> For the complete documentation index, see [llms.txt](https://www.ired.team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.ired.team/offensive-security/lateral-movement/lateral-movement-over-headless-rdp-with-sharprdp.md).

# Lateral Movement over headless RDP with SharpRDP

Executing commands on a remote host is possible by using a headless (non-GUI) RDP lateral movement technique brought by a tool called [SharpRDP](https://posts.specterops.io/revisiting-remote-desktop-lateral-movement-8fb905cb46c3?gi=fe80458d82a5).

## Execution

Executing a binary on a remote machine dc01 from a compromised system with offense\administrator credentials:

```
SharpRDP.exe computername=dc01 command=calc username=offense\administrator password=123456
```

![](/files/-LzsKSQef9AhBoU8PjVd)

## Observations

Defenders may want to look for mstscax.dll module being loaded by suspicious binaries on a compromised host from which SharpRDP is being executed:

![](/files/-LzsLPGoHpbVX3GWqreo)

Also, weird binaries making connections to port 3389:

![](/files/-LzsLbkMUJKyV6dibir4)

## References

{% embed url="<https://posts.specterops.io/revisiting-remote-desktop-lateral-movement-8fb905cb46c3?gi=fe80458d82a5>" %}