Windows Fundamentals · beginner · ~11 min

RDP and SMB

Explain the two protocols that dominate Windows networks and their security pitfalls.

Overview

SMB (445) is Windows file sharing + inter-host comms (shares, NTLM/Kerberos auth; SMBv1 is dangerous). RDP (3389) is graphical remote access (a top ransomware vector when internet-exposed). Both are primary lateral-movement channels.

Why it matters

SMB enumeration surfaces shares, files, and credentials on internal networks, and SMB auth underlies pass-the-hash/relay; RDP is a leading external entry point. Spotting 445/3389 shapes internal testing and lateral movement.

Core concepts

SMB (445). Shares, NTLM/Kerberos auth; disable SMBv1 (EternalBlue). RDP (3389). Interactive access; keep off the internet, require MFA (BlueKeep). Lateral movement. Both channels carry it once you hold creds. Enumeration. SMB shares are a credential/data goldmine.

Lesson

Two protocols carry most Windows network activity — and most Windows attacks.

SMB (port 445)

Server Message Block is Windows file/printer sharing and inter-machine communication. Over SMB you find shares, authenticate, and (with rights) run remote commands.

  • Enumeration: list shares and readable files — a frequent source of credentials and sensitive data on internal engagements.
  • Authentication: uses NTLM/Kerberos (AD track). NTLM relay and pass-the-hash abuse SMB auth.
  • History: EternalBlue (MS17-010) was an SMBv1 RCE — SMBv1 should be disabled everywhere; flag it if present.

RDP (port 3389)

Remote Desktop Protocol gives a graphical interactive session.

  • Exposure: RDP open to the internet is a top ransomware entry vector — should be behind a VPN/gateway with MFA.
  • Attacks: credential brute force/spraying, and BlueKeep (CVE-2019-0708) on unpatched systems.

Why both matter

On an internal test, SMB enumeration finds data and footholds, and RDP/SMB are the main lateral movement channels once you have credentials. Recognising 445/3389 in a scan immediately shapes the plan.

Summary

SMB and RDP dominate Windows networks: SMB for sharing and authentication (and relay/pass-the-hash), RDP for remote sessions (and external exposure risk). Both are central to internal enumeration and lateral movement.

Practice with these exercises