mirror of
https://github.com/anotherhadi/sec-notes.git
synced 2026-10-05 07:48:23 +02:00
55 lines
1.2 KiB
Markdown
55 lines
1.2 KiB
Markdown
---
|
|
title: "RDP"
|
|
description: "Enumeration, exploitation and post-exploitation techniques for RDP servers."
|
|
tags: ["rdp", "network", "service"]
|
|
publishDate: 2026-05-04
|
|
---
|
|
|
|
<!-- START doctoc generated TOC please keep comment here to allow auto update -->
|
|
<!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
|
|
|
|
- [Enumeration](#enumeration)
|
|
- [Banner grabbing](#banner-grabbing)
|
|
- [Connect](#connect)
|
|
- [Brute Force](#brute-force)
|
|
|
|
<!-- END doctoc generated TOC please keep comment here to allow auto update -->
|
|
|
|
RDP (Remote Desktop Protocol) runs on **port 3389** and provides a graphical remote session.
|
|
Common on Windows servers and workstations.
|
|
|
|
## Enumeration
|
|
|
|
### Banner grabbing
|
|
|
|
```bash
|
|
nmap -sV -p 3389 $IP
|
|
nmap -p 3389 --script rdp-* $IP
|
|
```
|
|
|
|
Key scripts:
|
|
|
|
- `rdp-enum-encryption`: checks encryption level
|
|
- `rdp-vuln-ms12-020`: tests for MS12-020 DoS vulnerability
|
|
|
|
## Connect
|
|
|
|
```bash
|
|
xfreerdp /u:$user /p:$password /v:$IP
|
|
xfreerdp /u:$user /p:$password /v:$IP /cert:ignore
|
|
rdesktop $IP
|
|
```
|
|
|
|
Pass the hash directly (no plaintext password needed):
|
|
|
|
```bash
|
|
xfreerdp /u:$user /pth:$hash /v:$IP
|
|
```
|
|
|
|
## Brute Force
|
|
|
|
```bash
|
|
hydra -l $user -P ~/wordlists/rockyou.txt rdp://$IP
|
|
crowbar -b rdp -s $IP/32 -u $user -C ~/wordlists/rockyou.txt
|
|
```
|