init

2026-10-05 07:48:23 +02:00 · 2026-08-28 11:45:23 +02:00
commit 54fed22b8b
28 changed files with 1884 additions and 0 deletions
@@ -0,0 +1,54 @@
+---
+title: "RDP"
+description: "Enumeration, exploitation and post-exploitation techniques for RDP servers."
+tags: ["rdp", "network", "service"]
+publishDate: 2026-05-04
+---
+
+<!-- START doctoc generated TOC please keep comment here to allow auto update -->
+<!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
+
+- [Enumeration](#enumeration)
+  - [Banner grabbing](#banner-grabbing)
+- [Connect](#connect)
+- [Brute Force](#brute-force)
+
+<!-- END doctoc generated TOC please keep comment here to allow auto update -->
+
+RDP (Remote Desktop Protocol) runs on **port 3389** and provides a graphical remote session.
+Common on Windows servers and workstations.
+
+## Enumeration
+
+### Banner grabbing
+
+```bash
+nmap -sV -p 3389 $IP
+nmap -p 3389 --script rdp-* $IP
+```
+
+Key scripts:
+
+- `rdp-enum-encryption`: checks encryption level
+- `rdp-vuln-ms12-020`: tests for MS12-020 DoS vulnerability
+
+## Connect
+
+```bash
+xfreerdp /u:$user /p:$password /v:$IP
+xfreerdp /u:$user /p:$password /v:$IP /cert:ignore
+rdesktop $IP
+```
+
+Pass the hash directly (no plaintext password needed):
+
+```bash
+xfreerdp /u:$user /pth:$hash /v:$IP
+```
+
+## Brute Force
+
+```bash
+hydra -l $user -P ~/wordlists/rockyou.txt rdp://$IP
+crowbar -b rdp -s $IP/32 -u $user -C ~/wordlists/rockyou.txt
+```