Skip to content
Home

xfreerdp: RDP client from Linux

Connect to a Windows host over RDP from the command line.

bash·1 min read··INE Certification

The straightforward way to use RDP credentials once you have them, without needing a Windows box of your own to run mstsc.exe from. It creates an entire GUI session on the target machine.

Connect

xfreerdp /u:<username> /p:<password> /v:<target_ip>:<port>

Gotchas

  • RDP requires a legitimate account and its cleartext password on the target. There’s no equivalent to SMB’s pass-the-hash here.
  • If a target isn’t listening on the default 3389, admins commonly move it to a non-standard port to cut down on drive-by brute-force noise, so a full port sweep is worth doing before assuming RDP isn’t running at all.
  • RDP enumeration: confirm RDP is up and find valid accounts
  • RDP exploitation: brute-force, BlueKeep, enabling RDP post-exploitation
  • Nmap: find RDP on non-standard ports
  • Hydra: brute-forcing RDP credentials