RDP Session Hijacking – tscon and SharpRDPHijack

Windows Terminal Services allows sessions to be transferred between connections using tscon.exe. When running as SYSTEM, you can connect to any disconnected session on the host without supplying the session owner's credentials. If a domain admin left a disconnected RDP session on a host you control, you take over their desktop with a single command.

This requires SYSTEM-level privileges on the host. Getting there is a privilege escalation task. Once you have SYSTEM, hijacking is trivial and leaves minimal forensic trace compared to other lateral movement techniques — no new process is created under the target user, and the session transfer looks like a legitimate reconnection.

Identifying Sessions

List all active and disconnected sessions on the current host:

Or the equivalent:

Disc means disconnected — the user closed their RDP window without logging off. Their session is still alive in memory with all their tokens and network connections intact. Session IDs 2 and 3 are targets.

For remote hosts you have admin access to:

Hijacking with tscon – Service Method

tscon.exe run directly requires matching session ownership or SYSTEM. Creating a service that runs as SYSTEM bypasses this. From a local admin shell:

Elevate to SYSTEM first using PsExec or any other method:

Then switch directly to the target session — connecting it to your current console session:

Where $SESSION_ID is the ID of the session you want to hijack and $YOUR_SESSION_ID is your current session name from query user.

Without SYSTEM first, create a service that runs tscon as SYSTEM:

The service runs as SYSTEM, executes tscon, connects the target session to your current RDP connection, and their desktop replaces yours. You are now in their session.

Clean up the service afterward:

Hijacking with SharpRDPHijack

SharpRDPHijack automates the WTS API calls and provides cleaner options including remote session querying and shadow session support:

Query sessions on a remote host:

Hijack a specific session without a password (requires elevated context):

On Windows Server 2019 and later, hijacking a session that is currently redirected to an active RDP connection prompts for the user's password. Redirecting to the console session works without a password on all versions:

Remote Hijacking

If you have SYSTEM on one host and want to hijack sessions on another, use PsExec to run the tscon command remotely on the target host:

This connects the target user's session to the physical console of the remote host. You then need another RDP connection to view it, or use the shadow feature.

Session Shadowing (View Without Hijacking)

Shadow mode lets you observe a session without taking it over. This is useful for watching what a user is doing without disrupting their session:

/noConsentPrompt removes the confirmation dialog that would otherwise alert the user. Requires admin rights on the target.