Impacket rdp_check.py

Back to the category index / Back to the command index

Overview

Checks whether a specified account can authenticate through RDP/CredSSP.

Item	Details
Implementation	examples/rdp_check.py
Category	SMB / MSRPC / NTLM
Size	578 lines
Distribution	Installed as a script through scripts=examples/*.py in setup.py

CLI and input

Run python examples/rdp_check.py -h for the current option definitions.

Argument	Description
target	[[domain/]username[:password]@]
-6 / --ipv6	Test over IPv6.
-ts	Add a timestamp to each log message.
-debug	Enable debug output.
-hashes	NTLM hashes in LMHASH:NTHASH format.

Detailed processing flow

After connecting over TCP, the tool selects a protocol through TPKT/X.224 negotiation and establishes TLS. It exchanges CredSSP TSRequest messages containing SPNEGO/NTLM tokens, then verifies server public-key binding and the authentication response. It distinguishes RDP negotiation failures from rejected credentials.

How it works

An RDP connection does not send user credentials immediately. It first negotiates a security protocol through an X.224 connection request, establishes TLS, and then proceeds to CredSSP/NLA. This command constructs the TPKT, TPDU, and RDP negotiation structures itself, first checking whether the server accepts TLS/CredSSP.

CredSSP wraps SPNEGO/NTLM tokens in ASN.1 TSRequest messages and exchanges challenges and responses over several round trips. After verifying binding to the TLS server certificate and public key, it places domain, user, and password information in TSCredentials and sends it through the encrypted channel. This checks NLA authentication, rather than only whether TCP port 3389 is reachable.

RDP negotiation failure codes, TLS handshake errors, NTLM rejection, and CredSSP protocol errors occur at different stages. Whether an account is considered valid depends on the target’s NLA policy, logon rights, and lockout policy. The code must not trust received lengths; it checks that TPKT/ASN.1 fields fit in the buffer before decoding them.

Key implementation elements

Symbol	Location	Where to trace its responsibility
TPKT	58	Structure or constant definition
TPDU	67	__init__()
CR_TPDU	78	Structure or constant definition
DATA_TPDU	88	__init__()
RDP_NEG_REQ	99	__init__()
RDP_NEG_RSP	108	Structure or constant definition
RDP_NEG_FAILURE	113	Structure or constant definition
TSPasswordCreds	118	__init__(), getData()
TSCredentials	141	__init__(), getData()
TSRequest	163	__init__(), fromString(), getData()

Dependencies

Within Impacket

Module	Main names used
impacket.examples	logger
impacket.examples.utils	get_connected_socket, parse_target
impacket.structure	Structure
impacket.spnego	ASN1_OCTET_STRING, ASN1_SEQUENCE, GSSAPI, asn1decode, asn1encode
impacket	ntlm, version

External packages (used directly)

Import name	Distribution package	Import path and declaration status
Cryptodome	pycryptodomex	Imported directly; declared
OpenSSL	pyOpenSSL	Imported directly; declared

Output, side effects, and required privileges

• The tool primarily makes queries and authentication attempts. Frequent runs can affect audit logs, account lockouts, and target load.

Failure paths and cleanup

• Distinguish between a missing input file, a damaged file, an incomplete read, and an unsupported format.

When changing the implementation

The code depends on its own TPKT/TPDU/CredSSP structures, spnego, ntlm, and OpenSSL/socket helpers. TSRequest.fromString() and message framing process untrusted network input, so retain length validation.

Verification

• Syntax: python -m py_compile examples/rdp_check.py
• CLI: python examples/rdp_check.py -h
• Related test: tests/SMB_RPC/test_spnego.py
• Related test: tests/misc/test_structure.py