Questions tagged [rdp]

Remote Desktop Protocol, a protocols for accessing Windows applications remotely

Filter by
Sorted by
Tagged with
3 votes
1 answer
932 views

How is RDP through VPN safer?

Everywhere on the internet I read that I shouldn't open RDP ports on my router (obviously with port forwarding, I don't mean opening 3389 port directly). Instead I should use something like VNC (I get ...
user avatar
  • 33
1 vote
0 answers
32 views

How to get the list of computers a user can RDP into using BloodHound?

Using bloodhound I would like to find the list of all computers a user I.e "domain\ajohn" can RDP into. I looked at: match p=(g:Group)-[:CanRDP]->(c:Computer) where g.objectid ENDS WITH '-...
user avatar
  • 11
0 votes
0 answers
34 views

Bruteforce on RDP [duplicate]

I have an internet-facing RDP server and getting constant brute force attacks trying random usernames and passwords. It's Windows 2016 with remote desktop services enabled. What can I do to stop this ...
user avatar
  • 1
-1 votes
1 answer
77 views

How to protect Windows Remote Desktop Client from untrusted server

We have blocked all direct connections from client computers to the Internet in our firewalls and only allow Internet access via http and https through a Squid proxy. Now one of my users requests ...
user avatar
0 votes
0 answers
42 views

How can I check the validity of a selfsigned xrdp certificate

I am connecting to a fedora xrdp server from the built-in Windows Remote Desktop client. I have access to the /etc/xrdp/key.pem and to the certificate inspection window on on Windows Remote Desktop ...
user avatar
  • 101
0 votes
0 answers
25 views

Firewall IP-Filtered Pinhole Risks

To facilitate consulting work, a client has suggested that they allow me to connect directly to an in-house remote desktop server, via a firewall pinhole which allows connection from my IP address ...
user avatar
  • 101
0 votes
1 answer
44 views

RDP to a Virtual Machine where should i do the security Measures

i have a Computer, on which Hyper-V is installed, there i created a Virtual Machine. I want to connect only and directly to the Virtual Machine with Remote-Desktop from outside the Network I have some ...
user avatar
0 votes
1 answer
87 views

RDP security review over private VPN

I know Remote Desktop Protocol can be incredibly insecure if handled wrong. Knowing no system is 100% safe, are there any easy to exploit vulnerabilities in the described system below; ZeroTier VPN: ...
user avatar
0 votes
0 answers
132 views

Disabled MD5 and enabled SHA under SCHANNEL/Hashes in registry. xfreerdp fails with an ssl i/o error

So delving into securing server and not quite understanding how I broke the ability to rdp into my server (using xfreerdp). I disabled MD5 as an available hash and enabled SHA. The exact changes in ...
user avatar
  • 212
1 vote
1 answer
134 views

How do I get my server HSM working while connected via RDP? (Win 2019)

The error I get from pkcs11-tool.exe is "No slots." My server has a hardware security module (Nitrokey HSM 2) that becomes inaccessible once I connect to my server via Windows Remote Desktop....
user avatar
1 vote
2 answers
174 views

Multiple Established TCP Connections on Port 3389 - Is my server compromised?

If i run netstat -an on my Windows Server 2019 it shows multiple connections on Port 3389 (which is RDP) The first IP Adress is mine, however i cant explain the other two connections. They both ...
user avatar
  • 53
1 vote
1 answer
134 views

Are Credentials used in RDP cached on Client?

When I enter my domain admin user credentials into the RDP Window, does the Client also save my password hash? Example: Windows 10 Client -> Remote Desktop -> Enter Domain Admin User and ...
user avatar
-1 votes
1 answer
95 views

How can you attack or redirect the client from the server over an RDP or SSH conneciton? [closed]

I have a penetration testing scenario where I am on the network with two machines, Machine A and Machine B. I have complete control over Machine B and am trying to leverage that to get access to ...
user avatar
0 votes
0 answers
122 views

How to secure remote desktop?

How to secure RDP connection to prevent the spread of ransomware from users' systems when they connect to corporate systems through remote desktop?
user avatar
0 votes
2 answers
639 views

Does VNC need hardening when inside LAN (home network)?

This is a very newbie question, but I would just like to make sure that I'm not missing anything: If I connect via VNC protocol to my various servers etc. inside my own LAN (home network), then should ...
user avatar
-2 votes
1 answer
802 views

Does using a VPS hides the client identity in the web?

I know that a VPS provider can track the client connected to a VPS (This Q/A) using RDP(Remote desktop protocol). But my question is about websites accessed from the VPS using a browser. Can they know ...
user avatar
0 votes
0 answers
77 views

How to prevent configuration of Public IP on an interface

I have recently identified a security risk with some of the machines (primarily Windows 10 and MacOS laptops) my company issues to users. Specifically, a small subset of the users are regularly ...
user avatar
0 votes
1 answer
146 views

Connecting to server with Proxy vs VPN

Suppose I have a server and no-one can hack into my local area network. I want to Remote Desktop into my server from Internet. Exposing RDP is the most foolish thing I did do once and the server was ...
user avatar
4 votes
2 answers
2k views

Remmina RDP Certificate Fingerprint Changed

I've been using Remmina to connect to my RDP server across the internet. When I first connected to the server, I had to accept the certificate. I have not had to do that since the first time I ...
user avatar
  • 41
0 votes
2 answers
4k views

RDP Authentication with domain credentials

There's something I don't get with RDP in a domain. During an authentication, if we're using a local account of the distant machine, then the creds are in the SAM so all good. But with a domain ...
user avatar
1 vote
2 answers
600 views

RDP - access security

I have a question about protecting myself against attacks on the RDP service. I note that I have already done the appropriate configuration: I am using a local user (not administrator) to connect ...
user avatar
  • 11
0 votes
0 answers
34 views

How is it possible for people to reverse a GoToAssist session? [duplicate]

I am puzzled by how people on Youtube bait scammers into connecting to their machines and end up "reversing" the connection on them. Essentially controlling the scammer's PC. Is this done via reverse ...
user avatar
  • 265
1 vote
0 answers
126 views

Reasonable security for RDP over VPN

An organisation I work with requires that employees be able to connect to machines on their network and log on to them from machines that are not on the network and not joined to the domain. They ...
user avatar
  • 111
0 votes
0 answers
1k views

Is RDP user enumeration possible?

There are many pre-made tools around for brute-forcing RDP credentials, but I haven't found one for username enumeration. Is it possible by design to enumerate potential RDP logins? If not within the ...
user avatar
0 votes
0 answers
377 views

RDP with self-signed cert requiring password before launching display

I've noticed that the search engine Shodan grabs screenshots from hosts running an RDP service, even if they offer a certificate. To my understanding, the certificate is used to authentify the server,...
user avatar
2 votes
3 answers
3k views

Can a website detect remote operation of a computer?

I was wondering if a website I am visiting can detect whether or not the computer that is being used is being operated remotely. For example... I have two desktops. I use Desktop 1 to remotely ...
user avatar
0 votes
2 answers
1k views

Whonix with Remmina to Connect on RDP - Is it safe?

I do not want my ISP logging any of my data, and do not trust my VPN either. Is it a safe measure to use Whonix in a VirtualBox, connecting over VPN, then using remmina to connect to an RDP? My goal ...
user avatar
1 vote
0 answers
103 views

Abusing RDP/SSH post exploitation [closed]

I'm curious to how an attacker would enable RDP/SSH and use it to gain further access to the compromised windows server after achieving remote command/code execution on the server. (Using cmd.exe)
user avatar
1 vote
1 answer
118 views

RDP to Azure VMs through public IP versus VPN

I have two options for remoting into our Azure VMs: RDP to public IP or RDP through VPN. I'm certain using a VPN is 'more' secure. But my question is: Is it still reasonably secure to have a hole in ...
user avatar
  • 181
0 votes
0 answers
132 views

Remote Desktop compromised

So roughly 2 weeks ago my Remote Desktop was compromised whilst I was actively interacting with my server via Rdp I was prompted with a disconnect status equal to “ Another user has connected to ...
user avatar
1 vote
1 answer
2k views

Windows RDP logging into itself?

There is a computer system that has to have RDP on an open port(I fought against this of course). I secured this via RDPGuard which worked phenomenally. Anyway, after a few weeks I check back on those ...
user avatar
  • 11
0 votes
2 answers
704 views

Malware spreading through jump server and SSH data transfer

Can someone explain to me how jump servers mitigate the risk of malware infection please? Whilst I understand some of the benefits of having a jump server as an extra layer of defence i.e. ...
user avatar
  • 13
0 votes
2 answers
601 views

Is it possible for specific event logs to have been deleted?

I'm analyzing several hacked machines on our network. On the original hacked machine, I've found event logs indicating a series of successful RDP connections to other machines, but when I go to those ...
user avatar
  • 180
1 vote
1 answer
150 views

Steps to Harden Ancient Gaming Server

I am somewhat administering an old Windows Server 2008 server that is used to host a older Video Game. It's in such a state that it has tons of custom code on it that run the server and hasn't really ...
user avatar
  • 41
1 vote
1 answer
553 views

Finding the reason behind an RDP Certificate Change (man in the middle attack?)

I've installed some new networking equipment: firewall, switches, vlans, etc. I won't mention the brand name here, because I don't want to cause them harm by my suspicions. Right after doing this, I ...
user avatar
-1 votes
1 answer
246 views

Windows Remote Desktop access modes and security/functionality? [closed]

What are the security implications of running a Windows RDS farm vs. just using RDP for remote administration?
user avatar
  • 33
0 votes
0 answers
155 views

CanRDP right set to computer account?

I was querying a domain and found an interesting ACL that I haven't seen before. One of the DomainComputer accounts has a CanRDP right set to another domain computer. How would this work? The domain ...
user avatar
  • 121
1 vote
1 answer
375 views

Windows server 2016 Remote Desktop username leaked

One of our servers got infected with ransomware last week (Matrix, .Grhan). The server allowed remote desktop connection from outside on the default port, which was a big security hole (and also, the ...
user avatar
  • 133
0 votes
1 answer
176 views

SIEM: Correlating remote logons to associate origin and target user

How is it possible to correlate or detect user logons eg via ssh/rdp to associate the origin user and target user. My use case is to know who actually (personal/identifiable) used a technical account ...
user avatar
1 vote
1 answer
561 views

Metasploit MacOS victim - tools to enable remote desktop / GUI view of the victim

If the exploited victim OS is Windows, metasploit has the getgui command to run RDP. Then he can manipulate the victim OS through the GUI desktop interface. meterpreter > run getgui -u loneferret -...
user avatar
6 votes
1 answer
969 views

I'm hacked without telling anyone my ip [duplicate]

I have a pc with static IP bought from my ISP and RDP enabled. I was using this PC for development and didn't tell or use it for any communication purpose so it's not possible that someone knew about ...
user avatar
3 votes
0 answers
96 views

Is it possible for a remote machine to "escape" from a folder mapped through RDP?

Although most people seem to share entire drives with RDP, it is possible to share individual folders, by mapping them to a drive for example with subst <lettertomap>: <pathtofolder> (for ...
user avatar
  • 260
3 votes
2 answers
187 views

RDP violation without credentials

On a Windows Server 2003 machine seems like someone has logged in through RDP without using credentials: there is a logged access, but there are nor userid nor password. I am wondering how is this ...
user avatar
  • 33
1 vote
1 answer
5k views

Best tool to BruteForcing RDP

I have tried many tools and to do not seem to be successful with locking out an account I am testing on my network with an RDP domain. I used crowbar, ncrack and THC hydra but they don't seem to be ...
user avatar
0 votes
1 answer
4k views

THC Hydra on Windows RDP Domain

I am testing a bruteforce on a windows rdp server within a domain. It seems to not be working because nothing is locking out the account I am targeting. How do you specify a domain username? I tried ...
user avatar
23 votes
2 answers
7k views

What are the risks of remoting in (RDP) to a compromised system? [duplicate]

Can the client be harmed in any way, and how?
user avatar
  • 1,731
-2 votes
2 answers
332 views

Accidently watched content against company policy while connected to work using RDP

I was at home and had some work to be finished so I used IE connected remotely to my work PC finished the job but forgot to disconnect. After a while I started watch not-safe-for-work material in ...
user avatar
  • 121
5 votes
2 answers
300 views

CVE-2018-0886 mitigation for an unpatchable RDP server

An up-to-date Windows 10 client is connecting to a Windows 10 RDP host which is stuck at 1511 (host can't be updated and 1511 is out of support for receiving patches such as the CVE-2018-0886 ...
user avatar
  • 171
5 votes
1 answer
525 views

Can passwords be brute-forced through RDP?

We had a small discussion about a security-related article at work today, and I was a bit surprised about one thing - they claim that some attackers managed to brute-force guess the password of ...
user avatar
  • 998
2 votes
1 answer
174 views

Controlling windows server on Amazon Web Services

Our site is ISO-27001 compliant. As part of the compliance we were advised not to use RDP to connect to the server, but rather to choose a cloud server which provides a web-interface. Our current ...
user avatar
  • 271