Remote Session Enumeration via Undocumented Windows APIs

What it is

A walkthrough of reimplementing qwinsta.exe's remote session enumeration by calling the undocumented WinStation API in winsta.dll directly, rather than the documented Terminal Services / WTS API (wtsapi32.h). The author confirms via disassembly that qwinsta uses WinStation, and rebuilds the same capability in C++.

How it works

winsta.dll exports the functions but ships with no SDK header (no winsta.h/winsta32.h), so you cannot link against it normally. The technique: define your own function prototypes as typedefs, LoadLibrary("winsta.dll"), resolve each export with GetProcAddress, and call through the pointers. The five functions are invoked in a fixed order:

flowchart LR
    A[WinStationOpenServerW<br/>PWSTR hostname] --> B[WinStationEnumerateW<br/>list sessions]
    B --> C[WinStationQueryInformationW<br/>per-session detail]
    C --> D[WinStationFreeMemory]
    D --> E[WinStationCloseServer]

The structures needed by these calls (e.g. SESSIONIDW, which unions SessionId/LogonId with WinStationName and WINSTATIONSTATECLASS) are also undocumented; the author sources both prototypes and structs from the Process Hacker winsta.h (https://processhacker.sourceforge.io/doc/winsta_8h_source.html), porting each dependent struct one at a time.

Preconditions / Affected

Remote enumeration targets a Windows host via /server:{hostname} (or WinStationOpenServerW(serverName)). The author's key claim: RDP does not need to be enabled on the target for enumeration to succeed, despite the API's Remote Desktop framing.

What to do

For the initial open/close handle proof, the working snippet resolves and calls two exports:

typedef HANDLE(WINAPI* LPFN_WinStationOpenServerW)(PWSTR);
typedef BOOLEAN(WINAPI* LPFN_WinStationCloseServer)(HANDLE);

HINSTANCE hDLL = LoadLibrary(TEXT("winsta.dll"));
LPFN_WinStationOpenServerW pfnWinStationOpenServerW =
    (LPFN_WinStationOpenServerW)GetProcAddress(hDLL, "WinStationOpenServerW");
wchar_t serverName[] = L"TARGET_HOST";
HANDLE hServer = pfnWinStationOpenServerW(serverName);

Enumeration then uses:

typedef BOOLEAN(WINAPI* LPFN_WinStationEnumerateW)(HANDLE, PSESSIONIDW*, PULONG);

For defenders, the detection surface is the pairing of a winsta.dll load with WinStation* calls (rather than wtsapi32.dll) from non-standard processes, and remote WinStationOpenServerW traffic where RDP is disabled.

Caveats

The fetched text cuts off at the WinStationEnumerateW call, so the full enumerate/query loop and output parsing are not shown. All prototypes and structs are community-reverse-engineered (Process Hacker), not Microsoft-documented, so they carry no stability guarantee across Windows versions.