Service

RDP

RDP remote desktop protocol attacks covering NTLM fingerprinting, BlueKeep and DejaBlue CVEs, NLA bypass, Pass-the-Hash, session hijacking via tscon, and sticky keys backdoors

:3389 12 guides 5 phases

1 min read Created: Dec 28, 2025 Updated: Jul 14, 2026

RDP (Remote Desktop Protocol) runs on TCP port 3389 and provides graphical remote access to Windows systems. Nmap identifies it as ms-wbt-server. RDP is enabled by default on many Windows Server installations and is frequently exposed to the internet.

Weak or reused credentials are the primary attack vector. NLA (Network Level Authentication) can be disabled, allowing pre-authentication attacks. Known vulnerabilities like BlueKeep (CVE-2019-0708) provide unauthenticated RCE on older Windows versions. RDP sessions may also be hijacked without credentials if a disconnected session exists on the target.

Use nmap --script rdp-enum-encryption,rdp-ntlm-info to identify the OS, domain, and hostname. Test credentials with hydra, crowbar, or crackmapexec rdp. Check for NLA enforcement and test known CVEs. If valid credentials are obtained, connect with xfreerdp or rdesktop.

Enumeration

Fingerprint RDP via NTLM info, encryption levels, and TLS certs

View all 3

RDP encryption NLA

Jan 4, 2026 • 4 min read

RDP NTLM Info Fingerprinting

Jan 4, 2026 • 2 min read

RDP TLS Certificate Extraction

Jan 4, 2026 • 2 min read

Vulnerability Discovery

Detect BlueKeep, DejaBlue, and missing NLA on RDP hosts

View all 2

RDP Known Vulnerability Detection

Identifies known RDP vulnerabilities including BlueKeep, DejaBlue, and misconfigurations using Nmap scripts, Metasploit modules, and manual version checks.

May 15, 2026 • 3 min read

RDP NLA Not Enforced

Identifies RDP servers lacking Network Level Authentication, enabling pre-authentication attacks and brute force without valid credentials.

May 15, 2026 • 3 min read

Exploitation

RDP exploitation via brute force, Pass-the-Hash, and RCE CVEs

View all 5

RDP Brute Force and Password Spraying

Exploit RDP with brute force and password spraying techniques, targeting exposed 3389/TCP services to gain unauthorised access via credential attacks.

Mar 11, 2026 • 5 min read

RDP Pass-the-Hash – GUI Session from an NT Hash

Leverage NT hashes for RDP authentication using Restricted Admin mode, bypassing plaintext credential requirements via pass-the-hash techniques with xfreerdp or Mimikatz.

Mar 11, 2026 • 4 min read

2 steps

Lateral Movement

Hijack disconnected RDP sessions via tscon and SharpRDPHijack

View all 1

RDP Session Hijacking – tscon and SharpRDPHijack

Hijack active/disconnected RDP sessions without credentials using tscon.exe or SharpRDPHijack, enabling lateral movement via existing authenticated sessions.