RDP:

Lateral Movement

Hijack disconnected RDP sessions via tscon and SharpRDPHijack

1 guide • Created Dec 28, 2025 • Updated Mar 29, 2026

1 guide

RDP Session Hijacking – tscon and SharpRDPHijack

Hijack active/disconnected RDP sessions without credentials using tscon.exe or SharpRDPHijack, enabling lateral movement via existing authenticated sessions.

Mar 11, 2026 • 5 min read

RDP lateral movement uses legitimate remote desktop functionality to hop between hosts with captured credentials. Plaintext passwords, NTLM hashes (via pass-the-hash with Restricted Admin mode or xfreerdp), and Kerberos tickets all work depending on the target configuration. Credential reuse across hosts is the simplest path and succeeds frequently in environments with shared local admin passwords.

Restricted Admin mode lets you authenticate with an NTLM hash instead of a plaintext password, turning every hash you dump into potential RDP access. When it is not enabled, you can enable it remotely via registry if you already have admin access to the target.

RDP Gateway (RD Gateway) tunnels RDP traffic over HTTPS, letting you reach internal hosts through a single internet-facing gateway. Session pivoting chains RDP connections through compromised hosts to access segmented networks. SharpRDP and similar tools automate command execution over RDP without a full GUI session.