Skip to content
HackIndex logo

HackIndex

RDP NTLM Info Fingerprinting

2 min read May 15, 2026

RDP with CredSSP (NLA) often leaks useful identity and OS details during the NTLM handshake before any real login. This is fast signal for domain context, naming, and rough Windows build without creds.

Nmap rdp-ntlm-info

Run it directly:

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p $PORT --script rdp-ntlm-info $TARGET_IP

If you’re scanning multiple hosts, keep it quiet and output for parsing:

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -n -p $PORT --script rdp-ntlm-info -oA rdp_ntlm_info $TARGET_IP

What good output looks like

Expect fields like NetBIOS and DNS naming plus a product version:

| rdp-ntlm-info:
|   Target_Name: CONTOSO
|   NetBIOS_Domain_Name: CONTOSO
|   NetBIOS_Computer_Name: WIN10-WS01
|   DNS_Domain_Name: contoso.local
|   DNS_Computer_Name: win10-ws01.contoso.local
|   Product_Version: 10.0.19045
|_  System_Time: 2026-01-19T10:12:03+00:00

How to use it

  • DNS_Domain_Name / Target_Name present: treat it as domain-joined until proven otherwise. Set $DOMAIN from this and align user spraying formats and AD targeting — see RDP Brute Force and Password Spray.

  • DNS_Computer_Name / NetBIOS_Computer_Name present: you’ve got a reliable hostname for pivoting into DNS, SMB, LDAP, and certificate-based targeting.

  • Product_Version present: prioritize older-looking builds for deeper vuln checks, and don’t waste time guessing OS family.

When rdp-ntlm-info returns nothing

This usually means CredSSP isn’t in play, the service isn’t Windows RDP, or the endpoint is doing something odd with negotiation.

Confirm the port really speaks RDP:

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -sV -p $PORT $TARGET_IP

If you still need identity hints, try pulling the server cert via a client handshake (you’ll often get a CN/SAN with the host naming pattern):

┌──(kali㉿kali)-[~]
└─$ xfreerdp /v:$TARGET_IP:$PORT /u:$USER /p:$PASSWORD /cert:ignore /sec:nla

If you don’t have creds, you can still try with empty values just to trigger negotiation and see what it prints before auth fails:

┌──(kali㉿kali)-[~]
└─$ xfreerdp /v:$TARGET_IP:$PORT /u: /p: /cert:ignore /sec:nla

What you’re looking for:

  • Any displayed server name or certificate subject that gives you a hostname pattern.

  • Clear errors about required security modes, which changes how you approach follow-on enumeration.

Fast TCP sanity check

This is only for “is something listening”, not fingerprinting:

┌──(kali㉿kali)-[~]
└─$ nc -nv -w 3 $TARGET_IP $PORT

If it connects, treat it as “open”. Don’t expect a readable banner.

References