Password brute force

RDP accepts Windows credentials, so brute force and password spraying target the logon directly. Windows account lockout and the cost of each RDP handshake make low-and-slow spraying of validated users the practical approach; a hit gives an interactive desktop, often administrative, and is usually reusable across the domain.

Dakika 1 za kusomailisasishwa 5 Okt 2026florianamettemchangiaji 1
Uliza msaidizi wako (MCP)Hariri kwenye GitHub

RDP authenticates against Windows accounts, so online guessing goes straight to the applicable local or domain identity provider. Two constraints shape testing: account-lockout policy and the relative expense of each RDP connection. Password spraying distributes a small number of guesses across accounts, but it does not eliminate lockout or detection risk. A successful guess establishes only that the account can log on to that target; its local privilege and reuse on other systems require separate validation.

bash
# spray one password across users, respecting lockout (single-threaded, paced)
nxc rdp <target> -u users.txt -p 'Spring2025!'         # flags valid creds and admin access
crowbar -b rdp -s <target>/32 -u admin -C passwords.txt -n 1
hydra -L users.txt -p 'Spring2025!' rdp://<target> -t 1
# derive the lockout threshold first (from SMB/LDAP) to spray safely
nxc smb <dc> -u user -p pass --pass-pol 2>/dev/null

Exploitation notes#

  • Learn the lockout policy before spraying (via SMB/LDAP --pass-pol): spray fewer attempts than the threshold per window, and wait out the reset, or risk locking accounts and alerting defenders.
  • Spray validated usernames (from RDP NTLM info domain data plus AD enumeration) in domain\user or UPN form; a single common password across the org finds the weak accounts.
  • Use the resulting session and authorized privilege checks to determine whether the account is a standard user or administrator; do not infer privilege solely from successful RDP authentication.
  • Treat reuse on other hosts and services as a separate, lockout-aware test rather than an assumed property of a valid RDP credential.

Tools#

References#

IliyotanguliaNLA bypassInayofuata Enumeration