A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
Every Windows environment has RDP enabled somewhere. Help desk technicians use it. Sysadmins use it. MSPs managing hundreds of clients use it. TCP 3389 is open on more hosts than any other management protocol. And because it requires a GUI session, people leave it running with weak passwords, shared credentials, and no network-level authentication. It is the most consistently exploitable service I encounter.
administrator:password123. On a production RDP host. Crowbar handles the RDP protocol negotiation that Hydra struggles with. One password against a list of usernames. Low and slow. Avoids account lockout. The -b flag specifies the protocol, -s the target, -U the username file, -c the password to spray.
You have local admin on a machine. Another user, a Domain Admin, is connected via RDP. Their session is active. You can hijack it. No password needed. No hash needed. Just SYSTEM privileges and the tscon.exe binary. You create a service that runs tscon to connect to their session ID. Their desktop appears in your window. You are now them.
A new terminal window opens. You are now in the lewen session. If lewen is a Domain Admin, you just escalated from local admin to domain admin without cracking a single password. This technique does not work on Server 2019+, but on Server 2016 and Windows 10, it is reliable.
The nuclear option. BlueKeep is a pre-authentication RCE in the RDP protocol. No credentials required. The vulnerability is a use-after-free in the handling of virtual channels during the connection initialization phase. An attacker sends malformed packets that cause the kernel to free memory, then writes shellcode into that freed memory. SYSTEM-level code execution. 950,000 hosts were vulnerable when it was disclosed. A quarter of them still were months later.
BlueKeep exploitation can cause a Blue Screen of Death on the target. This is a denial of service risk. In a real engagement, get explicit written permission before running the exploit. Speak with the client. Explain the risk. Let them decide. Do not crash a production server because you wanted to prove a point.
RDP attacks span the full spectrum. Password spraying for the lazy admin. Session hijacking for the active Domain Admin. Pass-the-Hash for the credential dumper. BlueKeep for the unpatched legacy system. Four techniques. One port. TCP 3389. Check it on every host. Every single time.
Finish the lesson once you have worked through the material. This awards ★ 40 XP.