H 540: RDP and Old Passwords (30 pts)

What You Need for this Project

Purpose

To demonstrate this vulnerability: Windows RDP lets you log in using revoked passwords. Microsoft is OK with that.

Microsoft says this is intended behavior, as shown below:

Part 1: Demonstrating the Vulnerability

Creating a Microsoft Cloud Account

In a Web browser, go to:
Outlook for everyday email and calendars
Click the "Create free account" button.

Follow the on-screen account to create a Microsoft cloud account. I made one ending in "hotmail.com".

Don't create a passkey or use biometric authentication.

Adding your Cloud Account to a Windows Machine

On your Windows machine, open Control Panel.

In Control Panel, click "User Accounts".

Click "User Accounts" again.

Click "Manage another account".

Click "Add a new user in PC settings".

Click "Add account".

In the "How will this person sign in?" box, enter the cloud account address, as shown below.

Click Next.

Click Finish.

In the "Accounts > Other Users" page, find the name of your new account, and click the down-arrow next to it, outlined in red in the image below.

Click "Change account type".

Change the account to an Administrator account.

Enabling Remote Desktop Access

From the search bar at the bottom of the desktop, search for remote.

Click "Remote desktop settings".

On the top right, click the slider to turn Remote Desktop On, as shown below.

Logging in Locally with your Cloud Account

At the bottom of your Windows desktop, right-click the Start button and click "Shut down or sign out", "Sign out".

Log in with your cloud account.

You will need to create a PIN.

Microsoft will try to trick you into purchasing services. Decline.

Once you complete the account creation process, you see a Windows desktop.

Finding Your IP Address

On your Windows machine, open a Command Prompt or Terminal and execute this command:
ipconfig
Make a note of this IP address. You'll need it to connect via RDP.

Sign out.

Logging in via RDP

On another machine, connect to your Windows machine via Remote Desktop.

The procedure varies depending on your operating system.

This page may be helpful.

You see the desktop.

At the bottom of your Windows desktop, right-click the Start button and click "Shut down or sign out", "Sign out".

Changing your Cloud Password

In your browser, you should be logged in to Outlook.

At the top right, click the little circle with your initials in it, outlined in red in the image below.

Click "My Microsoft account".

On the next page, click "Change password".

Follow the on-screen process to change your cloud password.

When I did it, I needed to add a second email address.

Sign in to your cloud account with your new password.

Logging in via RDP

On another machine, connect to your Windows machine again via Remote Desktop.

Log in with your Microsoft cloud account, using your new password. Your login is rejected.

Log in with your cloud account, but use your old cloud password.

You see the desktop.

Flag H 540.1: Connection (15 pts)

In your RDP session, open an Administrator Terminal window.

Execute this command:

netstat -ban -p tcp
The flag is covered by a green rectangle in the image below.

Part 2: Fixing the Problem

I tried removing cached credentials in Credential Manager and removing cached logons in Group Policy, but neither of those changes made the old password stop working for RDP.

However, Tessa Anselm found a solution on 5-7-25. Log in locally to the Windows machine using your Microsoft cloud account, and click "I forgot my PIN", as shown below.

Then go through the process of changing your PIN. It's an involved process, but during this process the Windows machine authenticates with the cloud, requiring your new password, and the old password stops working for RDP.

You can see a complete writeup of her solution here.

After changing your PIN, log out.

Logging in via RDP

On another machine, connect to your Windows machine again via Remote Desktop.

Log in with your Microsoft cloud account, using your old password. Your login is rejected.

Log in with your cloud account, but use your new password.

You see the desktop.

Flag H 540.2: Account Type (15 pts)

In your RDP session, open a Terminal window.

Execute this command:

whoami /all /fo csv
The flag is covered by a green rectangle in the image below.

References

Windows RDP lets you log in using revoked passwords. Microsoft is OK with that.
RDP vulnerability when using Microsoft Cloud accounts

Posted 5-1-25
Solution added 5-8-25