Phear the TScrack Pacman! softlabs in association with The Ninja Corporation [TNC]
TScrack 2.0
Terminal Services Cracker
TScrack Downloads! [DOWN]      Mirror #1, US, hosted by [DOWN]     Mirror #2, US, hosted by                 Mirror #3, UK, hosted by                Mirror #4, DO, hosted by                Mirror #5, NL, hosted by               Mirror #X, XX, Mirror Sites Wanted!

What is TScrack?   TScrack is a dictionary based (rather than bruteforce) password cracker for Microsoft Windows Terminal Services (RDP).

TScrack applies AI technology (Artificial Neural Networks) to scrape the screen contents of the graphical logon, in order to enable a simple dictionary based cracking algorithm to perform efficiently against the graphically presented logon dialogs and message boxen. This is very similar to the technology used i.e. in Optical Character Recognition (OCR), Face- and Image recognition in general.
Why use TScrack?   You can use TScrack to check security of your terminal service by strenght testing the password of the administrator account. Microsoft recommends this procedure in their ISP Security Practices List, which could be found at

while this page was created.
This process is also very important for security professionals, in order to perform tests against customer equipment. TScrack supports operation on local as well as remote RDP servers.

At the time this HTML is created, TScrack is known to be the only public available password cracker for windows terminal services.

Features List:
  • Handles Logon Banner Message Boxen
  • Does not require specific server configuration to work
  • Credentials Test (See if given credentials are valid)
  • Can test for blank passwords
  • Supports 40bit, 56bit and 128bit encryption
  • Silent operation (no "wrong password" beeps)
  • Optionally prevents System Log entries on the targeted server
  • Supports two simultaneous connections
  • Supports batch processing

Supported Platforms List:
  • Windows 2000 Professional
  • Windows 2000 Server
  • Windows 2000 Advanced Server

If your operating system is not listed here, and you have success in running tscrack on it, please consider dropping me an email message. See chapter 6 in the readme file for details :)
How does TScrack work?   Since any RDP session, such as a Microsoft Windows Terminal Services Session, consists basically of the exchange of bitmap data from the server to the client, and keyboard + mouse input events from the client to the server, it is not easily possible to determine the exact state of the terminal server session. A specific problem are lacking interfaces to determine a failed logon attempt, or the presence of a logon banner message box.

TScrack overcomes those limits by resorting to a technology that is classified as "weak" AI, so called "Artificial Neural Networks" (short: ANN). TScrack now utilizes a single ANN per connection, in order to process the contents of the TS session, and instruct the cracking algorithm accordingly.

If you wish to find out more about Artificial Neural Networks, then we have two links for you here:

The main ANN has 1024 neurons in its input layer, which correspond to pixels on the TS sessions. The output layer of the ANN has 4 neurons. These 4 neurons directly correspond to commands, such as "Send Password" or "Send Enter". The ANN in TScrack has been carefully designed, trained and optimized to perform suitably well. However, it is still necessary to expand the training sets used to "teach" the ANN to give the correct responses (yes, this is supervised learning ;).

Therefore please consider contributing to the TScrack project, and sending in screen captures as outlined in tscapture.txt. Thank you. :)

TScrack dependencies?  
msvbvm60.dll          Visual Basic 6 Runtime DLL
                      - Everything else comes built-in
TScrack licensing?   TScrack is basically free.

This means that you can use TScrack free of charge, if you abide to the following terms of usage:

a) The author of TScrack, as well as softlabs, hereby void any and all liability concerning the TScrack software. Neither the author, nor softlabs can be held responsible in any way for any loss of income, data, gain, profit, reputation, credibility or whatsoever, neither as a direct nor indirect result of using the TScrack software.

b) The user of TScrack is solely responsible for usage of the TScrack software. Neither the TScrack author nor softlabs can be held responsible for any actions conducted by TScrack users.

c) TScrack software is provided as is, neither functionality nor fitness for a particular purpose are declared. TScrack comes with no warranty and/or support. Any and all usage of TScrack is at the sole risk of the user.

d) You may NOT redistribute the TScrack software for any fee exceeding it's media (or associated transfer volume) cost. You may not provide and/or present the TScrack software as a creation of your own. You may freely use the TScrack software within your organization. You may freely copy, distribute and publish the TScrack software, given that you do not violate the terms of usage outlined herein. If you choose to redistribute the TScrack software, you are required to include these terms of usage, as outlined herein, with your distribution.

e) You may NOT use the TScrack software in your own commercial software projects without written permission from softlabs. Not abiding to this rule violates swiss and international laws on copyright and intellectual property. For TScrack licensing, please write an email message to (please replace nospam with info). See the site at [] (the site is in german, but you may send enquiries in english language).

f) The TScrack software remains the sole property of softlabs. Disassembly, Reverse Engineering and/or modification of the TScrack software is strictly prohibited. Copyright 2002 by gridrun [TNC]. All rights reserved.

g) Usage of the TScrack software implies that you agree to these terms of usage, as outlined herein.

(C) 2002 by spacebitch softlabs - All rights reserved