completion: Remote Desktop (RDP)- Brute Force Attack


completion: Hello and welcome to my article.


completion: I am Idan and I am a penetration tester / red teamer.


completion: Also, I am Linux & Infrastructure PT Practitioner in ITSafe College.


completion: I am going to talk about how to do RDP Brute Force Attack.


completion: Let me explain what RDP Protocol is.


completion: What is RDP?


completion: Remote Desktop Protocol (RDP) is a proprietary protocol developed by Microsoft which provides a user with a graphical interface to connect to another computer over a network connection. The user employs RDP client software for this purpose, while the other computer must run RDP server software.


completion: For this attack weâ€™ll use a tool called â€ścrowbarâ€ť that gonna help us to brute force the credentials of the target machine.


completion: What is Crowbar?


completion: Crowbar (formally known as Levye) is a brute forcing tool that can be used during penetration tests. It was developed to brute force some protocols in a different manner according to other popular brute forcing tools. As an example, while most brute forcing tools use username and password for SSH brute force, Crowbar uses SSH key(s). This allows for any private keys that have been obtained during penetration tests, to be used to attack other SSH servers.


completion: We can Download the tool right here https://github.com/galkan/crowbar


completion: After Explaining what RDP protocol and Crowbar tool are, letâ€™s begin the attack!


completion: Attack Scenario


completion: I am going to use Kali Linux as an attacker machine and a Windows 10 machine as a target.


completion: First weâ€™ll download the files to our Kali machine and install the requirements:


completion: Do python3 crowbar.py -h and weâ€™ll get all the flags that we can use.


completion: The flags we will use:


completion: -U : USERNAME FILE


completion: -u : USERNAME


completion: -C : PASSWORD FILE


completion: -c : PASSWORD


completion: -b : TARGET SERVICE


completion: â€” server : STATIC TARGET


completion: We can check with nmap/netdiscover if there are live hosts.


completion: Windows 10 IP: 192.168.239.133


completion: Letâ€™s attack Windows 10.


completion: Weâ€™ll run the command:


completion: python3 crowbar.py â€” server IP/32 -b [protocol]-u [username] -C [PassowrdListPath]


completion: We can see that the tool cracked the RDPâ€™s credentials!


completion: Letâ€™s connect to this victim with xfreerdp with this credentials.


completion: We have a successful login!


completion: How to Prevent ourselves from this attack?


completion: There are multiple ways to prevent this attack but Iâ€™ll show you only one way.


completion: We can use Lockout Policy.


completion: Connect into your computer and go to the search bar and type:


completion: â€śLocal Security Policyâ€ť


completion: Go under â€śAccount Policies -> â€śAccount Lockout Policyâ€ť -> Click on â€śAccount lockout threshold.


completion: Put account will lockout after 3 attempts and click apply (I am in Active Directory so its different).


completion: Now after that weâ€™ll do restart to the Windows 10 machine.


completion: As you can see, we cannot get any results!


completion: Hope you find this article useful.


completion: Regards,


completion: Idan Malihi.