RDP:
Exploitation
RDP exploitation via brute force, Pass-the-Hash, and RCE CVEs
RDP Brute Force and Password Spraying
Exploit RDP with brute force and password spraying techniques, targeting exposed 3389/TCP services to gain unauthorised access via credential attacks.
RDP Pass-the-Hash – GUI Session from an NT Hash
Leverage NT hashes for RDP authentication using Restricted Admin mode, bypassing plaintext credential requirements via pass-the-hash techniques with xfreerdp or Mimikatz.
RDP exploitation ranges from unauthenticated remote code execution to credential-based attacks. BlueKeep (CVE-2019-0708) targets unpatched Windows 7 and Server 2008 systems through the RDP protocol itself, giving you SYSTEM-level code execution without credentials. Metasploit has a working module, though reliability varies by target.
Credential brute-forcing with Hydra, Crowbar, or Ncrack works when NLA is disabled, since the server presents a login screen before requiring valid credentials. With NLA enabled, brute-forcing still works but is slower since authentication happens at the network layer. Password spraying against domain-joined RDP servers avoids lockout while testing common passwords.
Session hijacking through tscon allows a SYSTEM-level process to take over disconnected sessions without knowing the password. RDP relay attacks capture and forward authentication attempts when NLA is not enforced.