Skip to main content
Default Port: 3389 RDP is how most Windows environments get administered remotely, which makes it both an obvious entry point and, once you’re on a box, a direct path to pivot onto other machines that share the same credentials. It’s graphical rather than a shell, so a lot of what makes RDP interesting offensively isn’t the protocol itself but what you can do once a session is open: hijack someone else’s session, relay a hash, or just log in with weak credentials nobody rotated.

Standard Login

A normal authenticated session, password or pass-the-hash. The baseline access most of this page builds on.

Session Hijacking

If you land SYSTEM on a box with other active RDP sessions, you can take over one of those sessions directly, no password needed at all.

​
Connecting

Pass-the-hash works the same way, just swap /p for /pth:

​
Recon

Impacket’s rdp_check.py confirms the service is reachable and reports its security settings without a full login attempt:

​
Brute Forcing

RDP brute-forcing is notably slower and more error-prone than most other protocols because each attempt involves setting up a full session. -t 1 in Hydra (single thread) is often more reliable than the default, even though it’s slower.

​
Pass-the-Hash

From an already-compromised machine, Mimikatz can launch an RDP session directly using a captured hash without ever touching a plaintext password:

​
BlueKeep (CVE-2019-0708)

BlueKeep is wormable, pre-authentication RCE affecting Windows 7, Server 2008, and XP. A confirmed-vulnerable host is a critical finding, and exploitation carries a real risk of crashing the target. Confirm this is explicitly authorized before attempting it.
If confirmed vulnerable:

​
RDP Session Hijacking

This requires SYSTEM-level access on the target already. It’s a post-exploitation technique for taking over an existing session, not a way to gain initial access.
With SYSTEM privileges, tscon can attach your session directly to another logged-in user’s session, bypassing authentication entirely since you’re reusing their already-authenticated session.

​
Sticky Keys Backdoor

This modifies a core system binary and survives reboots. Treat it strictly as a persistence technique, confirm it’s within scope, and remove it during cleanup.
Replacing the accessibility shortcut binary with cmd.exe gives a SYSTEM shell straight from the login screen, no credentials needed at all once it’s in place.
At the RDP login screen, pressing Shift five times now opens a SYSTEM command prompt instead of the accessibility dialog.

​
RDP Man-in-the-Middle

This requires network position between the client and the target, and actively intercepts live authentication traffic. Confirm scope explicitly covers this before running it.
Seth performs a MITM downgrade against RDP connections and recovers credentials in the process.

​
Known RDP Gateway CVEs

​
Metasploit Modules

​
Quick Reference Tools

Hackviser: RDP

Quick-reference pentesting guide for the RDP service.

HackTricks: RDP

Deeper breakdown of RDP enumeration and exploitation techniques.

Seth

RDP man-in-the-middle tool for credential capture.
Session hijacking, sticky keys, and MITM attacks are all high-impact, easily detected actions. Confirm scope before going beyond standard authenticated access.