RDP authenticates against Windows accounts, so online guessing goes straight to the applicable local or domain identity provider. Two constraints shape testing: account-lockout policy and the relative expense of each RDP connection. Password spraying distributes a small number of guesses across accounts, but it does not eliminate lockout or detection risk. A successful guess establishes only that the account can log on to that target; its local privilege and reuse on other systems require separate validation.
# spray one password across users, respecting lockout (single-threaded, paced)
nxc rdp <target> -u users.txt -p 'Spring2025!' # flags valid creds and admin access
crowbar -b rdp -s <target>/32 -u admin -C passwords.txt -n 1
hydra -L users.txt -p 'Spring2025!' rdp://<target> -t 1
# derive the lockout threshold first (from SMB/LDAP) to spray safely
nxc smb <dc> -u user -p pass --pass-pol 2>/dev/null
Exploitation notes#
- Learn the lockout policy before spraying (via SMB/LDAP
--pass-pol): spray fewer attempts than the threshold per window, and wait out the reset, or risk locking accounts and alerting defenders. - Spray validated usernames (from RDP NTLM info domain data plus AD enumeration) in
domain\useror UPN form; a single common password across the org finds the weak accounts. - Use the resulting session and authorized privilege checks to determine whether the account is a standard user or administrator; do not infer privilege solely from successful RDP authentication.
- Treat reuse on other hosts and services as a separate, lockout-aware test rather than an assumed property of a valid RDP credential.