# RDP

> RDP remote desktop protocol attacks covering NTLM fingerprinting, BlueKeep and DejaBlue CVEs, NLA bypass, Pass-the-Hash, session hijacking via tscon, and sticky keys backdoors

- **URL:** https://hackindex.io/services/rdp
- **Type:** Service
- **Default ports:** 3389
- **Tags:** rdp, windows, remote-desktop, lateral-movement, credential-access, network
- **Published:** 2025-12-31
- **Updated:** 2026-07-14

RDP (Remote Desktop Protocol) runs on **TCP port 3389** and provides graphical remote access to Windows systems. Nmap identifies it as `ms-wbt-server`. RDP is enabled by default on many Windows Server installations and is frequently exposed to the internet.

Weak or reused credentials are the primary attack vector. NLA (Network Level Authentication) can be disabled, allowing pre-authentication attacks. Known vulnerabilities like BlueKeep (CVE-2019-0708) provide unauthenticated RCE on older Windows versions. RDP sessions may also be hijacked without credentials if a disconnected session exists on the target.

Use `nmap --script rdp-enum-encryption,rdp-ntlm-info` to identify the OS, domain, and hostname. Test credentials with `hydra`, `crowbar`, or `crackmapexec rdp`. Check for NLA enforcement and test known CVEs. If valid credentials are obtained, connect with `xfreerdp` or `rdesktop`.

## Phases

- [Enumeration](https://hackindex.io/services/rdp/enumeration.md): Fingerprint RDP via NTLM info, encryption levels, and TLS certs (3 guides)
- [Vulnerability Discovery](https://hackindex.io/services/rdp/vulnerability-discovery.md): Detect BlueKeep, DejaBlue, and missing NLA on RDP hosts (2 guides)
- [Exploitation](https://hackindex.io/services/rdp/exploitation.md): RDP exploitation via brute force, Pass-the-Hash, and RCE CVEs (5 guides)
- [Lateral Movement](https://hackindex.io/services/rdp/lateral-movement.md): Hijack disconnected RDP sessions via tscon and SharpRDPHijack (1 guides)
- [Persistence](https://hackindex.io/services/rdp/persistence.md): Guides on backdooring RDP via sticky keys and utilman hijacking (1 guides)