> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/enumeration/rdp.md).

# RDP

**Remote Desktop Protocol (RDP)** allows users to connect to and control remote Windows systems.

Default RDP Port: `3389`

***

### Common Tools for RDP Connection

| Tool       | Description                     |
| ---------- | ------------------------------- |
| `rdesktop` | CLI-based RDP client            |
| `xfreerdp` | Flexible, modern RDP client     |
| `remmina`  | GUI-based remote desktop client |

#### Example:

```bash
rdesktop <ip>
```

```bash
xfreerdp /u:<username> /p:<password> /v:<ip>
```

```bash
remmina
```

***

### Banner Grabbing & TLS Scanning

Check SSL/TLS support and identify vulnerabilities:

```bash
sslscan <ip>:3389
testssl.sh <ip>:3389
```

These tools help detect deprecated SSL versions, certificate issues.

***

### Nmap NSE Scripts for RDP

Run the following Nmap scripts to enumerate encryption settings, NTLM details, and known vulnerabilities:

```bash
nmap -p 3389 --script=rdp-enum-encryption,rdp-ntlm-info,rdp-vuln-ms12-020 <ip>
```

| Script                | Purpose                                                            |
| --------------------- | ------------------------------------------------------------------ |
| `rdp-enum-encryption` | Detects RDP encryption level (Standard, High, FIPS, etc.)          |
| `rdp-ntlm-info`       | Attempts to extract Windows domain, version, and hostname via NTLM |
| `rdp-vuln-ms12-020`   | Checks for vulnerability to MS12-020 (DoS / possible RCE)          |

> These scripts are most useful on **Windows targets**, and provide limited output on Linux-based xRDP servers.

***

### Notable RDP Vulnerabilities

#### BlueKeep (CVE-2019-0708)

A critical RDP vulnerability that allows **unauthenticated remote code execution** on vulnerable systems.

* Affects: Windows XP to Windows Server 2008 R2
* Detection: Use `nmap`, or `Nessus`

***

### RDP Brute-force with Hydra

Perform brute-force authentication attempts using `hydra`:

```bash
hydra -t 4 -V -f -l Administrator -P /usr/share/wordlists/rockyou.txt rdp://<ip>
```

{% hint style="danger" %}
Many RDP servers have account lockout policies. Avoid aggressive brute-forcing to prevent lockout or detection.
{% endhint %}