# Exploitation

> RDP exploitation via brute force, Pass-the-Hash, and RCE CVEs

- **URL:** https://hackindex.io/services/rdp/exploitation
- **Service:** [RDP](https://hackindex.io/services/rdp.md)
- **Tags:** initial-access, execution
- **Published:** 2026-03-11
- **Updated:** 2026-03-29

RDP exploitation ranges from unauthenticated remote code execution to credential-based attacks. BlueKeep (CVE-2019-0708) targets unpatched Windows 7 and Server 2008 systems through the RDP protocol itself, giving you SYSTEM-level code execution without credentials. Metasploit has a working module, though reliability varies by target.

Credential brute-forcing with Hydra, Crowbar, or Ncrack works when NLA is disabled, since the server presents a login screen before requiring valid credentials. With NLA enabled, brute-forcing still works but is slower since authentication happens at the network layer. Password spraying against domain-joined RDP servers avoids lockout while testing common passwords.

Session hijacking through tscon allows a SYSTEM-level process to take over disconnected sessions without knowing the password. RDP relay attacks capture and forward authentication attempts when NLA is not enforced.

## Guides

- [RDP Brute Force and Password Spraying](https://hackindex.io/services/rdp/exploitation/brute-force-password-spray.md): Exploit RDP with brute force and password spraying techniques, targeting exposed 3389/TCP services to gain unauthorised access via credential attacks.
- [RDP Pass-the-Hash – GUI Session from an NT Hash](https://hackindex.io/services/rdp/exploitation/pass-the-hash.md): Leverage NT hashes for RDP authentication using Restricted Admin mode, bypassing plaintext credential requirements via pass-the-hash techniques with xfreerdp or Mimikatz.
- [Vulnerabilities](https://hackindex.io/services/rdp/exploitation/vulnerabilities.md)
  - [BlueKeep CVE-2019-0708 – Unauthenticated RDP RCE](https://hackindex.io/services/rdp/exploitation/vulnerabilities/bluekeep-cve-2019-0708.md): Exploits CVE-2019-0708, an unauthenticated RCE vulnerability in Windows RDP via kernel UAF, enabling pre-auth SYSTEM-level code execution without user interaction.
  - [DejaBlue CVE-2019-1181 – RDP RCE on Modern Windows](https://hackindex.io/services/rdp/exploitation/vulnerabilities/dejablue-cve-2019-1181.md): Exploits CVE-2019-1181 pre-auth RDP RCE via heap overflow in MS-RDPBCGR on Windows 8.1/10/Server 2012-2019 without requiring credentials.