RDP
Pentesting RDP - TCP Port 3389
Theory
Remote Desktop Protocol (RDP) is a proprietary protocol developed by Microsoft, which provides a user with a graphical interface to connect to another computer over a network connection. The user employs RDP client software for this purpose, while the other computer must run RDP server software.
NLA will allow us to authenticate the user before the opening of an RDP session, thus avoiding unnecessary demands on the server if the person cannot authenticate. The CredSSP protocol is used for authentication.
Practice
Enumerate
We can use nmap to enumerate informations about the running RDP server
# Enum NetBIOS, DNS, and OS build version.
nmap -p 3389 --script rdp-ntlm-info <target>
# Enum available encryption and CredSSP (NLA)
nmap -p 3389 --script rdp-enum-encryption <target>Targeting Accounts
When bruteforcing accounts, you may lock accounts
#Hydra
hydra -V -f -L <userslist> -P <passwlist> rdp://<IP>
#NetExec
netexec rdp <IP> -u <userlist> -p <passwlist>We can use following commands to password spray
#Hydra
hydra -L <userslist> -p 'password123' rdp://<IP>
#NetExec - Spray on target
netexec rdp <IP> -u <userlist> -p 'password123'
#NetExec - Spray on subnet
netexec rdp 10.10.10.0/24 -u <userlist> -p 'password123'Logging in
We can use xfreerdp to connect into a RDP server with known credentials or using Pass the hash technique.
We can use rdesktop to connect into a RDP server with known credentials
Using the rdp_check.py script from impacket, we can check if some credentials are valid for a RDP service
Using netexec, we can check if some credentials are valid for a RDP service
Headless RDP
Vulnerabilities
MS12-020 (CVE-2012-0152)
This CVE address a denial of service (DOS) vulnerability in the Remote Desktop Service.
Tools like nmap can be used to detect the presence of the CVE-2012-0152 vulnerability without crashing the target.
We can use this python exploit (do not forget to change the hardcoded IP)
BlueKeep - CVE-2019-0708
RDP uses "virtual channels", configured before authentication, as a data path between the client and server for providing extensions. RDP 5.1 defines 32 "static" virtual channels, and "dynamic" virtual channels are contained within one of these static channels. If a server binds the virtual channel "MS_T120" (a channel for which there is no legitimate reason for a client to connect to) with a static channel other than 31, heap corruption occurs that allows for arbitrary code execution at the system level.
Bluekeep or CVE-2019-0708 is an RCE exploit that effects the following versions of Windows systems:
Windows 2003
Windows XP
Windows Vista
Windows 7
Windows Server 2008
Windows Server 2008 R2
If the target uses RDP and the Windows version is mentioned above, it is vulnerable.
Alternatively, we can use the rdp_detect_info.py from worawit github to detect the vulnerability
Additionally, we can use metasploit to scan a target
To exploit, we may use the RICSecLab exploit on GitHub to gain a revers shell
Exploit may cause the system to crash
We can easily exploit this vulnerability using a metasploit frameworks
Session stealing
With SYSTEM permissions you can access any opened RDP session by any user without need to know the password of the owner. It only use Windows tools and features.
On the target system:
When you access an active RDP sessions you will kickoff the user that was using it.
We can perform this attack with mimikatz
Shadow Attack
AutoRDPwn is a post-exploitation framework created in Powershell, designed primarily to automate the Shadow attack on Microsoft Windows computers. This vulnerability (listed as a feature by Microsoft) allows a remote attacker to view his victim's desktop without his consent, and even control it on demand, using tools native to the operating system itself. More info here
RDP Process Injection (rdpclip.exe)
If someone from a different domain or with better privileges login via RDP to the PC where you are an Admin, you can inject your beacon in his RDP session process and act as him.
If a user access via RDP into a machine where an attacker is waiting for him with admin privileges, the attacker will be able to inject a beacon in the RDP session of the user and if the victim mounted his drive when accessing via RDP, the attacker could access it.
In this case you could just compromise the victims original computer by writing a backdoor in the statup folder.
Persistence - Sticky Keys & Utilmans
Using stickykeys or utilman as a persistence vetcor, you will be able to access a administrative CMD and any RDP session anytime
Accessibility features BackdoorResources
Last updated
Was this helpful?