Overview¶
Remote Desktop Protocol (RDP) is a proprietary protocol developed by Microsoft that allows users to remotely connect to and interact with Windows systems through a graphical interface.
RDP commonly operates on TCP port 3389, although administrators can configure it to use another port.
RDP authentication generally requires valid credentials for an account on the target Windows system. In a penetration testing lab, weak or reused credentials can make RDP susceptible to password-guessing attacks.
The general attack flow is:
Reconnaissance
|
v
Identify RDP
|
v
Determine RDP Port
|
v
RDP Enumeration
|
v
Credential Testing
|
v
Remote Access
Identifying the Target¶
Start by performing service enumeration against the target.
Example output:
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012
3333/tcp open ssl/dec-notes?
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49163/tcp open msrpc Microsoft Windows RPC
The scan does not show RDP on the default port 3389. However, TCP port 3333 is open and requires further investigation.
RDP does not have to run on port 3389. It can be configured to listen on a different TCP port.
RDP Enumeration with Metasploit¶
Metasploit Framework contains an auxiliary module for identifying systems that speak RDP.
Search for the RDP scanner:
Example:
Load the module:
View the available options:
Important options include:
RHOSTS Target host
RPORT Target port
DETECT_NLA Detect Network Level Authentication
THREADS Number of concurrent threads
For the lab target, configure the host and port:
msf6 auxiliary(scanner/rdp/rdp_scanner) > set RHOSTS 10.2.24.86
msf6 auxiliary(scanner/rdp/rdp_scanner) > set RPORT 3333
Run the scanner:
Example result:
[*] 10.2.24.86:3333 - Detected RDP on 10.2.24.86:3333
(Windows version: 6.3.9600) (Requires NLA: Yes)
[*] 10.2.24.86:3333 - Scanned 1 of 1 hosts
[*] Auxiliary module execution completed
This confirms that TCP port 3333 is running RDP.
Credential Testing¶
Once RDP has been identified, valid credentials are required for authentication.
In an authorized lab environment, a password-guessing tool such as Hydra can be used to test a controlled credential set.
Example:
hydra -L /usr/share/metasploit-framework/data/wordlists/common_users.txt \
-P /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt \
rdp://10.2.24.86 -s 3333
The important parameters are:
Example output from the lab:
[3333][rdp] host: 10.2.24.86
login: administrator
password: qwertyuiop
1 of 1 target successfully completed
4 valid passwords found
This indicates that valid credentials were identified during the controlled lab test.
Connecting Through RDP¶
After obtaining valid credentials, an RDP client can be used to verify remote access.
For example, xfreerdp can be used:
The /v option specifies the target address and port:
Because the server uses a certificate that does not match the IP address, the client may display a certificate warning.
After accepting the certificate in the controlled lab, the RDP session can establish a graphical connection to the Windows Server.
Understanding the Attack¶
The complete process demonstrated in the lab is:
Target
10.2.24.86
|
| Nmap Service Enumeration
v
TCP/3333
|
| Metasploit RDP Scanner
v
RDP Detected
|
| Credential Testing
v
Valid Credentials
|
| xfreerdp
v
Windows Server Desktop
The important point is that RDP does not necessarily use TCP port 3389. Service enumeration should therefore be used to identify unusual or non-standard ports.
Security Considerations¶
RDP should not be exposed directly to untrusted networks without appropriate protections.
Recommended controls include:
-
Use Network Level Authentication (NLA)
-
Enforce strong, unique passwords
-
Implement account lockout and rate limiting
-
Restrict RDP access using firewall rules and VPNs
-
Monitor repeated authentication failures
-
Disable unused RDP services
-
Keep Windows systems patched
-
Use multi-factor authentication where supported
-
Avoid exposing RDP directly to the public Internet
Key Commands¶
msf6 > search rdp_scanner
msf6 > use auxiliary/scanner/rdp/rdp_scanner
msf6 auxiliary(scanner/rdp/rdp_scanner) > show options
msf6 auxiliary(scanner/rdp/rdp_scanner) > set RHOSTS <TARGET>
msf6 auxiliary(scanner/rdp/rdp_scanner) > set RPORT <PORT>
msf6 auxiliary(scanner/rdp/rdp_scanner) > run
Lab only: Credential testing and remote access techniques should only be performed against systems you own or have explicit authorization to test.