Questions tagged [rdp]
Remote Desktop Protocol, a protocols for accessing Windows applications remotely
134 questions
0
votes
0
answers
35
views
How risky is it to my macOS PC to use VPS/RDP from unknown marketplace vendors?
I found a lot of cheap daily VPS/RDP services on my local online marketplace, mostly offered at less than half a buck. Since this will be my first time connecting my PC (MacBook Air M1, macOS Sequoia) ...
- 101
0
votes
0
answers
53
views
Are connecting to honeypots through RDP a risk for the connecting computer?
Because the vps where I have installed the t-pot doesn't have any graphic cards (GPU), I must connect to the honeypot through RDP. I connect to the t-pot honeypot directly from my main computer. Are ...
- 113
0
votes
1
answer
245
views
Is an isolated VM (Hyper-V) still safe despite the fact that the host uses RDP to view/control the VM?
This question is directed towards creating an isolated environment for a reverse engineering VM, where malicious programs will be disassembled, debugged by executing them, so static and dynamic ...
0
votes
0
answers
86
views
Security of RDP directly with administrative account VS RDP with normal account and elevation with administrative account
I've had some arguments with people about securing RDP access to servers:
Team 1 (including me) suggests that direct RDP access should only be possible with an (separate) administrative account.
Team ...
- 101
1
vote
1
answer
327
views
Which is more secure to access a VMware Windows VM : VMware Remote console or RDP+Remote Desktop Gateway
Without knowing more details, I can't suggest to our security guy that we should use RDP along with a Remote Desktop Gateway.
One person says to that VMware Remote Console is more secure than using ...
- 111
2
votes
1
answer
1k
views
RDP logout necessary to prevent RDP session hijacking?
We recently got a strengthened security policy where people are required to log out of any RDP connections at the end of the day. So when I turn off my laptop, it is not enough to merely close the RDP ...
- 21
1
vote
1
answer
685
views
Does enabling rdp induces a security risk coming from the internet if no port forwarding/nat is configured?
The question is mainly about the default windows implementation of rdp, but could also apply to xrdp. Enabling rdp is an option in the windows settings (remote desktop).
I would like to use rdp in a ...
- 75
1
vote
1
answer
524
views
RDP Brute Force Attacks
I've discovered my VPS server with RDP access is getting attacked.
Event log shows a bunch of 4625 events.
Now I know for using RDP, this is just the nature of things.
I have changed the RDP port ...
- 13
1
vote
1
answer
4k
views
Is RDP wrapper any more or less secure than the built-in RDP? [closed]
I have read several sources indicating that RDP may have some vulnerabilities.
Without delving into that, is RDP wrapper any more or less secure than the built-in RDP, when it is enabled?
I read ...
1
vote
1
answer
507
views
X11 forwarding to another user. How it's possible?
I would like to understand how the following problem is technically possible:
In my company, we have a machine which I and several colleagues connect to. I regularly use x11 forwarding when I connect ...
- 13
5
votes
2
answers
7k
views
How is RDP through VPN safer?
I've read that I shouldn't open RDP ports on my router (obviously with port forwarding, I don't mean opening 3389 port directly). Instead I should use something like VNC (I get that solution) or ...
- 153
1
vote
0
answers
953
views
How to get the list of computers a user can RDP into using BloodHound?
Using bloodhound I would like to find the list of all computers a user I.e "domain\ajohn" can RDP into.
I looked at:
match p=(g:Group)-[:CanRDP]->(c:Computer) where g.objectid ENDS WITH '-...
- 11
0
votes
0
answers
205
views
Bruteforce on RDP [duplicate]
I have an internet-facing RDP server and getting constant brute force attacks trying random usernames and passwords. It's Windows 2016 with remote desktop services enabled. What can I do to stop this ...
- 1
0
votes
1
answer
404
views
How to protect Windows Remote Desktop Client from untrusted server
We have blocked all direct connections from client computers to the Internet in our firewalls and only allow Internet access via http and https through a Squid proxy.
Now one of my users requests ...
- 1,220
0
votes
0
answers
593
views
How can I check the validity of a selfsigned xrdp certificate
I am connecting to a fedora xrdp server from the built-in Windows Remote Desktop client.
I have access to the /etc/xrdp/key.pem and to the certificate inspection window on on Windows Remote Desktop
...
- 101
0
votes
0
answers
155
views
Firewall IP-Filtered Pinhole Risks
To facilitate consulting work, a client has suggested that they allow me to connect directly to an in-house remote desktop server, via a firewall pinhole which allows connection from my IP address ...
- 101
1
vote
1
answer
296
views
RDP to a Virtual Machine. Where should I apply the security measures? [closed]
I have a computer with Hyper-V installed and a virtual machine. I want to connect only and directly to the VM with Remote-Desktop from outside the network.
I have some good ideas to make the ...
0
votes
1
answer
220
views
RDP security review over private VPN
I know Remote Desktop Protocol can be incredibly insecure if handled wrong. Knowing no system is 100% safe, are there any easy to exploit vulnerabilities in the described system below;
ZeroTier VPN:
...
0
votes
1
answer
1k
views
Disabled MD5 and enabled SHA under SCHANNEL/Hashes in registry. xfreerdp fails with an ssl i/o error
So delving into securing server and not quite understanding how I broke the ability to rdp into my server (using xfreerdp). I disabled MD5 as an available hash and enabled SHA. The exact changes in ...
- 212
1
vote
1
answer
425
views
How do I get my server HSM working while connected via RDP? (Win 2019)
The error I get from pkcs11-tool.exe is "No slots."
My server has a hardware security module (Nitrokey HSM 2) that becomes inaccessible once I connect to my server via Windows Remote Desktop....
- 413
1
vote
2
answers
1k
views
Multiple Established TCP Connections on Port 3389 - Is my server compromised?
If i run
netstat -an
on my Windows Server 2019 it shows multiple connections on Port 3389 (which is RDP)
The first IP Adress is mine, however i cant explain the other two connections. They both ...
- 41
1
vote
1
answer
2k
views
Are Credentials used in RDP cached on Client?
When I enter my domain admin user credentials into the RDP Window, does the Client also save my password hash?
Example:
Windows 10 Client -> Remote Desktop -> Enter Domain Admin User and ...
- 11
-1
votes
1
answer
156
views
How can you attack or redirect the client from the server over an RDP or SSH conneciton? [closed]
I have a penetration testing scenario where I am on the network with two machines, Machine A and Machine B. I have complete control over Machine B and am trying to leverage that to get access to ...
0
votes
0
answers
172
views
How to secure remote desktop?
How to secure RDP connection to prevent the spread of ransomware from users' systems when they connect to corporate systems through remote desktop?
1
vote
2
answers
2k
views
Does VNC need hardening when inside LAN (home network)?
This is a very newbie question, but I would just like to make sure that I'm not missing anything: If I connect via VNC protocol to my various servers etc. inside my own LAN (home network), then should ...
- 21
-2
votes
1
answer
2k
views
Does using a VPS hides the client identity in the web?
I know that a VPS provider can track the client connected to a VPS (This Q/A) using RDP(Remote desktop protocol). But my question is about websites accessed from the VPS using a browser. Can they know ...
- 117
0
votes
0
answers
182
views
How to prevent configuration of Public IP on an interface
I have recently identified a security risk with some of the machines (primarily Windows 10 and MacOS laptops) my company issues to users. Specifically, a small subset of the users are regularly ...
- 1
1
vote
1
answer
301
views
Connecting to server with Proxy vs VPN
Suppose I have a server and no-one can hack into my local area network. I want to Remote Desktop into my server from Internet. Exposing RDP is the most foolish thing I did do once and the server was ...
- 115
4
votes
2
answers
4k
views
Remmina RDP Certificate Fingerprint Changed
I've been using Remmina to connect to my RDP server across the internet. When I first connected to the server, I had to accept the certificate. I have not had to do that since the first time I ...
- 41
0
votes
2
answers
6k
views
RDP Authentication with domain credentials
There's something I don't get with RDP in a domain. During an authentication, if we're using a local account of the distant machine, then the creds are in the SAM so all good.
But with a domain ...
- 3
1
vote
2
answers
791
views
RDP - access security
I have a question about protecting myself against attacks on the RDP service.
I note that I have already done the appropriate configuration:
I am using a local user (not administrator) to connect
...
- 11
0
votes
0
answers
37
views
How is it possible for people to reverse a GoToAssist session? [duplicate]
I am puzzled by how people on Youtube bait scammers into connecting to their machines and end up "reversing" the connection on them. Essentially controlling the scammer's PC.
Is this done via reverse ...
- 275
1
vote
0
answers
168
views
Reasonable security for RDP over VPN
An organisation I work with requires that employees be able to connect to machines on their network and log on to them from machines that are not on the network and not joined to the domain.
They ...
- 111
0
votes
0
answers
2k
views
Is RDP user enumeration possible?
There are many pre-made tools around for brute-forcing RDP credentials, but I haven't found one for username enumeration. Is it possible by design to enumerate potential RDP logins? If not within the ...
- 992
0
votes
0
answers
601
views
RDP with self-signed cert requiring password before launching display
I've noticed that the search engine Shodan grabs screenshots from hosts running an RDP service, even if they offer a certificate.
To my understanding, the certificate is used to authentify the server,...
- 111
2
votes
4
answers
8k
views
Can a website detect remote operation of a computer?
I was wondering if a website I am visiting can detect whether or not the computer that is being used is being operated remotely.
For example...
I have two desktops. I use Desktop 1 to remotely ...
- 23
0
votes
1
answer
2k
views
Whonix with Remmina to Connect on RDP - Is it safe?
I do not want my ISP logging any of my data, and do not trust my VPN either. Is it a safe measure to use Whonix in a VirtualBox, connecting over VPN, then using remmina to connect to an RDP? My goal ...
1
vote
0
answers
158
views
Abusing RDP/SSH post exploitation [closed]
I'm curious to how an attacker would enable RDP/SSH and use it to gain further access to the compromised windows server after achieving remote command/code execution on the server. (Using cmd.exe)
- 11
1
vote
1
answer
171
views
RDP to Azure VMs through public IP versus VPN
I have two options for remoting into our Azure VMs: RDP to public IP or RDP through VPN.
I'm certain using a VPN is 'more' secure. But my question is: Is it still reasonably secure to have a hole in ...
- 181
0
votes
0
answers
193
views
Remote Desktop compromised
So roughly 2 weeks ago my Remote Desktop was compromised whilst I was actively interacting with my server via Rdp I was prompted with a disconnect status equal to “ Another user has connected to ...
1
vote
1
answer
4k
views
Windows RDP logging into itself?
There is a computer system that has to have RDP on an open port(I fought against this of course). I secured this via RDPGuard which worked phenomenally. Anyway, after a few weeks I check back on those ...
- 11
0
votes
2
answers
1k
views
Malware spreading through jump server and SSH data transfer
Can someone explain to me how jump servers mitigate the risk of malware infection please?
Whilst I understand some of the benefits of having a jump server as an extra layer of defence i.e. ...
- 13
0
votes
2
answers
2k
views
Is it possible for specific event logs to have been deleted?
I'm analyzing several hacked machines on our network. On the original hacked machine, I've found event logs indicating a series of successful RDP connections to other machines, but when I go to those ...
- 170
1
vote
1
answer
192
views
Steps to Harden Ancient Gaming Server
I am somewhat administering an old Windows Server 2008 server that is used to host a older Video Game.
It's in such a state that it has tons of custom code on it that run the server and hasn't really ...
- 41
1
vote
1
answer
856
views
Finding the reason behind an RDP Certificate Change (man in the middle attack?)
I've installed some new networking equipment: firewall, switches, vlans, etc. I won't mention the brand name here, because I don't want to cause them harm by my suspicions.
Right after doing this, I ...
- 119
-1
votes
1
answer
347
views
Windows Remote Desktop access modes and security/functionality? [closed]
What are the security implications of running a Windows RDS farm vs. just using RDP for remote administration?
- 33
0
votes
0
answers
294
views
CanRDP right set to computer account?
I was querying a domain and found an interesting ACL that I haven't seen before.
One of the DomainComputer accounts has a CanRDP right set to another domain computer. How would this work? The domain ...
- 121
1
vote
1
answer
521
views
Windows server 2016 Remote Desktop username leaked
One of our servers got infected with ransomware last week (Matrix, .Grhan). The server allowed remote desktop connection from outside on the default port, which was a big security hole (and also, the ...
- 133
1
vote
1
answer
894
views
Metasploit MacOS victim - tools to enable remote desktop / GUI view of the victim
If the exploited victim OS is Windows, metasploit has the getgui command to run RDP. Then he can manipulate the victim OS through the GUI desktop interface.
meterpreter > run getgui -u loneferret -...
- 73
6
votes
1
answer
1k
views
I'm hacked without telling anyone my ip [duplicate]
I have a pc with static IP bought from my ISP and RDP enabled.
I was using this PC for development and didn't tell or use it for any communication purpose so it's not possible that someone knew about ...
- 171