RDP:

Exploitation

RDP exploitation via brute force, Pass-the-Hash, and RCE CVEs

3 guides • 2 steps • Created Dec 28, 2025 • Updated Mar 29, 2026

3 guides

RDP Brute Force and Password Spraying

Exploit RDP with brute force and password spraying techniques, targeting exposed 3389/TCP services to gain unauthorised access via credential attacks.

Mar 11, 2026 • 5 min read

RDP Pass-the-Hash – GUI Session from an NT Hash

Leverage NT hashes for RDP authentication using Restricted Admin mode, bypassing plaintext credential requirements via pass-the-hash techniques with xfreerdp or Mimikatz.

Mar 11, 2026 • 4 min read

2 steps

Vulnerabilities

Mar 11, 2026

RDP exploitation ranges from unauthenticated remote code execution to credential-based attacks. BlueKeep (CVE-2019-0708) targets unpatched Windows 7 and Server 2008 systems through the RDP protocol itself, giving you SYSTEM-level code execution without credentials. Metasploit has a working module, though reliability varies by target.

Credential brute-forcing with Hydra, Crowbar, or Ncrack works when NLA is disabled, since the server presents a login screen before requiring valid credentials. With NLA enabled, brute-forcing still works but is slower since authentication happens at the network layer. Password spraying against domain-joined RDP servers avoids lockout while testing common passwords.

Session hijacking through tscon allows a SYSTEM-level process to take over disconnected sessions without knowing the password. RDP relay attacks capture and forward authentication attempts when NLA is not enforced.