rdesktop — RDP Client (Legacy)
Ctrl+F:
rdesktop· RDP · port 3389 · user enum · valid user ·-u· login error
rdesktop is an open-source RDP client for Linux. Connect to Windows port 3389 for a full desktop session — useful when you have creds and need GUI (not just WinRM).
Modern Kali: xfreerdp / xfreerdp3 is the current default — more flags, PTH, cert handling. rdesktop still appears in labs and older notes; syntax is simpler.
→ Remote Access · UseCases for ports > Port 3389 — RDP
Install (Kali)
sudo apt update && sudo apt install -y rdesktop
which rdesktop
rdesktop --versionAlso bundled on some images via freerdp2-x11 / xfreerdp — install separately if needed.
Syntax
rdesktop [options] SERVER[:PORT]📌 Basic connection
# IP only — prompts for username/password in GUI
rdesktop 192.168.234.165
# With credentials on command line
rdesktop -u Administrator -p Password1 192.168.234.165
# Domain account
rdesktop -d CORP -u jsmith -p Password1 192.168.234.165
# Non-standard port
rdesktop -u admin -p pass 192.168.234.165:3390📌 Username / valid-user enumeration
RDP login often returns different errors for valid vs invalid usernames (especially older Windows and non-NLA targets). Use rdesktop to probe a wordlist when you have no LDAP/Kerberos enum yet.
NLA enabled: Network Level Authentication may block the login screen until creds are validated — user enum via GUI errors is harder. Try Kerbrute, rpcclient, or ldapsearch instead.
How it works
| Result | Typical GUI / behavior |
|---|---|
| Valid user, wrong password | ”The password is incorrect” · “Logon failure: unknown user name or bad password” |
| Invalid user | ”The user name or password is incorrect” (generic) · no account-specific hint |
| Valid user, no RDP rights | ”The user has not been granted the requested logon type” / “not allowed to log on remotely” |
| Valid user, account locked | ”The referenced account is currently locked out” |
| Valid user, must change password | Prompt to change password at logon (password was correct or policy forces change) |
Valid user + wrong password confirms the account exists — add to users.txt for spray / Kerberoast / Hydra.
Manual — GUI login screen
# Opens RDP window — type each username, use any wrong password, read the error
rdesktop 192.168.234.165Try common names first:
Administrator
administrator
admin
guest
backup
user
Domain account — include domain in GUI or use -d:
rdesktop -d CORP.LOCAL -u jsmith -p WrongPass123! 192.168.234.165
rdesktop -d CORP -u 'CORP\jsmith' -p WrongPass123! 192.168.234.165Manual — CLI one user at a time
# Wrong password on purpose — watch the popup error text
rdesktop -u Administrator -p 'WrongPass123!' 192.168.234.165
rdesktop -u john.doe -p 'WrongPass123!' 192.168.234.165
rdesktop -u guest -p 'WrongPass123!' 192.168.234.165Close the session after each attempt (Ctrl+Alt+Enter then close window, or kill the client).
Loop over a wordlist
# users.txt — one username per line
while read -r user; do
echo "[*] Trying: $user"
timeout 8 rdesktop -u "$user" -p 'WrongPass123!' 192.168.234.165 2>/dev/null &
sleep 4
pkill -x rdesktop 2>/dev/null
done < users.txtLog hits manually from the GUI, or note which names get password incorrect vs generic failure.
# Quick inline list (no file)
for user in Administrator admin guest backup svc_admin; do
echo "[*] $user"
rdesktop -u "$user" -p 'x' 192.168.234.165
doneAfter you find valid users
Valid RDP users confirmed
→ password spray (low threads): [[Hydra]] · crowbar · [[CrackMapExec - nxc]] rdp
→ AD domain? Prefer [[Kerbrute]] userenum + AS-REP / Kerberoast (no lockout on userenum)
→ Retry RDP with cracked / sprayed password
# Spray one password against known users (careful — lockouts)
hydra -L valid_users.txt -p 'Password1' 192.168.234.165 rdp -t 1 -f
crowbar -b rdp -s 192.168.234.165/32 -U valid_users.txt -c 'Password1' -n 1→ Kerbrute · xfreerdp > 📌 9) Brute Force RDP Credentials · UseCases for ports > Port 3389 — RDP
📌 Common flags
| Flag | Description |
|---|---|
-u USER | Username |
-p PASS | Password (avoid on shared history — use prompt) |
-d DOMAIN | Windows domain |
-g WxH | Desktop geometry — e.g. -g 1024x768 |
-f | Full screen |
-a DEPTH | Color depth (8, 15, 16, 24, 32) |
-r clipboard:PRIMARYCLIPBOARD | Share clipboard (copy/paste) |
-r disk:NAME=/local/path | Share local folder as \\tsclient\NAME |
-x l | Experience level — l = LAN (best quality) |
-P | Persistent bitmap caching |
-z | Enable compression |
-0 | Attach to console session (admin) |
-V | Verify server identity (cert) — labs often skip |
Clipboard & file share
rdesktop -u admin -p Password1 -r clipboard:PRIMARYCLIPBOARD -r disk:share=/tmp/share 192.168.234.165
# In Windows: \\tsclient\share📌 Verify RDP is open
nc -nv 192.168.234.165 3389
nmap -p 3389 -sV 192.168.234.165📌 rdesktop vs xfreerdp
| rdesktop | xfreerdp | |
|---|---|---|
| Syntax | rdesktop -u user -p pass IP | xfreerdp3 /u:user /p:pass /v:IP /cert:ignore |
| Cert errors | Often manual / older behavior | /cert:ignore |
| Pass-the-Hash | Limited / not standard | /pth:NTHASH |
| OSCP default today | Legacy / simple labs | Preferred |
# Same box — xfreerdp equivalent
xfreerdp3 /u:Administrator /p:'Password1' /v:192.168.234.165 /cert:ignore /workarea +clipboard📌 Through tunnel / port forward
# After SSH -L 3389:TARGET:3389 ...
rdesktop -u admin -p Password1 127.0.0.1→ SSH Tunneling · Port Forwarding
📌 Troubleshooting
| Problem | Fix |
|---|---|
| Connection refused | nc -nv IP 3389 — RDP off or filtered |
| Login failed | Check user/domain; try evil-winrm for shell-only |
| Cert / trust prompt | Accept in GUI or use xfreerdp /cert:ignore |
| Black screen | Try -a 16 or -g 1024x768 |
📌 Quick cheat sheet
rdesktop 192.168.234.165
rdesktop -u Administrator -p 'WrongPass123!' 192.168.234.165 # user enum — read error text
rdesktop -u Administrator -p 'Password1' 192.168.234.165
rdesktop -d CORP -u user -p pass -g 1280x720 -r clipboard:PRIMARYCLIPBOARD 192.168.234.165
nc -nv 192.168.234.165 3389