Terminal services though considered safe are susceptible to brute force attacks. You might want to protect yourself by referring to an old post of ours. In case you would still like to check if the methods presented there might save you from a brute force attack or not, we have tried to list down the tools we know will help you to brute force a Microsoft Terminal Service.
We know there are other tools out there, but we are discussing about brute forcing only and not MITM, etc.
1. TScrack:
It was developed way back in 2002, in VB. In short, TScrack uses AI technology (Artificial Neural Networks) to scrape the screen contents of the graphical logon, in order to enable a simple dictionary based cracking algorithm to perform efficiently against the graphically presented logon dialogs and message boxes.
This working is similar to the technology used i.e. in Optical Character Recognition (OCR), Face- and Image recognition in general.
Now, the homepage for this tool sadly does not exist any more. But, we still have the Web archive of the same, which can serve your download purposes here.
It needs to be noted that at the time of release of this tool, it was extensively tested on Windows 2000, somewhat on Windows XP. So, we do not know if it will run on Windows 2003, Vista, etc. Will try to locate a few VM’s and keep you all updated about the same.
2. TSGrinder:
TSGrinder takes into consideration that the Administrator account, since it cannot be locked out for local logons, can be brute forced! Very simple, yet effective!
It is a “dictionary” based attack tool, which supports multiple attack windows from a single dictionary file. It also supports multiple password attempts in the same connection, and allows you to specify how many times to try a username/password combination within a particular connection!
You do need Roboclient (Microsoft Simulated Terminal Server Client), which can be downloaded here. TSGrinder can be downloaded here. The current version is 2.03.
Oh yes, incase TSGrinder does not work for you, you might want to follow some simple tricks mailed at a mailing list here.
Searches leading to this post:brute force para terminal service, tsgrinder dictionary, windows 2003 rdp bruteforce wordlist
