Pearson's OSCP Notebook

xfreerdp

Properties1
tagsxfreerdp, rdp, remote-desktop, windows, pass-the-hash, port-3389, lateral-movement

6 min read

xfreerdp — RDP Client Reference

What is xfreerdp?

xfreerdp (and its newer version xfreerdp3) is the standard Linux RDP client used in OSCP. It connects to Windows machines over RDP (port 3389), supports Pass-the-Hash, clipboard/drive sharing, certificate bypass, and many display options.

OSCP tip: Use xfreerdp3 if available (Kali 2024+). Fall back to xfreerdp if not. Legacy alternative: rdesktop (rdesktop 192.168.x.x).

Install (Kali)

sudo apt update && sudo apt install -y freerdp2-x11

Verify: xfreerdp /version or xfreerdp3 /version

Full install index → Installation - Kali Setup

Syntax

xfreerdp3 [options] /v:TARGET[:PORT]
xfreerdp  [options] /v:TARGET[:PORT]

📌 1) All Flags

Connection

FlagDescription
/v:HOSTTarget IP or hostname
/v:HOST:PORTTarget with non-standard port
/port:PORTAlternative way to set port
/u:USERNAMEUsername
/d:DOMAINDomain (for domain accounts)
/p:PASSWORDPassword
/pth:NTHASHPass-the-Hash (NT hash instead of password)
/p:''Empty password

Certificate & Security

FlagDescription
/cert:ignoreIgnore certificate errors (most common for labs)
/cert-ignoreOlder syntax — same as above
/tls-seclevel:0Lower TLS security level (fixes connection issues on old hosts)
/sec:rdpForce RDP security (no NLA)
/sec:tlsForce TLS security
/sec:nlaForce NLA (Network Level Authentication)
/sec:extForce extended security

Display

FlagDescription
/w:WIDTHWindow width in pixels
/h:HEIGHTWindow height in pixels
/size:WxHWindow size (e.g. /size:1920x1080)
/fFull screen mode
/workareaWindow fits your current work area (most useful)
/multimonSpan across multiple monitors
/spanSpan across all monitors
/dynamic-resolutionAllow dynamic resize (RDP 8.1+)
/scale:VALUEScale factor (100, 140, 180)

Clipboard & File Sharing

FlagDescription
+clipboardEnable clipboard sharing (copy/paste between host and RDP session)
/drive:NAME,/local/pathShare a local directory in the RDP session
/drive:share,/tmp/shareExample: share /tmp/share as “share” drive

Audio

FlagDescription
/soundEnable audio from RDP session
/microphoneEnable microphone forwarding
-soundDisable audio

Performance

FlagDescription
/bpp:32Color depth (8, 15, 16, 24, 32)
/compressionEnable compression
/network:lanNetwork type preset: lan, broadband, wan, modem, auto
/gfxEnable GFX (RemoteFX) for better graphics
/rfxEnable RemoteFX codec

Misc

FlagDescription
/timeout:MSECConnection timeout in milliseconds
/reconnectAuto-reconnect on disconnect
/kbd:0x0409Keyboard layout (US = 0x0409)
/shell:CMDRun specific program instead of desktop
/shell-dir:PATHWorking directory for shell
/adminConnect to admin/console session
/restricted-adminRestricted Admin mode (required for PTH)
/from-stdinRead password from stdin (avoid shell history)
-grab-keyboardDon’t grab keyboard (lets keyboard shortcuts pass through)
+auto-reconnectAttempt auto-reconnect on network drop
/log-level:TRACESet log level (TRACE, DEBUG, INFO, WARN, ERROR, FATAL, OFF)

📌 2) Common Connection Examples

Standard connection (most common)

# Basic — ignore cert errors (use this most of the time)
xfreerdp3 /u:Administrator /p:'Password1' /v:10.10.10.10 /cert:ignore
 
# With domain
xfreerdp3 /u:jsmith /d:corp.local /p:'Password1' /v:10.10.10.10 /cert:ignore
 
# Domain short syntax
xfreerdp3 /u:corp\\jsmith /p:'Password1' /v:10.10.10.10 /cert:ignore
 
# Useful display options added
xfreerdp3 /u:Administrator /p:'Password1' /v:10.10.10.10 /cert:ignore /workarea +clipboard

Non-standard port

xfreerdp3 /u:Administrator /p:'Password1' /v:10.10.10.10:3390 /cert:ignore
xfreerdp3 /u:Administrator /p:'Password1' /v:10.10.10.10 /port:3390 /cert:ignore
 
# Via tunnel / port forward
xfreerdp3 /u:Administrator /p:'Password1' /v:127.0.0.1:3389 /cert:ignore

Handling old / difficult targets

# If you get "ERRCONNECT_TLS_CONNECT_FAILED" or similar TLS errors
xfreerdp3 /u:Administrator /p:'Password1' /v:10.10.10.10 /cert:ignore /tls-seclevel:0
 
# Force old RDP security (no TLS — very old targets)
xfreerdp3 /u:Administrator /p:'Password1' /v:10.10.10.10 c/cert:ignore /sec:rdp
 
# If connection resets immediately
xfreerdp3 /u:Administrator /p:'Password1' /v:10.10.10.10 /cert:ignore /sec:nla

Empty or special passwords

# Empty password
xfreerdp3 /u:Administrator /p:'' /v:10.10.10.10 /cert:ignore
 
# Password with special characters (quote carefully)
xfreerdp3 /u:Administrator /p:'P@$$w0rd!' /v:10.10.10.10 /cert:ignore
 
# Read password from stdin (no shell history)
echo 'Password1' | xfreerdp3 /u:Administrator /v:10.10.10.10 /cert:ignore /from-stdin

📌 3) Pass-the-Hash (PTH)

RDP with an NTLM hash — no plaintext password required. Requires Restricted Admin mode to be enabled on the target (enabled by default on many Windows boxes, or can be enabled if you have admin access).

# PTH — use NT hash directly
xfreerdp3 /u:Administrator /pth:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c /v:10.10.10.10 /cert:ignore
 
# Just the NT portion (no LM needed if LM is blank)
xfreerdp3 /u:Administrator /pth:8846f7eaee8fb117ad06bdd830b7586c /v:10.10.10.10 /cert:ignore
 
# With domain
xfreerdp3 /u:Administrator /d:corp.local /pth:NTHASH /v:10.10.10.10 /cert:ignore /restricted-admin
 
# Enable Restricted Admin via registry (if you have admin access another way):
# reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v DisableRestrictedAdmin /t REG_DWORD /d 0

Note: If PTH fails, Restricted Admin may be disabled. Enable it from your existing admin session first.

📌 4) File Sharing (Transfer Files via RDP)

Share a local directory into the RDP session — appears as a network drive inside Windows.

# Share /tmp/share as drive "share" in the RDP session
xfreerdp3 /u:Administrator /p:'Password1' /v:10.10.10.10 /cert:ignore /drive:share,/tmp/share
 
# Share your whole home dir
xfreerdp3 /u:Administrator /p:'Password1' /v:10.10.10.10 /cert:ignore /drive:kali,/home/kali
 
# Inside the RDP session:
# Open File Explorer → "This PC" → you'll see "share on KALI" or similar
# Copy files to/from it like any network drive

Enable clipboard (copy/paste)

xfreerdp3 /u:Administrator /p:'Password1' /v:10.10.10.10 /cert:ignore +clipboard
# Now you can paste text between your Kali clipboard and the Windows session

📌 5) Display Options

# Fit work area (recommended — doesn't cover taskbar)
xfreerdp3 /u:Administrator /p:'Password1' /v:10.10.10.10 /cert:ignore /workarea
 
# Fullscreen
xfreerdp3 /u:Administrator /p:'Password1' /v:10.10.10.10 /cert:ignore /f
 
# Specific resolution
xfreerdp3 /u:Administrator /p:'Password1' /v:10.10.10.10 /cert:ignore /size:1920x1080
xfreerdp3 /u:Administrator /p:'Password1' /v:10.10.10.10 /cert:ignore /w:1600 /h:900
 
# Dynamic resize (resize window and RDP session follows)
xfreerdp3 /u:Administrator /p:'Password1' /v:10.10.10.10 /cert:ignore /dynamic-resolution

📌 6) Run a Specific Program (No Desktop)

# Launch cmd.exe directly (skip the full desktop)
xfreerdp3 /u:Administrator /p:'Password1' /v:10.10.10.10 /cert:ignore /shell:cmd.exe
 
# Launch PowerShell
xfreerdp3 /u:Administrator /p:'Password1' /v:10.10.10.10 /cert:ignore /shell:powershell.exe
 
# Connect to admin/console session (session 0)
xfreerdp3 /u:Administrator /p:'Password1' /v:10.10.10.10 /cert:ignore /admin

📌 7) Verify RDP is Open

# Netcat port check
nc -nv 10.10.10.10 3389
 
# Nmap
nmap -p 3389 -sV --script rdp-enum-encryption 10.10.10.10
nmap -p 3389 --script rdp-vuln-ms12-020 10.10.10.10    # BlueKeep/MS12-020 check
 
# If no response on 3389, check if RDP is on a different port
nmap -p 3387,3388,3389,3390 -sV 10.10.10.10

📌 8) Common Errors & Fixes

ErrorFix
ERRCONNECT_TLS_CONNECT_FAILEDAdd /tls-seclevel:0
ERRCONNECT_SECURITY_NEGO_CONNECT_FAILEDTry /sec:rdp or /sec:nla
ERRCONNECT_LOGON_FAILUREWrong credentials — check username/password/domain
ERRCONNECT_CONNECT_FAILEDPort is closed or filtered — verify with nc
Certificate errorAdd /cert:ignore
Black screen / disconnectsTry /bpp:16 or add /compression
Keyboard issuesAdd -grab-keyboard or /kbd:0x0409
PTH not workingEnable Restricted Admin: reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v DisableRestrictedAdmin /t REG_DWORD /d 0

📌 9) Brute Force RDP Credentials

# Hydra (slow — keep threads very low)
hydra -L users.txt -P passwords.txt 10.10.10.10 rdp -t 2 -f
 
# Crowbar (RDP-specific, more reliable)
crowbar -b rdp -s 10.10.10.10/32 -U users.txt -C passwords.txt -n 1
 
# Ncrack
ncrack -vv --user Administrator -P passwords.txt rdp://10.10.10.10
 
# CrackMapExec
crackmapexec rdp 10.10.10.10 -u users.txt -p passwords.txt

📌 Quick OSCP Cheat Sheet (Copy/Paste)

# Standard connection
xfreerdp3 /u:Administrator /p:'Password1' /v:10.10.10.10 /cert:ignore /workarea +clipboard
 
# With domain
xfreerdp3 /u:jsmith /d:corp.local /p:'Password1' /v:10.10.10.10 /cert:ignore /workarea +clipboard
 
# TLS issues
xfreerdp3 /u:Administrator /p:'Password1' /v:10.10.10.10 /cert:ignore /tls-seclevel:0
 
# Pass-the-Hash
xfreerdp3 /u:Administrator /pth:NTHASH /v:10.10.10.10 /cert:ignore /restricted-admin
 
# Non-standard port (e.g. via port forward)
xfreerdp3 /u:Administrator /p:'Password1' /v:127.0.0.1:3389 /cert:ignore /workarea
 
# Share a folder (for file transfer)
xfreerdp3 /u:Administrator /p:'Password1' /v:10.10.10.10 /cert:ignore /drive:share,/tmp/share +clipboard
 
# Verify port open
nc -nv 10.10.10.10 3389
nmap -p 3389 -sV --script rdp-enum-encryption 10.10.10.10

Graph View

Backlinks