RDP – MSTSC Plaintext Password

🔒 Secure Bits 💡
𝗧𝗵𝗶𝗻𝗸 𝗥𝗗𝗣 + 𝗖𝗿𝗲𝗱𝗲𝗻𝘁𝗶𝗮𝗹 𝗚𝘂𝗮𝗿𝗱 𝗸𝗲𝗲𝗽𝘀 𝘆𝗼𝘂𝗿 𝗱𝗼𝗺𝗮𝗶𝗻 𝗮𝗱𝗺𝗶𝗻 𝗰𝗿𝗲𝗱𝘀 𝘀𝗮𝗳𝗲? 𝗡𝗼𝘁 𝗿𝗲𝗮𝗹𝗹𝘆.

Even in 2025, many 𝗮𝗱𝗺𝗶𝗻𝘀 𝘀𝘁𝗶𝗹𝗹 𝗲𝘅𝗽𝗼𝘀𝗲 𝘁𝗵𝗲𝗶𝗿 𝗗𝗼𝗺𝗮𝗶𝗻 𝗔𝗱𝗺𝗶𝗻 𝗰𝗿𝗲𝗱𝗲𝗻𝘁𝗶𝗮𝗹𝘀 without realizing it — just by using RDP to access Domain Controllers from their regular workstation.

🧠 “But I’ve got 𝗖𝗿𝗲𝗱𝗲𝗻𝘁𝗶𝗮𝗹 𝗚𝘂𝗮𝗿𝗱, I’m protected!”
Not always.

𝗛𝗲𝗿𝗲’𝘀 𝘄𝗵𝗮𝘁 𝗮𝗰𝘁𝘂𝗮𝗹𝗹𝘆 𝗵𝗮𝗽𝗽𝗲𝗻𝘀 𝗶𝗻 𝗰𝗮𝘀𝗲 𝗼𝗳 𝗥𝗗𝗣:
1️⃣ You connect to a DC via RDP from your “basic ” machine
2️⃣ As part of that RDP session, your password gets cached in MSTSC memory
3️⃣ An attacker on your workstation could extract it — even in plaintext

💥 𝗖𝗿𝗲𝗱𝗲𝗻𝘁𝗶𝗮𝗹 𝗚𝘂𝗮𝗿𝗱 𝗱𝗼𝗲𝘀𝗻’𝘁 𝘀𝗮𝘃𝗲 𝘆𝗼𝘂 𝗵𝗲𝗿𝗲.
Neither will SmartCards (care to guess what ends up in memory instead?)

🎯 The real fix? Implement 𝗽𝗿𝗼𝗽𝗲𝗿 𝗣𝗿𝗶𝘃𝗶𝗹𝗲𝗴𝗲𝗱 𝗔𝗰𝗰𝗲𝘀𝘀 𝗪𝗼𝗿𝗸𝘀𝘁𝗮𝘁𝗶𝗼𝗻𝘀 (𝗣𝗔𝗪) 𝗮𝗻𝗱 𝗳𝗼𝗹𝗹𝗼𝘄 𝘁𝗵𝗲 𝗧𝗶𝗲𝗿𝗶𝗻𝗴 𝗠𝗼𝗱𝗲𝗹. You can also take advantage of Restricted Admin Mode in RDP, but it requires the knowledge of the above.

Your credentials are only as secure as the device you log in from.

👇 Ever tested what MSTSC leaks in memory?