windows of the 'Windows Remote Assistance' window using the `EnumChildWindows` API. In the enumeration callback, they send a `WM_GETTEXT` message to each child window; testing shows that the second child window contains the password string. By returning `0` after finding it, the enumeration stops early, and the password can be extracted for later use. This technique is similar to interface manipulation discussed in [Penetration Techniques - Exploitation of Clipboard in Windows](/news/penetration-techniques-exploitation-of-clipboard-in-windows).