XFreeRDP

The command-line RDP client of the FreeRDP project — the standard way to reach Windows Remote Desktop from Linux. For offensive work it stands out for first-class pass-the-hash support (/pth) against targets with Restricted Admin Mode enabled.

Standard connection

xfreerdp +clipboard \
         /cert:ignore \
         /dynamic-resolution \
         /v:$HOST \
         /u:$USER \
         /p:$PASSWORD

• +clipboard — shared clipboard between host and RDP session
• /cert:ignore — skip certificate validation (lab/CTF use; hides MITM warnings)
• /dynamic-resolution — resize the remote desktop with the local window
• /drive:$NAME,$LOCAL_DIR (or legacy /mount:) — expose a local directory inside the session for tool transfer

Pass-the-hash

xfreerdp /v:$HOST /u:$DOMAIN\\$USER /pth:$NTLM_HASH

/pth authenticates with an NTLM hash instead of a password — but the target must have Restricted Admin Mode enabled, or the server will reject hash-only NTLM logons for RDP. See rdp-restricted-admin-mode for the security trade-offs of that setting.

Notes

• Current builds prefer /drive: syntax for drive redirection; older notes reference /mount:
• /cert:ignore is being phased out in favor of /cert:tofu / explicit /certificate-name checks in FreeRDP 3.x
• Keyboard layout issues over non-US layouts: add /kbd:0x00000409

Sources

• FreeRDP/FreeRDP — GitHub
• Kali — Passing the Hash with Remote Desktop
• MITRE ATT&CK T1021.001 — Remote Desktop Protocol

Related: rdp-restricted-admin-mode, rdp-session-hijacking, ntlm-relay-attacks, psexec