Ctrlk
Infiltr8ForumGitHub
For the complete documentation index, see llms.txt. This page is also available as Markdown.

RDP

Pentesting RDP - TCP Port 3389

Theory

Remote Desktop Protocol (RDP) is a proprietary protocol developed by Microsoft, which provides a user with a graphical interface to connect to another computer over a network connection. The user employs RDP client software for this purpose, while the other computer must run RDP server software.

NLA will allow us to authenticate the user before the opening of an RDP session, thus avoiding unnecessary demands on the server if the person cannot authenticate. The CredSSP protocol is used for authentication.

Practice

Enumerate

We can use nmap to enumerate informations about the running RDP server

# Enum NetBIOS, DNS, and OS build version.
nmap -p 3389 --script rdp-ntlm-info <target>

# Enum available encryption and CredSSP (NLA)
nmap -p 3389 --script rdp-enum-encryption <target>

Targeting Accounts

When bruteforcing accounts, you may lock accounts

#Hydra
hydra -V -f -L <userslist> -P <passwlist> rdp://<IP>

#NetExec
netexec rdp <IP> -u <userlist> -p <passwlist>

We can use following commands to password spray

#Hydra
hydra -L <userslist> -p 'password123' rdp://<IP>

#NetExec - Spray on target
netexec rdp <IP> -u <userlist> -p 'password123'

#NetExec - Spray on subnet
netexec rdp 10.10.10.0/24 -u <userlist> -p 'password123'

Logging in

We can use xfreerdp to connect into a RDP server with known credentials or using Pass the hash technique.

We can use rdesktop to connect into a RDP server with known credentials

Using the rdp_check.py script from impacket, we can check if some credentials are valid for a RDP service

Using netexec, we can check if some credentials are valid for a RDP service

Headless RDP

Executing commands on a remote host is possible by using a headless (non-GUI) RDP lateral movement technique brought by a tool called SharpRDP.

Vulnerabilities

MS12-020 (CVE-2012-0152)

This CVE address a denial of service (DOS) vulnerability in the Remote Desktop Service.

Tools like nmap can be used to detect the presence of the CVE-2012-0152 vulnerability without crashing the target.

We can use this python exploit (do not forget to change the hardcoded IP)

BlueKeep - CVE-2019-0708

RDP uses "virtual channels", configured before authentication, as a data path between the client and server for providing extensions. RDP 5.1 defines 32 "static" virtual channels, and "dynamic" virtual channels are contained within one of these static channels. If a server binds the virtual channel "MS_T120" (a channel for which there is no legitimate reason for a client to connect to) with a static channel other than 31, heap corruption occurs that allows for arbitrary code execution at the system level.

Bluekeep or CVE-2019-0708 is an RCE exploit that effects the following versions of Windows systems:

  • Windows 2003

  • Windows XP

  • Windows Vista

  • Windows 7

  • Windows Server 2008

  • Windows Server 2008 R2

Windows 8,10,11, Windows Server 2012 and above are not affected

If the target uses RDP and the Windows version is mentioned above, it is vulnerable.

Alternatively, we can use the rdp_detect_info.py from worawit github to detect the vulnerability

Additionally, we can use metasploit to scan a target

To exploit, we may use the RICSecLab exploit on GitHub to gain a revers shell

This exploit have been made for Windows 7 targets

Exploit may cause the system to crash

We can easily exploit this vulnerability using a metasploit frameworks

Session stealing

With SYSTEM permissions you can access any opened RDP session by any user without need to know the password of the owner. It only use Windows tools and features.

On the target system:

When you access an active RDP sessions you will kickoff the user that was using it.

We can perform this attack with mimikatz

Shadow Attack

AutoRDPwn is a post-exploitation framework created in Powershell, designed primarily to automate the Shadow attack on Microsoft Windows computers. This vulnerability (listed as a feature by Microsoft) allows a remote attacker to view his victim's desktop without his consent, and even control it on demand, using tools native to the operating system itself. More info here

RDP Process Injection (rdpclip.exe)

If someone from a different domain or with better privileges login via RDP to the PC where you are an Admin, you can inject your beacon in his RDP session process and act as him.

If a user access via RDP into a machine where an attacker is waiting for him with admin privileges, the attacker will be able to inject a beacon in the RDP session of the user and if the victim mounted his drive when accessing via RDP, the attacker could access it.

In this case you could just compromise the victims original computer by writing a backdoor in the statup folder.

Persistence - Sticky Keys & Utilmans

Using stickykeys or utilman as a persistence vetcor, you will be able to access a administrative CMD and any RDP session anytime

Accessibility features Backdoor

Resources

LogoBlueKeep (CVE-2019-0708) & Metasploitnet-security.fr
LogoLateral Movement over headless RDP with SharpRDP | Red Team Noteswww.ired.team
LogoRDP Sessions Abuse - HackTricksHackTricks
Logo3389 - Pentesting RDP - HackTricksHackTricks

Last updated