[MUSIC PLAYING]
Exploiting RDP.
Now that we've taken a look at how
to exploit some of the most frequently exploited
Windows services like IaaS and WebDAV as well as SMB,
we can now turn our attention to the RDP protocol.
However, before we actually get started
with taking a look at how we can attack or exploit the protocol,
let's get an understanding of what it is and how it works.
So RDP stands for the Remote Desktop Protocol.
It is a proprietary graphical user interface remote access
protocol that is developed or was developed by Microsoft
and is used to remotely connect and interact with a Windows
system.
RDP uses TCP port 3389 default. However, it can also
be configured to run on any other TCP port,
and that's something that you want to be acutely aware of.
The reason for this is because exploiting the RDP protocol
is relatively straightforward.
The typical attack would essentially
involve performing a brute force against the protocol
in order to identify a user accounts
and their respective passwords.
And for that reasons, many system administrators
have actually been switching the default
or have been using another port for the RDP protocol,
and they've been switching it around.
So as a penetration tester or as an attacker,
you must be aware of this.
And when performing your port scanning and enumeration,
you should be extremely comprehensive
because RDP could be running on another port, not just
the default port, which is 3389.
All right, so in terms of RDP authentication,
RDP authentication essentially requires a legitimate user
account on the Windows target as well as the user's password
in cleartext.
So this is something that's very, very important.
In order to remotely authenticate with RDP
on the target system, you need to have a user account,
username, and password on that system in order to gain access.
And the first attack that we'll be
taking a look at in this video is the process
of performing in RDP brute-force attack
in order to identify legitimate user credentials that we
can use to gain remote access to the target system.
Now, most of you should be familiar with RDP.
It's a very, very simple protocol
in regards to how it works.
You essentially utilize an RDP client
whether you're on Windows or on Linux,
and you connect to the target via the specified RDP
port or any other port.
And once you essentially initiate the connection,
you'll essentially be provided with a graphical user interface
of the target system, so a standard Windows desktop,
after which you will be required to authenticate with a username
and password.
So again, we can always connect to RDP.
However, we'll need legitimate credentials
in order to essentially authenticate and gain access
to the target system.
And similarly to the RDP exploitation videos,
we are going to be limiting our attack
scope to the administrator account
as the administrator account has the highest privileges,
and gaining access to the administrator's account
is pretty much what we're looking
for because we don't have to go through the process
of elevating our privileges.
So now that we have an understanding of what RDP is
and the exploitation technique that we'll
be exploring in this video, we can get started
with the lab environment.
So all you need to do is just fire up your lab environment,
and you can follow along with the techniques
that I'll be highlighting.
So I'll be seeing you in the lab environment.
All right, so I'm back within the lab environment.
And as you can see, you will be provided with the target IP
address.
And in your case, it's going to be different.
All you need to do is just copy it because, of course, we'll
be needing it in a few seconds.
So the first step, like any penetration test,
will essentially involve performing
a port scan on the target to identify what
ports and services are running.
And we can do this by saying Nmap,
and we can say we want to perform service version
detection, maybe even operating system detection if we want to.
And of course, if you've learned about how to use Nmap,
we can also use a SYN scan or a ping-only scan
and essentially to be stealthy if we want to.
And in this case, I'm just going to perform a service version
detection scan.
I would recommend scanning all the ports on the target.
And in this case, you will see why I'm saying that.
However, in this case, I'll just say sV,
and I'll paste in the target IP, and I'll hit Enter.
So I'm going to give this a couple of seconds
to a couple of minutes to complete.
All right, so the Nmap scan is complete.
And as you can see, we have the services
that you would typically associate with a Windows
system.
We have RPC.
We have NetBIOS.
We have SMB, and that tells us that it's either
running Windows Server 2008 or Windows Server 2012.
And of course, if we had performed
operating system detection, we might
have got a more solid prediction as to what
operating system or what version of Windows
is running on the target.
However, we don't see any port 3389 open.
We do see that we have port 3333 open,
but it doesn't tell us what service that is.
And this is primarily because, again, this particular port
is not really assigned to any service, and in this case,
this is what I wanted to highlight in this video,
and that, of course, is the fact that RDP
can be configured to run on another port instead
of the default port.
And in this case, this particular port is running RDP.
But if you were performing a Black box penetration
test, how would you be able to verify this,
or how can you actually check a port
and determine whether or not it's running RDP?
Well, one of the techniques is to actually connect
to the target system and specify this particular port as the RDP
port, and in that case, you'd be able to verify really quickly.
But another really helpful tool or module
is the Metasploit module RDP scanner.
So we're just going to use it here.
So I'll just open up a new tab, and I'll
start up the PostgreSQL database,
so service postgresql start and msfconsole like so.
And we'll give this a couple of seconds to start up.
So MSF console is started up.
And we can search for the module by saying search RDP_scanner,
and you can see it's an auxiliary module here.
This will essentially identify endpoints speaking
the remote desktop protocol.
What that means is that it will essentially
tell you whether that particular port is indeed running RDP.
So we can just copy the actual module name here.
I'm going to say use.
Paste that in there.
And we can then show the options for this particular module.
And you can see the options we need to specify here
are going to be the target IP, as well as the target port.
And in this case, we want to change the RPORT option
to 3333 instead of the default RDP port.
So we'll start off with the target IP.
I'm just going to copy it from this little document
here or that text file.
So I'll say set RHOSTS, paste that in there,
and then set our RPORT to 3333.
And of course, in your case, if it's
configured on a different port, make
sure to accurately change the RPORT value
to match that particular port.
You can also set the RDP client name and the or rather the RDP
client IP and the RDP client name,
but that really is not required in this instance.
So we'll just hit Run.
And you can see it's going to tell you right over here
detected RDP on that particular port,
and it tells us the actual version of the Build version.
In this case, it doesn't tell us the exact version of Windows
that's running, but it tells us the build
version, which is 9600 here.
So we know that RDP is running on the target
however we really can't authenticate with the target
system via RDP because we don't have any credentials.
Well, how would we obtain these credentials?
Well, the technique that I'm going to be covering
is the process of performing a brute force on RDP.
And the tool we can use to do this is hydra.
And of course, you can now start to see
why hydra is so powerful because we can essentially
perform a brute force on multiple protocols,
not just SSH, FTP, or SMB, for that matter.
So we can say hydra.
And because we don't know the username or the password,
we'll need to specify a wordlist or essentially
a list that contains users.
In this case, we'll say user.
The wordlist will be using for the usernames is under user,
share, Metasploit framework, data, wordlists,
and we are going to be utilizing the common_users.txt list.
We then need to specify the password list.
In this case, we're just going to use the same directory.
So that's under usher, share, Metasploit framework, data,
wordlists, and in this case, we will be using
unix_passwords.txt.
We then need to specify the protocol.
In this case, it's RDP and the target IP address.
And of course, remember, if we just hit Enter at this point,
hydra will automatically assume that you
want to connect to the default RDP port, which is 3389.
In this case, we need to specify the port, which
can be done by specifying the hyphens option and then
the port 3333.
And we can then hit Enter.
Now, of course, in your case or during a penetration test,
you want to be very cognizant of the brute force speed
because you can essentially, or you can really
cause a denial of service on that particular RDP service
and cause it to go down, or you could crash the Windows system,
and of course, that is something that will be noticed.
So you also have the ability to reduce the brute force
speed with hydra.
So, for example, let me just exit out of MSF console here.
If I say hydra and hit Enter, you
have the ability to limit the amount of tasks.
So you can use the task option.
The default option is set to 16, so you
can reduce that to two or three depending on your requirements.
In this case, we'll just use the default configuration,
which is 16.
We can then hit Enter, and it's going to begin the brute force.
And we already are able to identify a user account called
sysadmin, and their password, in this case, is Samantha.
So I'm just going to wait for this to complete.
Hopefully, we'll be able to identify an administrator
account and the password.
So I'll just give this a couple of minutes.
All right, so it looks like I've been
able to identify the administrator
account and the password, which is qwertyuiop,
as we had already experienced during the SMB exploitation
lab.
So the brute force is complete.
Now don't worry if you get this error telling you
that freerdp, the connection failed to establish.
The reason this is happening is because hydra,
after finding legitimate credentials,
will try and connect to the target via RDP
with the credentials it was able to identify,
and the default RDP client that it uses is freerdp.
Unfortunately, this lab doesn't support free RDP.
The only RDP client we can use is
xfreerdp, which will be taking a look at how to use in a second.
So now that we've identified the credentials,
we can essentially authenticate with the target via RDP,
and we can specify the credentials.
So we'll be using xfreerdp.
So to use xfreerdp, we essentially just say xfreerdp,
and then we specify the username,
which can be done by specifying the forwardslash then
the parameter that you want to pass.
In this case, the username is going to be administrator.
And we then specify the password.
So the same thing goes for password.
And the password, in this case, is qwertyuiop.
We then need to specify the target IP address,
which is done by saying /v, and then we can paste in the target
IP.
So I'm just going to copy that there.
There we go.
And I can paste that in there.
And remember, we still need to specify the actual RDP port
on the target because, in this case,
xfreerdp will assume that you want to connect to the default
RDP port so we can use.
We can use a colon there, and we can say 3333, and we hit Enter.
So it's going to ask us whether we trust the certificate.
I'm going to hit Yes.
And it's going to open up an RDP session right over here.
And we now have access to the target system via RDP.
And you can see this is the complete Windows desktop
experience, and we're currently logged in as the administrator
user right over here.
So we've pretty much gained access to the target system.
And we can do whatever we like.
Now, you can also authenticate with the target system
through the use of any of the other user accounts
that we were able to identify through the brute force
with hydra.
So we can log in as the auditor, as the sysadmin et
cetera, et cetera.
All you have to do is just substitute the actual username
option here and the password option.
And of course, in your case, you can also utilize other RDP
clients like Romania.
All right, so that is going to conclude
the practical demonstration side of this video.
In the next video, we will be exploring
the process of exploiting an inherent vulnerability
within the RDP protocol on Windows,
and the name of this vulnerability
is called bluekeep.
So I'll see you in the next video.