Skip to content
Nuclei Templates

Windows Remote Desktop Protocol - Detect

ID: rdp-detect

Severity: info

Author: princechaddha

Tags: network,windows,rdp,detect,detection,tcp

Description

Section titled “Description”

Windows Remote Desktop Protocol was detected.

YAML Source

Section titled “YAML Source”
id: rdp-detect


info:
  name: Windows Remote Desktop Protocol - Detect
  author: princechaddha
  severity: info
  description: |
    Windows Remote Desktop Protocol was detected.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 1
  tags: network,windows,rdp,detect,detection,tcp
tcp:
  - inputs:
      - data: "0300002a25e00000000000436f6f6b69653a206d737473686173683d746573740d0a010008000b000000"
        type: hex
    read-size: 2048


    host:
      - "{{Hostname}}"
    port: 3389


    matchers:
      - type: word
        name: rdp
        encoding: hex
        words:
          - "030000130ed"


      - type: word
        encoding: hex
        name: win2000/winxp
        words:
          - "0300000b06d00000123400"


      - type: word
        encoding: hex
        name: win2003
        words:
          - "030000130ed000001234000300080002000000"


      - type: word
        encoding: hex
        name: win2008
        words:
          - "030000130ed000001234000200080002000000"


      - type: word
        encoding: hex
        name: win7or2008R2
        words:
          - "030000130ed000001234000209080002000000"


      - type: word
        encoding: hex
        name: win2008R2DC
        words:
          - "030000130ed000001234000201080002000000"


      - type: word
        encoding: hex
        name: win10
        words:
          - "030000130ed00000123400021f080002000000"


      - type: word
        encoding: hex
        name: win2012R2OR8
        words:
          - "030000130ed00000123400020f080002000000"


      - type: word
        encoding: hex
        name: win2012R2
        words:
          - "030000130ed00000123400020f080008000000"


      - type: word
        encoding: hex
        name: win2016
        words:
          - "030000130ed00000123400021f080008000000"
# digest: 4a0a00473045022004c61cb59162d4ce82c3c121ef49bf75276926b2cafaeddc87cca92273dde90202210098a0a414db7fb377d9ed5609b61fbb7dd1ffbb610a1f72bba88af95f376a1518:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "network/detection/rdp-detect.yaml"

View on Github