Introducing LarpRDP
SharpRDP runs commands on Windows over RDP by injecting keystrokes via mstscax.dll. It’s clever — RDP is a GUI protocol, and treating it as a scripting surface brings the same automation benefits that shell scripting brings to a terminal.
But SharpRDP is Windows-only and limited to opening the Run dialog and typing one command.
LarpRDP is a Linux-native rewrite in Rust wrapping FreeRDP3.
What’s different
Headless RDP is similar to BadUSB. Instead of a single Win+R command, LarpRDP supports DuckyScript — full keystroke sequences with delays, modifier combos, and screenshot capture for verification. Same format USB Rubber Ducky uses, running over RDP.
The repo includes an example DuckyScript that automates a reverse shell: start a listener, run larprdp, and it types everything out end to end.
Where it fits
- Pentesting — post-exploitation through RDP without dropping agents
- CTFs — reverse shell onto RDP-only targets
- Red teaming — DuckyScript payloads over RDP instead of USB