RDP — Command Execution
Methods for achieving command execution over RDP — built-in tooling, common misconfigurations, and third-party utilities.
Overview
RDP (Remote Desktop Protocol) can be leveraged for command execution in several ways, depending on the target configuration and the access already held. This page covers the common methods, what each requires, and the traces they leave.
Key points
- RDP grants interactive access to a remote host, which can be driven toward command execution.
- Execution is possible through built-in Windows tooling, misconfigurations, or third-party utilities.
- Most often used during lateral movement, after initial access is established.
- Typically requires valid credentials, network reachability, or a weak setting.
- Leaves detectable artifacts in logs (Event IDs 4624, 4648, 4688 and related).
Common methods
| Method | Description | Requirements | Notes |
|---|---|---|---|
xfreerdp |
Open-source RDP client with exec options. | Valid creds / network | Supports drive redirect, /exec. |
mstsc |
Built-in Windows RDP client. | Valid creds | Launches programs via a .rdp file. |
| PsExec (post-RDP) | Run commands after RDP access. | Local admin | Useful for pivoting. |
| Scheduled Tasks | Register a task to run your command. | Valid creds | Doubles as persistence. |
| RDP misconfig | Abuse weak/exposed RDP. | Network access | Check NLA, restrictions, exposure. |
Further reading
Further Reading holds external links only — internal pages live in the workspace tree.
Authorised testing only. Run these against systems you have written permission to assess. Expect Event IDs 4624/4648/4688 in the defender's SIEM.
1 — Authenticate with xfreerdp
xfreerdp /u:administrator /p:'Passw0rd!' /v:10.10.10.5 \
/drive:share,/tmp/loot /cert:ignore +clipboard
2 — Execute via a staged .rdp file (mstsc)
Set-Content conn.rdp "full address:s:10.10.10.5`nalternate shell:s:cmd.exe"
mstsc .\conn.rdp
3 — Post-RDP execution with PsExec
psexec.exe \\10.10.10.6 -u CORP\admin -p Passw0rd! cmd.exe
Cleanup checklist
- Remove staged files from redirected drives and
%TEMP%. - Delete any scheduled tasks created during testing.
- Record affected hostnames and timestamps in the engagement page.