Questions tagged [rdp]
Remote Desktop Protocol, a protocols for accessing Windows applications remotely
130
questions
0
votes
1
answer
29
views
Which is more secure to access a VMware Windows VM : VMware Remote console or RDP+Remote Desktop Gateway
Without knowing more details, I can't suggest to our security guy that we should use RDP along with a Remote Desktop Gateway.
One person says to that VMware Remote Console is more secure than using ...
- 101
1
vote
1
answer
245
views
RDP logout necessary to prevent RDP session hijacking?
We recently got a strengthened security policy where people are required to log out of any RDP connections at the end of the day. So when I turn off my laptop, it is not enough to merely close the RDP ...
- 11
1
vote
1
answer
186
views
Does enabling rdp induces a security risk coming from the internet if no port forwarding/nat is configured?
The question is mainly about the default windows implementation of rdp, but could also apply to xrdp. Enabling rdp is an option in the windows settings (remote desktop).
I would like to use rdp in a ...
- 75
1
vote
1
answer
201
views
RDP Brute Force Attacks
I've discovered my VPS server with RDP access is getting attacked.
Event log shows a bunch of 4625 events.
Now I know for using RDP, this is just the nature of things.
I have changed the RDP port ...
- 13
1
vote
2
answers
2k
views
Is RDP wrapper any more or less secure than the built-in RDP?
I have read several sources indicating that RDP may have some vulnerabilities.
Without delving into that, is RDP wrapper any more or less secure than the built-in RDP, when it is enabled?
I read ...
1
vote
1
answer
198
views
X11 forwarding to another user. How it's possible?
I would like to understand how the following problem is technically possible:
In my company, we have a machine which I and several colleagues connect to. I regularly use x11 forwarding when I connect ...
- 13
5
votes
2
answers
4k
views
How is RDP through VPN safer?
I've read that I shouldn't open RDP ports on my router (obviously with port forwarding, I don't mean opening 3389 port directly). Instead I should use something like VNC (I get that solution) or ...
- 153
1
vote
0
answers
538
views
How to get the list of computers a user can RDP into using BloodHound?
Using bloodhound I would like to find the list of all computers a user I.e "domain\ajohn" can RDP into.
I looked at:
match p=(g:Group)-[:CanRDP]->(c:Computer) where g.objectid ENDS WITH '-...
- 11
0
votes
0
answers
98
views
Bruteforce on RDP [duplicate]
I have an internet-facing RDP server and getting constant brute force attacks trying random usernames and passwords. It's Windows 2016 with remote desktop services enabled. What can I do to stop this ...
- 1
-1
votes
1
answer
220
views
How to protect Windows Remote Desktop Client from untrusted server
We have blocked all direct connections from client computers to the Internet in our firewalls and only allow Internet access via http and https through a Squid proxy.
Now one of my users requests ...
- 891
0
votes
0
answers
370
views
How can I check the validity of a selfsigned xrdp certificate
I am connecting to a fedora xrdp server from the built-in Windows Remote Desktop client.
I have access to the /etc/xrdp/key.pem and to the certificate inspection window on on Windows Remote Desktop
...
- 101
0
votes
0
answers
76
views
Firewall IP-Filtered Pinhole Risks
To facilitate consulting work, a client has suggested that they allow me to connect directly to an in-house remote desktop server, via a firewall pinhole which allows connection from my IP address ...
- 101
1
vote
1
answer
181
views
RDP to a Virtual Machine. Where should I apply the security measures? [closed]
I have a computer with Hyper-V installed and a virtual machine. I want to connect only and directly to the VM with Remote-Desktop from outside the network.
I have some good ideas to make the ...
0
votes
1
answer
155
views
RDP security review over private VPN
I know Remote Desktop Protocol can be incredibly insecure if handled wrong. Knowing no system is 100% safe, are there any easy to exploit vulnerabilities in the described system below;
ZeroTier VPN:
...
0
votes
0
answers
579
views
Disabled MD5 and enabled SHA under SCHANNEL/Hashes in registry. xfreerdp fails with an ssl i/o error
So delving into securing server and not quite understanding how I broke the ability to rdp into my server (using xfreerdp). I disabled MD5 as an available hash and enabled SHA. The exact changes in ...
- 212
1
vote
1
answer
253
views
How do I get my server HSM working while connected via RDP? (Win 2019)
The error I get from pkcs11-tool.exe is "No slots."
My server has a hardware security module (Nitrokey HSM 2) that becomes inaccessible once I connect to my server via Windows Remote Desktop....
- 403
1
vote
2
answers
615
views
Multiple Established TCP Connections on Port 3389 - Is my server compromised?
If i run
netstat -an
on my Windows Server 2019 it shows multiple connections on Port 3389 (which is RDP)
The first IP Adress is mine, however i cant explain the other two connections. They both ...
- 41
1
vote
1
answer
882
views
Are Credentials used in RDP cached on Client?
When I enter my domain admin user credentials into the RDP Window, does the Client also save my password hash?
Example:
Windows 10 Client -> Remote Desktop -> Enter Domain Admin User and ...
- 11
-1
votes
1
answer
115
views
How can you attack or redirect the client from the server over an RDP or SSH conneciton? [closed]
I have a penetration testing scenario where I am on the network with two machines, Machine A and Machine B. I have complete control over Machine B and am trying to leverage that to get access to ...
0
votes
0
answers
134
views
How to secure remote desktop?
How to secure RDP connection to prevent the spread of ransomware from users' systems when they connect to corporate systems through remote desktop?
1
vote
2
answers
1k
views
Does VNC need hardening when inside LAN (home network)?
This is a very newbie question, but I would just like to make sure that I'm not missing anything: If I connect via VNC protocol to my various servers etc. inside my own LAN (home network), then should ...
- 21
-2
votes
1
answer
1k
views
Does using a VPS hides the client identity in the web?
I know that a VPS provider can track the client connected to a VPS (This Q/A) using RDP(Remote desktop protocol). But my question is about websites accessed from the VPS using a browser. Can they know ...
- 117
0
votes
0
answers
83
views
How to prevent configuration of Public IP on an interface
I have recently identified a security risk with some of the machines (primarily Windows 10 and MacOS laptops) my company issues to users. Specifically, a small subset of the users are regularly ...
- 1
0
votes
1
answer
218
views
Connecting to server with Proxy vs VPN
Suppose I have a server and no-one can hack into my local area network. I want to Remote Desktop into my server from Internet. Exposing RDP is the most foolish thing I did do once and the server was ...
- 105
4
votes
2
answers
3k
views
Remmina RDP Certificate Fingerprint Changed
I've been using Remmina to connect to my RDP server across the internet. When I first connected to the server, I had to accept the certificate. I have not had to do that since the first time I ...
- 41
0
votes
2
answers
5k
views
RDP Authentication with domain credentials
There's something I don't get with RDP in a domain. During an authentication, if we're using a local account of the distant machine, then the creds are in the SAM so all good.
But with a domain ...
- 3
1
vote
2
answers
658
views
RDP - access security
I have a question about protecting myself against attacks on the RDP service.
I note that I have already done the appropriate configuration:
I am using a local user (not administrator) to connect
...
- 11
0
votes
0
answers
37
views
How is it possible for people to reverse a GoToAssist session? [duplicate]
I am puzzled by how people on Youtube bait scammers into connecting to their machines and end up "reversing" the connection on them. Essentially controlling the scammer's PC.
Is this done via reverse ...
- 275
1
vote
0
answers
135
views
Reasonable security for RDP over VPN
An organisation I work with requires that employees be able to connect to machines on their network and log on to them from machines that are not on the network and not joined to the domain.
They ...
- 111
0
votes
0
answers
2k
views
Is RDP user enumeration possible?
There are many pre-made tools around for brute-forcing RDP credentials, but I haven't found one for username enumeration. Is it possible by design to enumerate potential RDP logins? If not within the ...
- 992
0
votes
0
answers
473
views
RDP with self-signed cert requiring password before launching display
I've noticed that the search engine Shodan grabs screenshots from hosts running an RDP service, even if they offer a certificate.
To my understanding, the certificate is used to authentify the server,...
- 111
2
votes
3
answers
5k
views
Can a website detect remote operation of a computer?
I was wondering if a website I am visiting can detect whether or not the computer that is being used is being operated remotely.
For example...
I have two desktops. I use Desktop 1 to remotely ...
- 23
0
votes
2
answers
2k
views
Whonix with Remmina to Connect on RDP - Is it safe?
I do not want my ISP logging any of my data, and do not trust my VPN either. Is it a safe measure to use Whonix in a VirtualBox, connecting over VPN, then using remmina to connect to an RDP? My goal ...
1
vote
0
answers
124
views
Abusing RDP/SSH post exploitation [closed]
I'm curious to how an attacker would enable RDP/SSH and use it to gain further access to the compromised windows server after achieving remote command/code execution on the server. (Using cmd.exe)
- 11
1
vote
1
answer
132
views
RDP to Azure VMs through public IP versus VPN
I have two options for remoting into our Azure VMs: RDP to public IP or RDP through VPN.
I'm certain using a VPN is 'more' secure. But my question is: Is it still reasonably secure to have a hole in ...
- 181
0
votes
0
answers
142
views
Remote Desktop compromised
So roughly 2 weeks ago my Remote Desktop was compromised whilst I was actively interacting with my server via Rdp I was prompted with a disconnect status equal to “ Another user has connected to ...
1
vote
1
answer
2k
views
Windows RDP logging into itself?
There is a computer system that has to have RDP on an open port(I fought against this of course). I secured this via RDPGuard which worked phenomenally. Anyway, after a few weeks I check back on those ...
- 11
0
votes
2
answers
943
views
Malware spreading through jump server and SSH data transfer
Can someone explain to me how jump servers mitigate the risk of malware infection please?
Whilst I understand some of the benefits of having a jump server as an extra layer of defence i.e. ...
- 13
0
votes
2
answers
852
views
Is it possible for specific event logs to have been deleted?
I'm analyzing several hacked machines on our network. On the original hacked machine, I've found event logs indicating a series of successful RDP connections to other machines, but when I go to those ...
- 170
1
vote
1
answer
158
views
Steps to Harden Ancient Gaming Server
I am somewhat administering an old Windows Server 2008 server that is used to host a older Video Game.
It's in such a state that it has tons of custom code on it that run the server and hasn't really ...
- 41
1
vote
1
answer
675
views
Finding the reason behind an RDP Certificate Change (man in the middle attack?)
I've installed some new networking equipment: firewall, switches, vlans, etc. I won't mention the brand name here, because I don't want to cause them harm by my suspicions.
Right after doing this, I ...
- 117
-1
votes
1
answer
272
views
Windows Remote Desktop access modes and security/functionality? [closed]
What are the security implications of running a Windows RDS farm vs. just using RDP for remote administration?
- 33
0
votes
0
answers
230
views
CanRDP right set to computer account?
I was querying a domain and found an interesting ACL that I haven't seen before.
One of the DomainComputer accounts has a CanRDP right set to another domain computer. How would this work? The domain ...
- 121
1
vote
1
answer
425
views
Windows server 2016 Remote Desktop username leaked
One of our servers got infected with ransomware last week (Matrix, .Grhan). The server allowed remote desktop connection from outside on the default port, which was a big security hole (and also, the ...
- 133
0
votes
1
answer
208
views
SIEM: Correlating remote logons to associate origin and target user
How is it possible to correlate or detect user logons eg via ssh/rdp to associate the origin user and target user.
My use case is to know who actually (personal/identifiable) used a technical account ...
- 101
1
vote
1
answer
729
views
Metasploit MacOS victim - tools to enable remote desktop / GUI view of the victim
If the exploited victim OS is Windows, metasploit has the getgui command to run RDP. Then he can manipulate the victim OS through the GUI desktop interface.
meterpreter > run getgui -u loneferret -...
- 73
6
votes
1
answer
985
views
I'm hacked without telling anyone my ip [duplicate]
I have a pc with static IP bought from my ISP and RDP enabled.
I was using this PC for development and didn't tell or use it for any communication purpose so it's not possible that someone knew about ...
- 171
3
votes
0
answers
109
views
Is it possible for a remote machine to "escape" from a folder mapped through RDP?
Although most people seem to share entire drives with RDP, it is possible to share individual folders, by mapping them to a drive for example with subst <lettertomap>: <pathtofolder> (for ...
- 260
3
votes
2
answers
205
views
RDP violation without credentials
On a Windows Server 2003 machine seems like someone has logged in through RDP without using credentials: there is a logged access, but there are nor userid nor password.
I am wondering how is this ...
- 33
1
vote
1
answer
6k
views
Best tool to BruteForcing RDP
I have tried many tools and to do not seem to be successful with locking out an account I am testing on my network with an RDP domain. I used crowbar, ncrack and THC hydra but they don't seem to be ...
- 325