Skip to content
HackIndex logo

HackIndex

RDP
Service

RDP

RDP remote desktop protocol attacks covering NTLM fingerprinting, BlueKeep and DejaBlue CVEs, NLA bypass, Pass-the-Hash, session hijacking via tscon, and sticky keys backdoors

:3389 12 guides 5 phases
1 min read Updated: Jul 14, 2026

What is RDP?

Remote Desktop Protocol is Microsoft’s remote display and input protocol for Windows.

Common security issues

  • Weak credentials exploited by brute force.

  • Network Level Authentication disabled.

  • Credential theft via RDP channel.

  • Known protocol vulnerabilities.

Default ports

  • 3389

Enumeration

Fingerprint RDP via NTLM info, encryption levels, and TLS certs

3

Vulnerability Discovery

Detect BlueKeep, DejaBlue, and missing NLA on RDP hosts

2

RDP Known Vulnerability Detection

Identifies known RDP vulnerabilities including BlueKeep, DejaBlue, and misconfigurations using Nmap scripts, Metasploit modules, and manual version checks.

May 15, 2026 • 3 min read

RDP NLA Not Enforced

Identifies RDP servers lacking Network Level Authentication, enabling pre-authentication attacks and brute force without valid credentials.

May 15, 2026 • 3 min read

Exploitation

RDP exploitation via brute force, Pass-the-Hash, and RCE CVEs

5
RDP Brute Force and Password Spraying

RDP Brute Force and Password Spraying

Exploit RDP with brute force and password spraying techniques, targeting exposed 3389/TCP services to gain unauthorised access via credential attacks.

Mar 11, 2026 • 5 min read

Lateral Movement

Hijack disconnected RDP sessions via tscon and SharpRDPHijack

1

Persistence

Guides on backdooring RDP via sticky keys and utilman hijacking

1