> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/connect-to-machines/rdp.md). # RDP Remote Desktop Protocol (RDP) is a proprietary protocol developed by Microsoft Corporation which provides a user with a graphical interface to connect to another computer over a network connection. ## Connect with rdesktop **rdesktop** is an open source client for Windows NT/2000 Terminal Server and Windows Server 2003/2008. Capable of natively speaking its Remote Desktop Protocol (RDP) in order to present the user’s Windows desktop. Unlike Citrix ICA, no server extensions are required. Install it with `sudo apt-get install rdesktop` if needed. Connect with specific user and full screen mode ```bash rdesktop -u Administrator -p letmein123! -f 10.10.95.87 ``` Connect with specific user and password, setting geometry size to 70% and share a disk as `kali` ```bash rdesktop -u nas -p lab 192.168.154.106 -g 70% -r disk:kali=/home/kali/OffsecLive ``` ## Connect with xfreerdp **xfreerdp** is an X11 Remote Desktop Protocol (RDP) client which is part of the FreeRDP project. Install it with `sudo apt-get install freerdp2-x11` if needed. Connect with specific user (`/u`), password (`/p`) and ignore certificate warnings ```bash xfreerdp /v:$TARGET_IP /cert:ignore /u:Administrator /p:'management2005' ``` Connect with a domain account (`/d`) and enable clipboard redirection ```bash xfreerdp /v:$TARGET_IP /cert:ignore /u:jeff /d:corp.com /p:HenchmanPutridBonbon11 /h:1024 /w:1500 +clipboard ``` Connect and create a window of specified size ```bash xfreerdp /v:$TARGET_IP /cert:ignore /u:alex /p:WelcomeToWinter0121 /h:960 /w:1500 +clipboard ``` Connnect with dynamic size/resolution ```bash xfreerdp /v:$TARGET_IP /cert:ignore /u:'administrator' /p:'letmein123!' -dynamic-resolution +clipboard ``` Connect with a shared drive (`/drive:,/path/to/drive_dir`) ```bash xfreerdp /v:$TARGET_IP /u:stephanie /d:corp.com /p:'LegmanTeamBenzoin!!' /drive:kali,/home/kali/OffSec_Cources ``` ### TLS errors If you get TLS error messages (such as `ERRCONNECT_TLS_CONNECT_FAILED`) try this ```bash xfreerdp /v:$TARGET_IP /cert:ignore /u:TCM /p:'Hacker123' /h:1024 /w:1500 +clipboard /tls-seclevel:0 /sec:rdp ``` This can happen when you connect to older **Windows 7** machines. ## Usage information
rdesktop -h ```bash ┌──(kali㉿kali)-[/mnt/…/TryHackMe/CTFs/Easy/HeartBleed] └─$ rdesktop -h rdesktop: A Remote Desktop Protocol client. Version 1.9.0. Copyright (C) 1999-2016 Matthew Chapman et al. See http://www.rdesktop.org/ for more information. Usage: rdesktop [options] server[:port] -u: user name -d: domain -s: shell / seamless application to start remotely -c: working directory -p: password (- to prompt) -n: client hostname -k: keyboard layout on server (en-us, de, sv, etc.) -g: desktop geometry (WxH[@DPI][+X[+Y]]) -i: enables smartcard authentication, password is used as pin -f: full-screen mode -b: force bitmap updates -L: local codepage -A: path to SeamlessRDP shell, this enables SeamlessRDP mode -V: tls version (1.0, 1.1, 1.2, defaults to negotiation) -B: use BackingStore of X-server (if available) -e: disable encryption (French TS) -E: disable encryption from client to server -m: do not send motion events -M: use local mouse cursor -C: use private colour map -D: hide window manager decorations -K: keep window manager key bindings -S: caption button size (single application mode) -T: window title -t: disable use of remote ctrl -N: enable numlock synchronization -X: embed into another window with a given id. -a: connection colour depth -z: enable rdp compression -x: RDP5 experience (m[odem 28.8], b[roadband], l[an] or hex nr.) -P: use persistent bitmap caching -r: enable specified device redirection (this flag can be repeated) '-r comport:COM1=/dev/ttyS0': enable serial redirection of /dev/ttyS0 to COM1 or COM1=/dev/ttyS0,COM2=/dev/ttyS1 '-r disk:floppy=/mnt/floppy': enable redirection of /mnt/floppy to 'floppy' share or 'floppy=/mnt/floppy,cdrom=/mnt/cdrom' '-r clientname=': Set the client name displayed for redirected disks '-r lptport:LPT1=/dev/lp0': enable parallel redirection of /dev/lp0 to LPT1 or LPT1=/dev/lp0,LPT2=/dev/lp1 '-r printer:mydeskjet': enable printer redirection or mydeskjet="HP LaserJet IIIP" to enter server driver as well '-r sound:[local[:driver[:device]]|off|remote]': enable sound redirection remote would leave sound on server available drivers for 'local': alsa: ALSA output driver, default device: default '-r clipboard:[off|PRIMARYCLIPBOARD|CLIPBOARD]': enable clipboard redirection. 'PRIMARYCLIPBOARD' looks at both PRIMARY and CLIPBOARD when sending data to server. 'CLIPBOARD' looks at only CLIPBOARD. '-r scard[:"Scard Name"="Alias Name[;Vendor Name]"[,...]] example: -r scard:"eToken PRO 00 00"="AKS ifdh 0" "eToken PRO 00 00" -> Device in GNU/Linux and UNIX environment "AKS ifdh 0" -> Device shown in Windows environment example: -r scard:"eToken PRO 00 00"="AKS ifdh 0;AKS" "eToken PRO 00 00" -> Device in GNU/Linux and UNIX environment "AKS ifdh 0" -> Device shown in Microsoft Windows environment "AKS" -> Device vendor name -0: attach to console -4: use RDP version 4 -5: use RDP version 5 (default) -o: name=value: Adds an additional option to rdesktop. sc-csp-name Specifies the Crypto Service Provider name which is used to authenticate the user by smartcard sc-container-name Specifies the container name, this is usually the username sc-reader-name Smartcard reader name to use sc-card-name Specifies the card name of the smartcard to use -v: enable verbose logging ```
xfreerdp /help ```bash ┌──(kali㉿kali)-[~/Desktop] └─$ xfreerdp /help FreeRDP - A Free Remote Desktop Protocol Implementation See www.freerdp.com for more information Usage: xfreerdp [file] [options] [/v:[:port]] Syntax: /flag (enables flag) /option: (specifies option with value) +toggle -toggle (enables or disables toggle, where '/' is a synonym of '+') /a:[,] Addin /action-script: Action script /admin Admin (or console) session +aero Enable desktop composition /app: or || Remote application program /app-cmd: Remote application command-line parameters /app-file: File to open with remote application /app-guid: Remote application GUID /app-icon: Remote application icon for user interface /app-name: Remote application name for user interface /app-workdir: Remote application workspace path /assistance: Remote assistance password /auto-request-control Automatically request remote assistance input control +async-channels Enable Asynchronous channels (experimental) +async-input Enable Asynchronous input +async-update Enable Asynchronous update /audio-mode: Audio output mode +auth-only Enable Authenticate only -authentication Disable Authentication (experimental) +auto-reconnect Enable Automatic reconnection /auto-reconnect-max-retries: Automatic reconnection maximum retries, 0 for unlimited [0,1000] +bitmap-cache Enable bitmap cache /bpp: Session bpp (color depth) /buildconfig Print the build configuration /cert:[deny,ignore,name:,tofu,fingerprint:: [,fingerprint::]] Certificate accept options. Use with care! * deny ... Automatically abort connection if the certificate does not match, no user interaction. * ignore ... Ignore the certificate checks altogether (overrules all other options) * name ... Use the alternate instead of the certificate subject to match locally stored certificates * tofu ... Accept certificate unconditionally on first connect and deny on subsequent connections if the certificate does not match * fingerprints ... A list of certificate hashes that are accepted unconditionally for a connection /cert-deny [deprecated, use /cert:deny] Automatically abort connection for any certificate that can not be validated. /cert-ignore [deprecated, use /cert:ignore] Ignore certificate /cert-name: [deprecated, use /cert:name:] Certificate name /cert-tofu [deprecated, use /cert:tofu] Automatically accept certificate on first connect /client-build-number: Client Build Number sent to server (influences smartcard behaviour, see [MS-RDPESC]) /client-hostname: Client Hostname to send to server -clipboard[:[use-selection:]] Disable Redirect clipboard. * use-selection: ... (X11) Specify which X selection to access. Default is CLIPBOARD. PRIMARY is the X-style middle-click selection. /codec-cache:[rfx|nsc|jpeg] Bitmap codec cache -compression Disable compression /compression-level: Compression level (0,1,2) +credentials-delegation Enable credentials delegation /d: Domain -decorations Disable Window decorations /disp Display control /drive:, Redirect directory as named share . Hotplug support is enabled with /drive:hotplug,*. This argument provides the same function as "Drives that I plug in later" option in MSTSC. +drives Enable Redirect all mount points as shares /dvc:[,] Dynamic virtual channel /dynamic-resolution Send resolution updates when the window is resized /echo Echo channel -encryption Disable Encryption (experimental) /encryption-methods:[40,][56,][128,][FIPS] RDP standard security encryption methods /f Fullscreen mode (++ toggles fullscreen) -fast-path Disable fast-path input/output +fipsmode Enable FIPS mode /floatbar[:sticky:[on|off],default:[visible|hidden],show: [always|fullscreen||window]] floatbar is disabled by default (when enabled defaults to sticky in fullscreen mode) -fonts Disable smooth fonts (ClearType) /frame-ack: Number of frame acknowledgement /from-stdin[:force] Read credentials from stdin. With the prompt is done before connection, otherwise on server request. /g:[:] Gateway Hostname /gateway-usage-method:[direct|detect] Gateway usage method /gd: Gateway domain /gdi:sw|hw GDI rendering /geometry Geometry tracking channel +gestures Enable Consume multitouch input locally /gfx[:[[RFX|AVC420|AVC444],mask:]] RDP8 graphics pipeline /gfx-h264[:[[AVC420|AVC444],mask:] [DEPRECATED] use /gfx:avc420 instead] RDP8.1 graphics pipeline using H264 codec +gfx-progressive Enable RDP8 graphics pipeline using progressive codec +gfx-small-cache Enable RDP8 graphics pipeline using small cache mode +gfx-thin-client Enable RDP8 graphics pipeline using thin client mode +glyph-cache Enable Glyph cache (experimental) /gp: Gateway password -grab-keyboard Disable Grab keyboard -grab-mouse Disable Grab mouse /gt:[rpc|http[,no-websockets]|auto[,no-websockets]] Gateway transport type /gu:[[\]|[@]] Gateway username /gat: Gateway Access Token /h: Height -heartbeat Disable Support heartbeat PDUs /help Print help +home-drive Enable Redirect user home as share /ipv6 Prefer IPv6 AAA record over IPv4 A record /jpeg JPEG codec support /jpeg-quality: JPEG quality /kbd:0x or Keyboard layout /kbd-lang:0x Keyboard active language identifier /kbd-fn-key: Function key value /kbd-list List keyboard layouts /kbd-lang-list List keyboard languages /kbd-remap:List of =,... pairs to remap scancodes Keyboard scancode remapping /kbd-subtype: Keyboard subtype /kbd-type: Keyboard type /load-balance-info: Load balance info /log-filters::[,:[,...]] Set logger filters, see wLog(7) for details /log-level:[OFF|FATAL|ERROR|WARN|INFO|DEBUG|TRACE] Set the default log level, see wLog(7) for details /max-fast-path-size: Specify maximum fast-path update size /max-loop-time: