Questions tagged [rdp]

Remote Desktop Protocol, a protocols for accessing Windows applications remotely

Filter by
Sorted by
Tagged with
0
votes
1answer
48 views

RDP security review over private VPN

I know Remote Desktop Protocol can be incredibly insecure if handled wrong. Knowing no system is 100% safe, are there any easy to exploit vulnerabilities in the described system below; ZeroTier VPN: ...
0
votes
0answers
76 views

Disabled MD5 and enabled SHA under SCHANNEL/Hashes in registry. xfreerdp fails with an ssl i/o error

So delving into securing server and not quite understanding how I broke the ability to rdp into my server (using xfreerdp). I disabled MD5 as an available hash and enabled SHA. The exact changes in ...
1
vote
1answer
96 views

How do I get my server HSM working while connected via RDP? (Win 2019)

The error I get from pkcs11-tool.exe is "No slots." My server has a hardware security module (Nitrokey HSM 2) that becomes inaccessible once I connect to my server via Windows Remote Desktop....
1
vote
2answers
102 views

Multiple Established TCP Connections on Port 3389 - Is my server compromised?

If i run netstat -an on my Windows Server 2019 it shows multiple connections on Port 3389 (which is RDP) The first IP Adress is mine, however i cant explain the other two connections. They both ...
1
vote
1answer
95 views

Are Credentials used in RDP cached on Client?

When I enter my domain admin user credentials into the RDP Window, does the Client also save my password hash? Example: Windows 10 Client -> Remote Desktop -> Enter Domain Admin User and ...
-1
votes
1answer
84 views

How can you attack or redirect the client from the server over an RDP or SSH conneciton? [closed]

I have a penetration testing scenario where I am on the network with two machines, Machine A and Machine B. I have complete control over Machine B and am trying to leverage that to get access to ...
0
votes
0answers
113 views

How to secure remote desktop?

How to secure RDP connection to prevent the spread of ransomware from users' systems when they connect to corporate systems through remote desktop?
0
votes
0answers
122 views

How to make Remmina or freerdp display matching Windows remote desktop certificate thumbprint in SHA1? Or Windows to display it in SHA256?

When using Remmina in Ubuntu connecting to Windows remote desktop, a message about a mismatch of certificates get displayed. However, Remmina is displaying it in SHA256 format. But when I look at ...
0
votes
2answers
468 views

Does VNC need hardening when inside LAN (home network)?

This is a very newbie question, but I would just like to make sure that I'm not missing anything: If I connect via VNC protocol to my various servers etc. inside my own LAN (home network), then should ...
-2
votes
1answer
497 views

Does using a VPS hides the client identity in the web?

I know that a VPS provider can track the client connected to a VPS (This Q/A) using RDP(Remote desktop protocol). But my question is about websites accessed from the VPS using a browser. Can they know ...
0
votes
0answers
72 views

How to prevent configuration of Public IP on an interface

I have recently identified a security risk with some of the machines (primarily Windows 10 and MacOS laptops) my company issues to users. Specifically, a small subset of the users are regularly ...
0
votes
1answer
115 views

Connecting to server with Proxy vs VPN

Suppose I have a server and no-one can hack into my local area network. I want to Remote Desktop into my server from Internet. Exposing RDP is the most foolish thing I did do once and the server was ...
4
votes
2answers
2k views

Remmina RDP Certificate Fingerprint Changed

I've been using Remmina to connect to my RDP server across the internet. When I first connected to the server, I had to accept the certificate. I have not had to do that since the first time I ...
0
votes
2answers
4k views

RDP Authentication with domain credentials

There's something I don't get with RDP in a domain. During an authentication, if we're using a local account of the distant machine, then the creds are in the SAM so all good. But with a domain ...
1
vote
2answers
585 views

RDP - access security

I have a question about protecting myself against attacks on the RDP service. I note that I have already done the appropriate configuration: I am using a local user (not administrator) to connect ...
0
votes
0answers
33 views

How is it possible for people to reverse a GoToAssist session? [duplicate]

I am puzzled by how people on Youtube bait scammers into connecting to their machines and end up "reversing" the connection on them. Essentially controlling the scammer's PC. Is this done via reverse ...
1
vote
0answers
123 views

Reasonable security for RDP over VPN

An organisation I work with requires that employees be able to connect to machines on their network and log on to them from machines that are not on the network and not joined to the domain. They ...
0
votes
0answers
1k views

Is RDP user enumeration possible?

There are many pre-made tools around for brute-forcing RDP credentials, but I haven't found one for username enumeration. Is it possible by design to enumerate potential RDP logins? If not within the ...
0
votes
0answers
341 views

RDP with self-signed cert requiring password before launching display

I've noticed that the search engine Shodan grabs screenshots from hosts running an RDP service, even if they offer a certificate. To my understanding, the certificate is used to authentify the server,...
2
votes
3answers
3k views

Can a website detect remote operation of a computer?

I was wondering if a website I am visiting can detect whether or not the computer that is being used is being operated remotely. For example... I have two desktops. I use Desktop 1 to remotely ...
0
votes
1answer
1k views

Whonix with Remmina to Connect on RDP - Is it safe?

My question is based on 2 things. I do not want my ISP logging any of my data, and do not trust my VPN either. Is it a safe measure to use Whonix in a VirtualBox, connecting over VPN. Then using ...
1
vote
0answers
95 views

Abusing RDP/SSH post exploitation [closed]

I'm curious to how an attacker would enable RDP/SSH and use it to gain further access to the compromised windows server after achieving remote command/code execution on the server. (Using cmd.exe)
1
vote
1answer
106 views

RDP to Azure VMs through public IP versus VPN

I have two options for remoting into our Azure VMs: RDP to public IP or RDP through VPN. I'm certain using a VPN is 'more' secure. But my question is: Is it still reasonably secure to have a hole in ...
0
votes
0answers
120 views

Remote Desktop compromised

So roughly 2 weeks ago my Remote Desktop was compromised whilst I was actively interacting with my server via Rdp I was prompted with a disconnect status equal to “ Another user has connected to ...
1
vote
1answer
1k views

Windows RDP logging into itself?

There is a computer system that has to have RDP on an open port(I fought against this of course). I secured this via RDPGuard which worked phenomenally. Anyway, after a few weeks I check back on those ...
0
votes
2answers
635 views

Malware spreading through jump server and SSH data transfer

Can someone explain to me how jump servers mitigate the risk of malware infection please? Whilst I understand some of the benefits of having a jump server as an extra layer of defence i.e. ...
0
votes
2answers
565 views

Is it possible for specific event logs to have been deleted?

I'm analyzing several hacked machines on our network. On the original hacked machine, I've found event logs indicating a series of successful RDP connections to other machines, but when I go to those ...
1
vote
1answer
142 views

Steps to Harden Ancient Gaming Server

I am somewhat administering an old Windows Server 2008 server that is used to host a older Video Game. It's in such a state that it has tons of custom code on it that run the server and hasn't really ...
1
vote
1answer
512 views

Finding the reason behind an RDP Certificate Change (man in the middle attack?)

I've installed some new networking equipment: firewall, switches, vlans, etc. I won't mention the brand name here, because I don't want to cause them harm by my suspicions. Right after doing this, I ...
-1
votes
1answer
236 views

Windows Remote Desktop access modes and security/functionality? [closed]

What are the security implications of running a Windows RDS farm vs. just using RDP for remote administration?
0
votes
0answers
114 views

CanRDP right set to computer account?

I was querying a domain and found an interesting ACL that I haven't seen before. One of the DomainComputer accounts has a CanRDP right set to another domain computer. How would this work? The domain ...
1
vote
1answer
352 views

Windows server 2016 Remote Desktop username leaked

One of our servers got infected with ransomware last week (Matrix, .Grhan). The server allowed remote desktop connection from outside on the default port, which was a big security hole (and also, the ...
0
votes
1answer
163 views

SIEM: Correlating remote logons to associate origin and target user

How is it possible to correlate or detect user logons eg via ssh/rdp to associate the origin user and target user. My use case is to know who actually (personal/identifiable) used a technical account ...
1
vote
1answer
488 views

Metasploit MacOS victim - tools to enable remote desktop / GUI view of the victim

If the exploited victim OS is Windows, metasploit has the getgui command to run RDP. Then he can manipulate the victim OS through the GUI desktop interface. meterpreter > run getgui -u loneferret -...
6
votes
1answer
959 views

I'm hacked without telling anyone my ip [duplicate]

I have a pc with static IP bought from my ISP and RDP enabled. I was using this PC for development and didn't tell or use it for any communication purpose so it's not possible that someone knew about ...
3
votes
0answers
92 views

Is it possible for a remote machine to "escape" from a folder mapped through RDP?

Although most people seem to share entire drives with RDP, it is possible to share individual folders, by mapping them to a drive for example with subst <lettertomap>: <pathtofolder> (for ...
3
votes
2answers
175 views

RDP violation without credentials

On a Windows Server 2003 machine seems like someone has logged in through RDP without using credentials: there is a logged access, but there are nor userid nor password. I am wondering how is this ...
1
vote
1answer
5k views

Best tool to BruteForcing RDP

I have tried many tools and to do not seem to be successful with locking out an account I am testing on my network with an RDP domain. I used crowbar, ncrack and THC hydra but they don't seem to be ...
0
votes
1answer
4k views

THC Hydra on Windows RDP Domain

I am testing a bruteforce on a windows rdp server within a domain. It seems to not be working because nothing is locking out the account I am targeting. How do you specify a domain username? I tried ...
23
votes
2answers
6k views

What are the risks of remoting in (RDP) to a compromised system? [duplicate]

Can the client be harmed in any way, and how?
-2
votes
2answers
303 views

Accidently watched content against company policy while connected to work using RDP

I was at home and had some work to be finished so I used IE connected remotely to my work PC finished the job but forgot to disconnect. After a while I started watch not-safe-for-work material in ...
5
votes
2answers
287 views

CVE-2018-0886 mitigation for an unpatchable RDP server

An up-to-date Windows 10 client is connecting to a Windows 10 RDP host which is stuck at 1511 (host can't be updated and 1511 is out of support for receiving patches such as the CVE-2018-0886 ...
5
votes
1answer
498 views

Can passwords be brute-forced through RDP?

We had a small discussion about a security-related article at work today, and I was a bit surprised about one thing - they claim that some attackers managed to brute-force guess the password of ...
2
votes
1answer
164 views

Controlling windows server on Amazon Web Services

Our site is ISO-27001 compliant. As part of the compliance we were advised not to use RDP to connect to the server, but rather to choose a cloud server which provides a web-interface. Our current ...
5
votes
2answers
771 views

Is there a way to see what is program is causing RDP attempts on computer

One of our servers (running RdpGuard) shows multiple failed attempts from specific users' machines (3 to be exact) and I can't figure out what is causing them. One user is local and two are remote ...
3
votes
2answers
7k views

Is open RDP really dangerous? [duplicate]

I have just started work for a small (100-150 employees) company. I noticed that anybody can remote in to the remote server using the correct domain, which is quite easy to guess based on the company ...
1
vote
0answers
959 views

Check the signature algorithm of RDP certificate

I received a Nessus warning of RDP as following, The following certificates were part of the certificate chain sent by the remote host, but contain hashes that are considered to be weak. |-Subject ...
-1
votes
1answer
475 views

Which of these configurations is better to stay anonymous on the internet? [duplicate]

MyPC > RDP > Windows VPS > Tor > Socks5 > Internet or MyPC with Tor sandboxed > socks5 > Internet. Which is better? Any better idea that doesn’t compromise on network speed?
0
votes
0answers
428 views

RDP - Why self signed certifcate is trusted on client-side?

Here is the issue I can't resolve. Remote RDP server presents a self-signed certificate, and I want to block any connection on client-side when RDP server is using non compliant certificate. I found ...
0
votes
1answer
566 views

RDP Audit Failures Brute Force Attacks

I need some help on tracking the source of these RDP access attempts on our terminal server. Port 3389 is open on the firewall (I know this is a terrible practice. I don't want to hear advice on ...