Lateral Movement: Enabling RDP Remotely

This article walks through multiple real-world techniques to remotely enable RDP on a Windows Server 2019 Domain Controller (DC.ignite.local) and demonstrates connecting to it from Kali Linux using rdesktop, xfreerdp3, and Remmina. It covers seven exploitation methods — NetExec, Pass-the-Hash wmiexec, Impacket utilities, Evil-WinRM, Samba net rpc, and a Metasploit post module — and provides targeted mitigation and detection guidance. #DCignite_local #NetExec

Keypoints

Seven distinct techniques are demonstrated to enable RDP on a Windows Server 2019 Domain Controller using SMB, WMI, WinRM, and RPC.
Tools and approaches include NetExec (with PtH/wmiexec), Impacket-reg/psexec, Evil-WinRM PowerShell, Samba net rpc, and a Metasploit post module.
After enabling RDP, the article shows connections via rdesktop, xfreerdp3 (with Pass-the-Hash), and the Remmina GUI client.
Recommended mitigations include LAPS, NTLM restrictions, SMB/WMI/WinRM hardening, RDP network limits, EDR, and zero-trust segmentation.
Detection guidance highlights monitoring fDenyTSConnections registry changes and related Windows Event IDs for remote execution and service creation.