RDP
RDP Services
Remote Desktop Protocol (RDP) is a proprietary protocol developed by Microsoft that provides a graphical interface for connecting to another computer over a network connection. It's widely used by system administrators and end users for remote access to Windows systems, making it a common target during penetration testing.
Protocol Overview
RDP operates on TCP port 3389 by default, though this can be changed in the registry. The protocol enables:
Full graphical access to remote systems
File transfer capabilities
Audio and video redirection
Clipboard sharing
Printer redirection
Enumeration Techniques
Basic Port Scanning
# Simple port scan
nmap -Pn -p3389 192.168.2.143
# Service version detection
nmap -Pn -p3389 -sV 192.168.2.143Example output:
Banner Grabbing
This may not provide a traditional text banner but can confirm the service is running.
RDP Security Assessment
Nmap has several RDP-specific scripts that can:
Check supported security protocols
Test for known vulnerabilities
Verify NLA (Network Level Authentication) settings
Common Misconfigurations
Authentication Issues
RDP services can be vulnerable to authentication-related issues:
Weak Credentials: Default or easily guessed passwords
No Account Lockout Policy: Allows unlimited password attempts
NLA Disabled: Enables pre-authentication vulnerabilities
Password Spraying
When an account lockout policy isn't configured or is too lenient, password spraying can be effective:
Example output:
Using Hydra
Example output:
Accessing RDP Services
Using rdesktop (Linux)
Using xfreerdp (Linux)
Using mstsc (Windows)
On Windows, you can use the built-in Remote Desktop Connection (mstsc.exe):
Press Win + R
Type
mstscEnter the target IP and credentials
Advanced Attack Techniques
RDP Session Hijacking
With local administrator access on a system, you can hijack other users' RDP sessions:
First, identify active sessions:
Example output:
Create a service to execute the hijack using
tscon:
Start the service:
This technique works by redirecting the target session to your current session, effectively taking it over without needing the user's credentials.
RDP Pass-the-Hash (PtH)
On systems with Restricted Admin Mode enabled, you can use NTLM hashes instead of cleartext passwords:
First, ensure Restricted Admin Mode is enabled on the target:
Use xfreerdp with the hash:
If the hash is valid and Restricted Admin Mode is enabled, you'll be logged in without requiring the cleartext password.
Known RDP Vulnerabilities
CVE-2019-0708 (BlueKeep)
A critical remote code execution vulnerability in Remote Desktop Services:
Affects Windows 7, Windows Server 2008 R2, and earlier versions
Pre-authentication and requires no user interaction
Can potentially allow wormable malware
Detection:
CVE-2012-0002 (MS12-020)
A vulnerability in Remote Desktop Protocol that could allow remote code execution:
Affects multiple versions of Microsoft Windows
Exploitable over the RDP protocol
Can cause denial of service
CVE-2020-0609/CVE-2020-0610
Remote code execution vulnerabilities in Windows Remote Desktop Gateway:
Affects Windows Server 2012, 2012 R2, 2016, 2019
Pre-authentication and requires no user interaction
Enables arbitrary code execution on the gateway server
Defensive Measures
When testing RDP services, consider these security recommendations:
RDP Hardening
Enable Network Level Authentication (NLA)
Requires user authentication before establishing a full RDP connection
Registry path:
HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-TcpSetting:
SecurityLayer= 2,UserAuthentication= 1
Implement Account Lockout Policies
Prevents brute force attacks
Recommended: 5-10 invalid attempts before lockout
Use Strong Passwords
Complex passwords for all accounts with RDP access
Consider password management solutions
Restrict RDP Access
Limit RDP to specific IP addresses using Windows Firewall
Use VPN for remote access before allowing RDP connections
Disable RDP When Not Needed
Registry path:
HKLM\System\CurrentControlSet\Control\Terminal ServerSetting:
fDenyTSConnections= 1
Use TLS 1.2 or Higher
Provides stronger encryption
Registry path:
HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols
Implement Multi-Factor Authentication
Adds an additional layer of security
Consider solutions like Duo Security, Azure MFA, etc.
RDP Penetration Testing Methodology
When testing RDP services, follow these steps:
Discovery: Identify systems with RDP enabled
Enumeration: Determine RDP version and security settings
Authentication Testing: Test for weak credentials and password policies
Security Configuration Assessment: Check NLA, encryption level, etc.
Vulnerability Testing: Test for known RDP vulnerabilities
Post-Authentication Testing: Attempt session hijacking, escalation, etc.
Reporting: Document findings and suggest mitigation measures
Practical Testing Scripts
Automated RDP Scanning Script
Password Spraying Wrapper
RDP Client Security Considerations
When using RDP clients during penetration testing, consider:
Clipboard Sharing: Disable if not needed to prevent data leakage
Drive Redirection: Disable to prevent accidental file exposure
Client-Side Vulnerabilities: Keep RDP clients updated
Session Recording: Consider recording sessions for documentation
Network Isolation: Use dedicated networks for penetration testing
By understanding RDP services and their security implications, penetration testers can effectively identify vulnerabilities and suggest appropriate security improvements for remote access infrastructure.
Last updated