Home > Network Pentesting

RDP & Remote Exploitation

RDP and remote exploitation focus on abusing weaknesses in Microsoft’s Remote Desktop Protocol to gain unauthorized access or escalate privileges. RDP is widely used for remote administration, and when misconfigured, outdated, or exposed to the internet, it becomes a major attack surface. Enumeration reveals authentication settings, encryption levels, NLA status, and version details. Exploitation targets weak credentials, vulnerable services, and insecure configurations.

Understanding RDP Attack Surface

RDP typically runs on port 3389. Common weaknesses include:

  • Weak or reused passwords

  • RDP without NLA

  • Outdated RDP versions

  • Weak encryption settings

  • Vulnerable Windows builds

  • Exposed administrative access

  • Misconfigured certificate settings

Exploitation focuses on authentication bypass, credential harvesting, and remote code execution.

Identifying RDP Service Details

Enumeration begins with gathering information about the RDP server.

Detecting RDP Service

nmap -sV -p3389 10.10.10.5

This identifies Windows versions and RDP capabilities.

Enumerating Encryption Strength

nmap --script rdp-enum-encryption -p3389 10.10.10.5

Weak encryption levels such as:

  • Standard RDP Security

  • RC4

  • Unsupported TLS versions

indicate risks.

Checking NLA (Network Level Authentication)

nmap --script rdp-ntlm-info -p3389 10.10.10.5

If NLA is disabled, attackers can attempt brute forcing or downgrade attacks.

Enumerating RDP Features

nmap --script rdp-enum-features -p3389 10.10.10.5

This reveals features tied to specific Windows builds or server roles.

Exploiting Weak Credentials

Weak passwords are one of the most common RDP vulnerabilities.

Brute Force (Only with explicit permission)

hydra -l admin -P passwords.txt rdp://10.10.10.5

Credential Spraying

hydra -L users.txt -p Password123 rdp://10.10.10.5

Attackers often gain access through predictable or reused passwords.

Exploiting RDP Without NLA

If NLA is disabled, RDP relies on older authentication methods.
This allows offline credential attacks, downgrade attacks, and man-in-the-middle scenarios.

Detecting NLA Disabled

Look for:

CredSSP not supported

in enumeration output.

BlueKeep (CVE-2019-0708)

BlueKeep allows remote code execution on vulnerable Windows systems without authentication.

Detection

nmap --script rdp-vuln-ms12-020 -p3389 10.10.10.5

If detected, exploitation is extremely dangerous and must only be used in controlled labs.

Exploiting Credential Disclosure Vulnerabilities

Some RDP versions leak NTLM hashes via authentication flow.
These can be used for:

  • Pass-the-Hash

  • Offline cracking

  • Lateral movement

Capturing NTLM via Responder or MITM

If RDP is not enforcing signing, attackers may intercept NTLM traffic.

Pass-the-Hash Attacks

If attackers obtain NTLM hashes:

xfreerdp /u:admin /pth:<hash> /v:10.10.10.5

Some systems accept authentication via hashes instead of passwords.

Remote Command Execution via RDP Access

Once authenticated, pentesters may:

  • Access the desktop

  • Execute commands

  • Modify registry

  • Extract credential material

  • Upload/download files

RDP provides full GUI access, enabling deeper exploitation.

Abusing Shared Clipboard and Drive Mapping

If RDP device redirection is enabled, attackers can:

  • Transfer payloads

  • Extract sensitive files

  • Bypass restrictions by mapping local drives

Checking for Redirect Features

xfreerdp /v:10.10.10.5 /clipboard /drive:/tmp

Enabled features often expose further weaknesses.

Post-Exploitation After RDP Access

Once inside the system, attackers enumerate:

  • Credential caches

  • SAM database

  • LSASS memory

  • Security logs

  • Installed software

  • Domain membership

Tools often used include:

  • mimikatz

  • SharpHound

  • powershell-based enumeration scripts

Weak segmentation policies allow lateral movement from the compromised host.

Why RDP Exploitation Matters

RDP provides full system access. Misconfigurations and outdated versions introduce major risks. Weak passwords, disabled NLA, exposed RDP ports, and vulnerable Windows builds lead to quick system compromise. RDP exploitation often results in complete control over the host and enables lateral movement throughout the network.

Intel Dump

  • RDP runs on port 3389 and exposes version, encryption, and NLA info

  • Enumeration uses Nmap scripts for encryption, NLA, and feature detection

  • Weak passwords and disabled NLA are major attack vectors

  • Vulnerabilities such as BlueKeep and NTLM leaks enable remote exploitation

  • RDP access grants full control and supports post-exploitation actions

HOME LEARN COMMUNITY DASHBOARD