• Remote Management Overview
• Linux Remote Protocols
• Windows Remote Protocols

​

Agent Instructions

​

Querying This Documentation

GET https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/remote-management.md?ask=<question>

​

Remote Management Overview

​

Overview

​

Categories of Remote Management

​

Linux Remote Management

• SSH (Secure Shell) - Encrypted terminal access and file transfer
• Rsync - Efficient file synchronization and backup
• R-Services - Legacy remote access protocols (insecure)

​

Windows Remote Management

• RDP (Remote Desktop Protocol) - Graphical remote desktop access
• WinRM (Windows Remote Management) - Command-line remote management
• WMI (Windows Management Instrumentation) - System monitoring and configuration

​

Security Considerations

​

Common Security Issues

1. Authentication Weaknesses: Default credentials, weak passwords
2. Network Exposure: Services accessible from untrusted networks
3. Encryption Issues: Unencrypted or weakly encrypted communications
4. Configuration Problems: Overly permissive access controls
5. Legacy Protocols: Use of inherently insecure protocols

​

Assessment Methodology

1. Service Discovery: Identify running remote management services
2. Version Detection: Determine software versions and configurations
3. Authentication Testing: Test for weak or default credentials
4. Vulnerability Assessment: Check for known security issues
5. Access Control Review: Evaluate permissions and restrictions

​

Enumeration Approach

​

Standard Enumeration Steps

1. Port Scanning: Identify open ports associated with remote management
2. Service Detection: Determine specific services and versions
3. Banner Grabbing: Collect service banners and information
4. Authentication Testing: Attempt various authentication methods
5. Configuration Analysis: Review service configurations
6. Vulnerability Scanning: Check for known vulnerabilities

​

Common Ports and Services

​

Tools and Techniques

​

General Tools

• Nmap: Network scanning and service detection
• Hydra: Authentication brute forcing
• Metasploit: Vulnerability exploitation framework
• Crackmapexec: Network authentication testing

​

Protocol-Specific Tools

• SSH: ssh, scp, sftp, ssh-keygen
• RDP: mstsc, rdesktop, xfreerdp
• WinRM: evil-winrm, winrs, PowerShell
• WMI: wmic, PowerShell WMI cmdlets
• Rsync: rsync client

​

Best Practices

​

Security Recommendations

1. Use Secure Protocols: Prefer encrypted protocols over plaintext
2. Strong Authentication: Implement multi-factor authentication
3. Network Segmentation: Isolate management traffic
4. Regular Updates: Keep software and systems updated
5. Access Control: Implement least privilege principles
6. Monitoring: Log and monitor remote access activities

​

Configuration Guidelines

1. Change Default Settings: Modify default ports and configurations
2. Disable Unused Services: Turn off unnecessary remote management services
3. Configure Firewalls: Restrict access to trusted networks
4. Use VPNs: Require VPN access for remote management
5. Regular Audits: Periodically review configurations and access

​

Related Documentation

• Linux Remote Protocols: SSH, Rsync, R-Services
• Windows Remote Protocols: RDP, WinRM, WMI

​

Common Attack Vectors

​

Authentication Attacks

• Brute Force: Password guessing attacks
• Credential Stuffing: Using leaked credentials
• Default Credentials: Exploiting unchanged default passwords
• Pass-the-Hash: Using captured password hashes

​

Network Attacks

• Man-in-the-Middle: Intercepting unencrypted communications
• Protocol Downgrade: Forcing use of weaker protocols
• Certificate Spoofing: Impersonating legitimate services
• Session Hijacking: Taking over authenticated sessions

​

System Exploitation

• Privilege Escalation: Gaining higher access levels
• Lateral Movement: Moving between systems
• Persistence: Maintaining access after initial compromise
• Data Exfiltration: Stealing sensitive information

​

Defensive Measures

​

Detection and Monitoring

• Log Analysis: Review authentication and access logs
• Network Monitoring: Monitor for unusual traffic patterns
• Intrusion Detection: Deploy IDS/IPS systems
• Behavioral Analysis: Detect anomalous user behavior

​

Response Procedures

• Incident Response: Established procedures for security incidents
• Access Revocation: Ability to quickly disable compromised accounts
• System Isolation: Procedures to isolate affected systems
• Recovery Planning: Steps to restore normal operations

​

Compliance and Standards

​

Security Frameworks

• NIST: National Institute of Standards and Technology guidelines
• ISO 27001: Information Security Management System
• CIS Controls: Center for Internet Security recommendations
• OWASP: Open Web Application Security Project guidelines

​

Regulatory Requirements

• GDPR: General Data Protection Regulation
• HIPAA: Health Insurance Portability and Accountability Act
• PCI DSS: Payment Card Industry Data Security Standard
• SOX: Sarbanes-Oxley Act

​

Conclusion

1. Risk Assessment: Regular evaluation of remote management risks
2. Security Controls: Implementation of appropriate security measures
3. Monitoring: Continuous monitoring of remote access activities
4. Incident Response: Prepared response procedures for security events
5. Training: Regular security awareness training for administrators

​

Agent Instructions

​

Querying This Documentation

GET https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/remote-management/remote-management.md?ask=<question>

​

Linux Remote Protocols

​

Overview

​

SSH (Secure Shell)

​

Overview

• Port 22: Default SSH port
• Authentication: Public key, password, or certificate-based
• Encryption: AES, 3DES, ChaCha20-Poly1305
• Integrity: HMAC-SHA256, HMAC-SHA1
• Key Exchange: Diffie-Hellman, ECDH

​

SSH Features

• Secure Remote Access: Encrypted terminal sessions
• File Transfer: SCP and SFTP protocols
• Port Forwarding: Local and remote port forwarding
• Tunneling: Secure tunneling of other protocols
• X11 Forwarding: Remote GUI application access

​

SSH Authentication Methods

# Password authentication
ssh username@hostname

# Public key authentication
ssh -i private_key username@hostname

# Certificate-based authentication
ssh -i certificate username@hostname

​

SSH Configuration

# Client configuration (/etc/ssh/ssh_config)
Host *
    ServerAliveInterval 60
    ServerAliveCountMax 3
    PasswordAuthentication no
    PubkeyAuthentication yes

# Server configuration (/etc/ssh/sshd_config)
Port 22
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AllowUsers normaluser

​

SSH Enumeration

# Banner grabbing
nc target 22
telnet target 22
nmap -p22 --script ssh-brute target

# SSH version detection
ssh -V
nmap -p22 --script ssh-hostkey target

# SSH algorithm enumeration
nmap -p22 --script ssh2-enum-algos target

​

SSH Security Issues

1. Weak Authentication: Default or weak passwords
2. Key Management: Unprotected private keys
3. Configuration: Insecure SSH daemon settings
4. Brute Force: Password guessing attacks
5. Version Vulnerabilities: Outdated SSH versions

​

Rsync

​

Overview

• Port 873: Default rsync daemon port
• Protocol: Custom rsync protocol over TCP
• Efficiency: Delta-sync algorithm (only transfers changes)
• Authentication: Module-based access control
• Encryption: Can tunnel through SSH

​

Rsync Modes

​

Rsync Configuration

# Rsync daemon configuration (/etc/rsyncd.conf)
uid = nobody
gid = nobody
use chroot = yes
max connections = 10
log file = /var/log/rsyncd.log
pid file = /var/run/rsyncd.pid
lock file = /var/run/rsync.lock

[backup]
    path = /backup
    comment = Backup files
    read only = false
    hosts allow = 192.168.1.0/24

​

Rsync Enumeration

# Check if rsync daemon is running
nmap -p873 target

# List available modules
rsync target::
rsync rsync://target/

# Enumerate module contents
rsync target::module_name/
rsync rsync://target/module_name/

# Download files
rsync -av target::module_name/file ./

​

Rsync Security Issues

1. Anonymous Access: Unauthenticated access to shares
2. Information Disclosure: Directory listings and file access
3. Data Exfiltration: Ability to download sensitive files
4. Configuration: Overly permissive access controls
5. Network Exposure: Rsync accessible from untrusted networks

​

R-Services (RSH, RCP, RLOGIN)

​

Overview

​

R-Service Components

​

R-Service Authentication

• .rhosts: Per-user access control
• /etc/hosts.equiv: System-wide access control
• Trusted hosts: IP-based authentication

​

R-Service Configuration Files

# /etc/hosts.equiv (system-wide)
trusted_host
+trusted_user
-untrusted_user

# ~/.rhosts (per-user)
trusted_host trusted_user
+ +

​

R-Service Enumeration

# Check for R-Services
nmap -p513,514 target

# Banner grabbing
nc target 513
nc target 514

# RSH access attempt
rsh target command
rsh target -l username command

# RLOGIN access attempt
rlogin target
rlogin target -l username

​

R-Service Security Issues

1. No Encryption: All communication in plain text
2. Weak Authentication: Host-based authentication only
3. Information Disclosure: Verbose error messages
4. Privilege Escalation: Potential for root access
5. Network Sniffing: Credentials transmitted in clear text

​

Advanced Enumeration Techniques

​

SSH Advanced Enumeration

# SSH user enumeration
nmap -p22 --script ssh-enum-users target

# SSH host key fingerprinting
ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key.pub

# SSH configuration analysis
ssh -T -o StrictHostKeyChecking=no target

# SSH tunneling detection
netstat -tlnp | grep :22

​

SSH Brute Force

# Hydra SSH brute force
hydra -l username -P passwords.txt ssh://target

# Patator SSH brute force
patator ssh_login host=target user=username password=FILE0 0=passwords.txt

# Custom SSH brute force
#!/bin/bash
for pass in $(cat passwords.txt); do
    sshpass -p $pass ssh username@target "echo success" 2>/dev/null && echo "Password found: $pass"
done

​

Rsync Advanced Enumeration

# Comprehensive rsync enumeration
rsync --list-only target::
rsync --list-only rsync://target/

# Recursive directory listing
rsync -r --list-only target::module/

# Test write permissions
echo "test" | rsync --partial - target::module/test.txt

​

R-Service Exploitation

# RSH command execution
rsh target "id; whoami; uname -a"

# RCP file transfer
rcp localfile target:remotefile
rcp target:remotefile localfile

# RLOGIN session
rlogin target
# If successful, you get a shell

​

Practical Examples

​

HTB Academy Style SSH Enumeration

# Step 1: Service detection
nmap -p22 -sV -sC target

# Step 2: SSH version and algorithms
nmap -p22 --script ssh-hostkey,ssh2-enum-algos target

# Step 3: User enumeration (if possible)
nmap -p22 --script ssh-enum-users --script-args userdb=users.txt target

# Step 4: Brute force (if permitted)
hydra -l admin -P passwords.txt ssh://target

# Step 5: Key-based authentication testing
ssh-keygen -t rsa -b 2048 -f testkey
ssh-copy-id -i testkey.pub user@target

​

HTB Academy Style Rsync Enumeration

# Step 1: Service detection
nmap -p873 target

# Step 2: List available modules
rsync target::
# Example output:
# backup          Backup files
# public          Public files

# Step 3: Enumerate module contents
rsync target::backup/
rsync target::public/

# Step 4: Download interesting files
rsync -av target::backup/passwords.txt ./
rsync -av target::public/config/ ./config/

​

HTB Academy Lab Questions Examples

# Question 1: "Which version of SSH is running on the target?"
nmap -p22 -sV target
# Look for: ssh OpenSSH 7.6p1
# Answer: 7.6p1

# Question 2: "What rsync modules are available?"
rsync target::
# Look for module names in output
# Answer: backup, public

# Question 3: "What files are in the backup module?"
rsync target::backup/
# Look for file listings
# Answer: passwords.txt, config.bak

# Question 4: "Extract the flag from the rsync share"
rsync -av target::backup/flag.txt ./
cat flag.txt
# Answer: HTB{...}

​

Security Assessment

​

SSH Security Assessment

# Check SSH configuration
ssh -T -o StrictHostKeyChecking=no target 2>&1 | grep -E "debug|config"

# Test weak authentication
ssh user@target
ssh root@target

# Check for SSH vulnerabilities
nmap -p22 --script ssh-vuln* target

​

Rsync Security Assessment

# Test anonymous access
rsync target::

# Check for write permissions
echo "test" | rsync - target::module/test.txt

# Enumerate sensitive files
rsync target::module/ | grep -E "passwd|shadow|key|config"

​

R-Service Security Assessment

# Test R-Service access
rsh target "id"
rlogin target

# Check for trusted hosts
rsh target "cat /etc/hosts.equiv"
rsh target "cat ~/.rhosts"

​

Enumeration Checklist

​

SSH Enumeration

• Port scan for SSH (22/tcp)
• Version detection and banner grabbing
• Algorithm enumeration
• User enumeration
• Authentication method testing
• Configuration analysis
• Vulnerability scanning

​

Rsync Enumeration

• Port scan for rsync (873/tcp)
• Module enumeration
• Anonymous access testing
• Directory listing
• File download testing
• Write permission testing
• Sensitive file identification

​

R-Service Enumeration

• Port scan for R-Services (513,514/tcp)
• Service availability testing
• Authentication bypass attempts
• Command execution testing
• File transfer testing
• Configuration file analysis

​

Common Vulnerabilities

​

SSH Vulnerabilities

• CVE-2018-15473: OpenSSH user enumeration
• CVE-2016-10009: OpenSSH privilege escalation
• CVE-2008-5161: OpenSSH client vulnerability

​

Rsync Vulnerabilities

• CVE-2014-9512: Rsync path traversal
• CVE-2011-1097: Rsync daemon security bypass

​

R-Service Vulnerabilities

• Inherent Design Flaws: No encryption, weak authentication
• CVE-1999-0651: R-Services buffer overflow
• CVE-1999-0025: R-Services authentication bypass

​

Tools and Techniques

​

SSH Tools

# Connection tools
ssh                  # SSH client
scp                  # Secure copy
sftp                 # SSH file transfer
ssh-keygen          # Key generation
ssh-copy-id         # Key deployment

# Enumeration tools
nmap                 # Network scanning
hydra                # Brute force
patator              # Authentication testing

​

Rsync Tools

# Basic tools
rsync                # Rsync client
nmap                 # Service detection

# Custom enumeration
#!/bin/bash
# Rsync enumerator
target=$1
modules=$(rsync $target:: 2>/dev/null | awk '{print $1}')
for module in $modules; do
    echo "=== Module: $module ==="
    rsync $target::$module/ 2>/dev/null
done

​

R-Service Tools

# R-Service clients
rsh                  # Remote shell
rcp                  # Remote copy
rlogin               # Remote login

​

Defensive Measures

​

SSH Hardening

# Secure SSH configuration
# /etc/ssh/sshd_config
Port 2222
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
AllowUsers normaluser
DenyUsers root

​

Rsync Security

# Secure rsync configuration
# /etc/rsyncd.conf
uid = nobody
gid = nobody
use chroot = yes
max connections = 10
timeout = 300
refuse options = delete
reverse lookup = no

[secure_backup]
    path = /backup
    read only = true
    hosts allow = 192.168.1.0/24
    hosts deny = *
    auth users = backup_user
    secrets file = /etc/rsyncd.secrets

​

R-Service Mitigation

# Disable R-Services (recommended)
systemctl stop rsh
systemctl stop rlogin
systemctl disable rsh
systemctl disable rlogin

# Remove R-Service packages
apt remove rsh-client rsh-server
apt remove rlogin

​

Best Practices

​

SSH Best Practices

1. Use key-based authentication only
2. Disable root login
3. Change default port
4. Use fail2ban for brute force protection
5. Regular security updates
6. Monitor SSH logs

​

Rsync Best Practices

1. Use authentication and encryption
2. Restrict network access
3. Use read-only shares when possible
4. Monitor rsync logs
5. Regular security audits

​

R-Service Recommendations

1. Do not use R-Services in production
2. Replace with SSH
3. Disable all R-Services
4. Use secure alternatives
5. Regular security assessments

​

Agent Instructions

​

Querying This Documentation

GET https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/remote-management/linux-remote-protocols.md?ask=<question>

​

Windows Remote Protocols

​

Overview

​

RDP (Remote Desktop Protocol)

​

Overview

• Port 3389: Default RDP port
• Authentication: Network Level Authentication (NLA), password-based
• Encryption: TLS encryption for secure connections
• Functionality: Full desktop remote access
• Clients: Windows Remote Desktop, mstsc, rdesktop, xfreerdp

​

RDP Features

• Desktop Sharing: Full graphical desktop access
• Multi-Session: Multiple simultaneous connections
• RemoteApp: Application-specific remote access
• Clipboard Integration: Copy/paste between local and remote systems
• Drive Redirection: Access to local drives from remote session

​

RDP Configuration

# Enable RDP via registry
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

# Enable RDP via PowerShell
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Value 0

# Configure RDP authentication
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v SecurityLayer /t REG_DWORD /d 1 /f

​

RDP Enumeration

# Nmap RDP detection
nmap -p3389 -sV -sC target

# RDP security enumeration
nmap -p3389 --script rdp-enum-encryption target
nmap -p3389 --script rdp-ntlm-info target

# RDP vulnerability scanning
nmap -p3389 --script rdp-vuln* target

​

RDP Security Issues

1. Weak Authentication: Default or weak passwords
2. Version Vulnerabilities: Outdated RDP versions
3. Encryption Issues: Weak encryption protocols
4. Brute Force: Password guessing attacks
5. Network Exposure: RDP accessible from internet

​

WinRM (Windows Remote Management)

​

Overview

• Port 5985: HTTP (unencrypted)
• Port 5986: HTTPS (encrypted)
• Authentication: Kerberos, NTLM, Basic, Certificate
• Protocol: SOAP over HTTP/HTTPS
• Functionality: Remote command execution, PowerShell remoting

​

WinRM Features

• PowerShell Remoting: Remote PowerShell sessions
• Command Execution: Execute commands on remote systems
• Event Forwarding: Forward Windows events
• Configuration Management: Remote system configuration
• Scalability: Manage multiple systems simultaneously

​

WinRM Configuration

# Enable WinRM
winrm quickconfig

# Configure WinRM listeners
winrm create winrm/config/listener?Address=*+Transport=HTTP

# Set authentication methods
winrm set winrm/config/service/auth @{Basic="true"}
winrm set winrm/config/service/auth @{Kerberos="true"}

# Configure trusted hosts
winrm set winrm/config/client @{TrustedHosts="*"}

​

WinRM Enumeration

# Nmap WinRM detection
nmap -p5985,5986 -sV -sC target

# WinRM service enumeration
nmap -p5985,5986 --script http-enum target
nmap -p5985,5986 --script http-headers target

# WinRM authentication testing
nmap -p5985 --script http-auth target

​

WinRM Security Issues

1. Weak Authentication: Basic authentication over HTTP
2. Configuration: Overly permissive settings
3. Encryption: Unencrypted HTTP transport
4. Access Control: Insufficient access restrictions
5. Credential Exposure: Credentials in scripts and configurations

​

WMI (Windows Management Instrumentation)

​

Overview

• Port 135: RPC endpoint mapper
• Dynamic Ports: Random high ports for actual communication
• Authentication: Windows authentication (NTLM, Kerberos)
• Functionality: System information, configuration, monitoring
• Access: Local and remote management

​

WMI Components

• WMI Service: Core service providing WMI functionality
• WMI Repository: Database storing WMI class definitions
• WMI Providers: Components that provide management data
• WMI Classes: Object-oriented representation of manageable resources
• WQL: WMI Query Language for data retrieval

​

WMI Configuration

# Enable WMI through firewall
netsh advfirewall firewall set rule group="windows management instrumentation (wmi)" new enable=yes

# Configure WMI authentication
dcomcnfg.exe
# Navigate to Component Services > Computers > My Computer > DCOM Config > Windows Management Instrumentation

​

WMI Enumeration

# Nmap WMI detection
nmap -p135 -sV -sC target

# WMI service enumeration
nmap -p135 --script rpc-grind target
nmap -p135 --script ms-sql-info target

​

WMI Security Issues

1. Authentication: Windows authentication bypass
2. Access Control: Insufficient WMI permissions
3. Information Disclosure: Sensitive system information
4. Privilege Escalation: WMI-based escalation techniques
5. Persistence: WMI event subscriptions for persistence

​

Advanced Enumeration Techniques

​

RDP Advanced Enumeration

# RDP certificate analysis
nmap -p3389 --script ssl-cert target

# RDP encryption enumeration
nmap -p3389 --script rdp-enum-encryption target

# RDP brute force
hydra -l administrator -P passwords.txt rdp://target
ncrack -u administrator -P passwords.txt rdp://target

​

WinRM Advanced Enumeration

# WinRM service detection
crackmapexec winrm target -u username -p password

# WinRM command execution
evil-winrm -i target -u username -p password

# WinRM PowerShell remoting
Enter-PSSession -ComputerName target -Credential (Get-Credential)

​

WMI Advanced Enumeration

# WMI remote queries
wmic /node:target /user:domain\username /password:password computersystem get name

# WMI information gathering
wmic /node:target os get caption,version,installdate
wmic /node:target service get name,startmode,state
wmic /node:target process get name,processid,commandline

​

Practical Examples

​

HTB Academy Style RDP Enumeration

# Step 1: Service detection
nmap -p3389 -sV -sC target

# Step 2: Certificate analysis
nmap -p3389 --script ssl-cert target

# Step 3: Encryption enumeration
nmap -p3389 --script rdp-enum-encryption target

# Step 4: Authentication testing
xfreerdp /u:administrator /p:password /v:target
rdesktop -u administrator -p password target

​

HTB Academy Style WinRM Enumeration

# Step 1: Service detection
nmap -p5985,5986 -sV -sC target

# Step 2: Authentication testing
crackmapexec winrm target -u username -p password

# Step 3: Command execution
evil-winrm -i target -u username -p password

# Step 4: PowerShell remoting
pwsh
Enter-PSSession -ComputerName target -Credential username

​

HTB Academy Lab Questions Examples

# Question 1: "What version of RDP is running on the target?"
nmap -p3389 -sV target
# Look for: Microsoft Terminal Services (RDP version)
# Answer: RDP version number

# Question 2: "Is WinRM enabled on the target?"
nmap -p5985,5986 target
# Look for: open ports
# Answer: Yes/No

# Question 3: "What authentication methods are supported by WinRM?"
nmap -p5985 --script http-auth target
# Look for: Basic, Negotiate, NTLM
# Answer: Authentication methods

# Question 4: "Execute a command via WinRM and submit the result"
evil-winrm -i target -u username -p password
*Evil-WinRM* PS C:\Users\username> whoami
# Answer: Command output

​

Security Assessment

​

RDP Security Assessment

# RDP vulnerability scanning
nmap -p3389 --script rdp-vuln* target

# RDP brute force protection testing
hydra -l administrator -P passwords.txt rdp://target

# RDP encryption analysis
nmap -p3389 --script rdp-enum-encryption target

​

WinRM Security Assessment

# WinRM configuration analysis
crackmapexec winrm target -u username -p password

# WinRM authentication testing
evil-winrm -i target -u username -p password

# WinRM command execution testing
winrs -r:target -u:username -p:password cmd

​

WMI Security Assessment

# WMI access testing
wmic /node:target /user:username /password:password computersystem get name

# WMI information gathering
wmic /node:target service get name,startmode,state
wmic /node:target process get name,processid

​

Enumeration Checklist

​

RDP Enumeration

• Port scan for RDP (3389/tcp)
• Version detection and banner grabbing
• Certificate analysis
• Encryption enumeration
• Authentication testing
• Vulnerability scanning
• Brute force protection testing

​

WinRM Enumeration

• Port scan for WinRM (5985,5986/tcp)
• Service detection and version identification
• Authentication method enumeration
• HTTP/HTTPS configuration analysis
• Command execution testing
• PowerShell remoting testing
• Configuration analysis

​

WMI Enumeration

• Port scan for RPC (135/tcp)
• Service detection and enumeration
• Authentication testing
• Information gathering via WMI queries
• Access control testing
• Privilege assessment
• Persistence mechanism analysis

​

Attack Vectors

​

RDP Attack Vectors

# RDP brute force
hydra -l administrator -P passwords.txt rdp://target

# RDP vulnerability exploitation
# BlueKeep (CVE-2019-0708)
# DejaBlue (CVE-2019-1181, CVE-2019-1182)

# RDP credential harvesting
# Keyloggers in RDP sessions
# Clipboard monitoring

​

WinRM Attack Vectors

# WinRM command execution
evil-winrm -i target -u username -p password

# WinRM PowerShell exploitation
Enter-PSSession -ComputerName target -Credential username
Invoke-Command -ComputerName target -ScriptBlock {whoami}

# WinRM persistence
# Event subscriptions via WMI
# Scheduled tasks

​

WMI Attack Vectors

# WMI command execution
wmic /node:target process call create "cmd.exe /c command"

# WMI persistence
# Event subscriptions
# MOF files
# WMI classes

# WMI lateral movement
# Remote process creation
# Service manipulation

​

Common Vulnerabilities

​

RDP Vulnerabilities

• CVE-2019-0708: BlueKeep RCE vulnerability
• CVE-2019-1181: DejaBlue RCE vulnerability
• CVE-2019-1182: DejaBlue RCE vulnerability
• CVE-2012-0002: RDP denial of service
• CVE-2018-0886: CredSSP authentication bypass

​

WinRM Vulnerabilities

• Configuration Issues: Weak authentication settings
• Network Exposure: WinRM accessible from untrusted networks
• Authentication Bypass: Weak authentication mechanisms
• Privilege Escalation: WinRM-based escalation techniques

​

WMI Vulnerabilities

• WMI Event Subscriptions: Persistence mechanisms
• WMI Query Injection: Malicious WQL queries
• Access Control: Insufficient WMI permissions
• Information Disclosure: Sensitive system information

​

Tools and Techniques

​

RDP Tools

# RDP clients
mstsc                # Windows Remote Desktop
rdesktop             # Linux RDP client
xfreerdp             # Cross-platform RDP client
freerdp              # Free RDP implementation

# RDP security tools
nmap                 # Network scanning
hydra                # Brute force
ncrack               # Network authentication cracker

​

WinRM Tools

# WinRM clients
winrs                # Windows Remote Shell
evil-winrm           # WinRM pentesting tool
pwsh                 # PowerShell Core

# WinRM testing tools
crackmapexec         # Network authentication testing
nmap                 # Service detection

​

WMI Tools

# WMI clients
wmic                 # Windows WMI command-line
powershell           # PowerShell WMI cmdlets
wmios                # WMI object browser

# WMI testing tools
wmiexec              # WMI command execution
wmipersist           # WMI persistence toolkit

​

Defensive Measures

​

RDP Hardening

# Change default RDP port
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 3390 /f

# Enable Network Level Authentication
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 1 /f

# Restrict RDP access
# Use Group Policy to limit RDP access
# Configure firewall rules

​

WinRM Security

# Disable WinRM if not needed
Stop-Service winrm
Set-Service winrm -StartupType Disabled

# Configure WinRM securely
winrm set winrm/config/service/auth @{Basic="false"}
winrm set winrm/config/service @{AllowUnencrypted="false"}

# Restrict WinRM access
# Use Group Policy to configure WinRM
# Configure firewall rules

​

WMI Security

# Configure WMI security
# Use Group Policy to configure WMI settings
# Set appropriate DCOM permissions
# Monitor WMI activity

# Disable WMI if not needed
Stop-Service winmgmt
Set-Service winmgmt -StartupType Disabled

​

Best Practices

​

RDP Best Practices

1. Change default port: Use non-standard ports
2. Enable NLA: Require Network Level Authentication
3. Use strong passwords: Implement password policies
4. Limit access: Restrict RDP access to authorized users
5. Monitor connections: Log and monitor RDP sessions
6. Keep updated: Apply security patches regularly

​

WinRM Best Practices

1. Use HTTPS: Enable SSL/TLS encryption
2. Restrict authentication: Disable basic authentication
3. Limit access: Configure trusted hosts carefully
4. Monitor activity: Log WinRM connections and commands
5. Network security: Use firewall rules and VPNs
6. Regular audits: Review WinRM configuration regularly

​

WMI Best Practices

1. Access control: Set appropriate WMI permissions
2. Monitor activity: Log WMI queries and changes
3. Disable if unused: Turn off WMI if not needed
4. Regular audits: Review WMI configuration and usage
5. Network security: Restrict WMI network access
6. Update regularly: Keep WMI components updated

​

Detection and Monitoring

​

RDP Monitoring

# Monitor RDP connections
# Windows Event Logs: Security, TerminalServices-LocalSessionManager
# Event IDs: 4624, 4625, 1149

# RDP connection logging
auditpol /set /subcategory:"Logon" /success:enable /failure:enable

​

WinRM Monitoring

# Monitor WinRM activity
# Windows Event Logs: Microsoft-Windows-WinRM
# PowerShell logging: Module, ScriptBlock, Transcription

# WinRM logging configuration
winrm set winrm/config/service @{EnableCompatibilityHttpListener="true"}

​

WMI Monitoring

# Monitor WMI activity
# Windows Event Logs: Microsoft-Windows-WMI-Activity
# Event IDs: 5857, 5858, 5859, 5860, 5861

# WMI logging configuration
# Enable WMI-Activity logging via Group Policy

​

Agent Instructions

​

Querying This Documentation

GET https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/remote-management/windows-remote-protocols.md?ask=<question>