RDP - PORT 3389
Become VeryLazyTech member! 🎁
Follow us on:
✖ Twitter @VeryLazyTech.
👾 Github @VeryLazyTech.
📜 Medium @VeryLazyTech.
📺 YouTube @VeryLazyTech.
📩 Telegram @VeryLazyTech.
🕵️♂️ My Site @VeryLazyTech.
Visit our shop for e-books and courses. 📚
Basic Info
Remote Desktop Protocol (RDP) is a powerful interface for remote administration but also a common target during network penetration tests. This guide provides a deep-dive, red team–oriented, practical approach to pentesting RDP—covering everything from service discovery and brute-forcing to misconfigurations, credential theft, and post-exploitation pivoting.
RDP typically runs on TCP port 3389.
Enumeration
RDP typically runs on TCP port 3389, but it can be reconfigured. Effective reconnaissance involves multiple techniques:
Port Scanning (TCP/UDP)
rdp-enum-encryption: Reveals supported security layers (Standard RDP, TLS, CredSSP)Look for open ports: 3389 (default), but may vary (3388, 3390)
Detecting RDP via SSL Certificate
Check for common RDP SSL certificate strings like Remote Desktop.
Banner Grabbing with Nmap NSE
Brute Force
Bypassing Account Lockouts
Slow brute-force (1 attempt every X seconds)
Distribute attempts across users
Password spraying (1 password across multiple accounts)
Password Spraying
Be careful, you could lock accounts
Connect with known credentials/hash
Check known credentials against RDP services
rdp_check.py from impacket let you check if some credentials are valid for a RDP service:
Session stealing
With SYSTEM permissions you can access any opened RDP session by any user without need to know the password of the owner.
Get openned sessions:
Access to the selected session
Now you will be inside the selected RDP session and you will have impersonate a user using only Windows tools and features.
Important: When you access an active RDP sessions you will kickoff the user that was using it.
You could get passwords from the process dumping it, but this method is much faster and led you interact with the virtual desktops of the user (passwords in notepad without been saved in disk, other RDP sessions opened in other machines...)
Mimikatz
You could also use mimikatz to do this:
Sticky-keys & Utilman
Combining this technique with stickykeys or utilman you will be able to access a administrative CMD and any RDP session anytime
You can search RDPs that have been backdoored with one of these techniques already with: https://github.com/linuz/Sticky-Keys-Slayer
RDP Process Injection
If the external group has RDP access to any computer in the current domain, an attacker could compromise that computer and wait for him.
Once that user has accessed via RDP, the attacker can pivot to that users session and abuse its permissions in the external domain.
RDPInception
If a user access via RDP into a machine where an attacker is waiting for him, the attacker will be able to inject a beacon in the RDP session of the user and if the victim mounted his drive when accessing via RDP, the attacker could access it.
In this case you could just compromise the victims original computer by writing a backdoor in the statup folder.
Adding User to RDP group
Automatic Tools
AutoRDPwn is a post-exploitation framework created in Powershell, designed primarily to automate the Shadow attack on Microsoft Windows computers. This vulnerability (listed as a feature by Microsoft) allows a remote attacker to view his victim's desktop without his consent, and even control it on demand, using tools native to the operating system itself.
Control mouse and keyboard in an automated way from command line
Control clipboard in an automated way from command line
Spawn a SOCKS proxy from the client that channels network communication to the target via RDP
Execute arbitrary SHELL and PowerShell commands on the target without uploading files
Upload and download files to/from the target even when file transfers are disabled on the target
This tool allows to execute commands in the victim RDP without needing a graphical interface.
Learn & practice For the Bug Bounty
Last updated
Was this helpful?