> For the complete documentation index, see [llms.txt](https://kashz.gitbook.io/kashz-jewels/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kashz.gitbook.io/kashz-jewels/os-windows/windows-post-exploitation/rdp-tools.md).

# RDP tools

## Connect

```bash
xfreerdp /dynamic-resolution +clipboard /cert:ignore /v:IP /u:USER /p:PASS [/drive:LOCAL_DIR,SHARE_NAME]
rdesktop -u USER -p PASS IP -r clipboard:CLIPBOARD [-g 95%]
remmina -c FILE.rdp
```

## brute force RDP

```bash
crowbar -b rdp -s CIDR-IP/32 -U USER.txt -C PASS.txt
```

## Run shell as elevated user without UAC prompt

### [nirsoft.net/Advanced Run](https://www.nirsoft.net/utils/advanced_run.html)

```bash
> AdvancedRun.exe /EXEFilename "kashz.exe" /RunAs 4 /Run
# 3: Administrator
# 4: SYSTEM
```

### [nirsoft.net/nircmd](https://www.nirsoft.net/utils/nircmd.html)

```bash
> nircmd.exe elevatecmd runassystem kashz.exe
```

## References

* [winhelponline.com/run-program-as-system-localsystem-account-windows](https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows)