Only mark RDP hosts Pwn3d when a real session actually opens

[azoxlpf]

Description

RDP hosts were marked Pwn3d! on any successful auth, even with no real session. This produced false positives for accounts with no RDP access right, and for pass-the-hash logons when restricted admin is disabled (auth succeeds but the interactive logon is refused).

Pwn3d! now relies on what the server reports, no marker when RDP access is denied or when no Save Session Info PDU confirms the logon, and Pwn3d! only once a real session is confirmed.

Must be merged first: skelsec/aardwolf#49

Type of change

Insert an "x" inside the brackets for relevant items (do not delete options)

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Deprecation of feature or functionality
• This change requires a documentation update
• This requires a third party update (such as Impacket, Dploot, lsassy, etc)
• This PR was created with the assistance of AI (list what type of assistance, tool(s)/model(s) in the description)

Setup guide for the review

Disable restricted admin if it isn't already (disabled by default) :

Set-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Lsa' -Name DisableRestrictedAdmin -Value 1

Try logging in as an admin using your password and via pth

Screenshots (if appropriate):

Before :

After :

Checklist:

Insert an "x" inside the brackets for completed and relevant items (do not delete options)

• I have ran Ruff against my changes (poetry: poetry run ruff check ., use --fix to automatically fix what it can)
• I have added or updated the tests/e2e_commands.txt file if necessary (new modules or features are required to be added to the e2e tests)
• If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
• I have linked relevant sources that describes the added technique (blog posts, documentation, etc)
• I have performed a self-review of my own code (not an AI review)
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)