RDP logs in with Windows credentials (local or domain), which makes it a direct target for guessing and reuse attacks. Brute force and spraying work against the logon, credential stuffing replays breached username/password pairs, and Network Level Authentication (NLA) moves the check earlier into CredSSP rather than preventing guessing. A successful login creates an interactive session under that account's existing local and domain permissions. Ordinary members of Remote Desktop Users can be authorized to connect without being administrators, so administrative rights and reuse on other systems must be tested separately.
# spray/guess against RDP, respecting lockout (domain\user forms from enumeration)
nxc rdp <target> -u users.txt -p 'Winter2025!' # marks valid + whether admin
hydra -L users.txt -p 'Winter2025!' rdp://<target> -t 1
Subtopics#
- Password brute force: online guessing against the logon.
- Credential stuffing: replaying breached and reused credentials.
- NLA bypass: Network Level Authentication considerations and misconfigurations.