Repository navigation
RDP - Server refused our connection request! Reason: SSL_NOT_ALLOWED_BY_SERVER #1457
Description
Describe the bug
When attempting to authenticate to a remote server over rdp using nxc, the connection fails despite the correct credentials.
To Reproduce
nxc rdp 10.129.113.246 -u 'RemovedUser' -p 'RemovedPass' --debug
[18:31:04] DEBUG NXC VERSION: 1.5.1 - Yippie-Ki-Yay - 306bf295 - 957 netexec.py:94
DEBUG PYTHON VERSION: 3.14.7 (main, Aug 14 2026, 06:38:32) [GCC 16.2.1 20260810] netexec.py:95
DEBUG RUNNING ON: Linux Release: 7.2.6-1-cachyos netexec.py:96
DEBUG Passed args: Namespace(version=False, threads=256, timeout=None, jitter=None, exclude_hosts=None, skip_self=False, no_progress=False, log=None, verbose=False, debug=True, force_ipv6=False, dns_server=None, dns_tcp=False, dns_timeout=3, protocol='rdp', target=['10.129.113.246'], netexec.py:97
username=['RemovedUser'], password=['RemovedPass'], cred_id=[], ignore_pw_decoding=False, no_bruteforce=False, continue_on_success=False, gfail_limit=None, ufail_limit=None, fail_limit=None, kerberos=False, use_kcache=False, aesKey=None, kdcHost=None, pfx_cert=None, pfx_base64=None,
pfx_pass=None, pem_cert=None, pem_key=None, module=None, module_options=[], list_modules=None, show_module_options=False, hash=[], port=3389, rdp_timeout=5, nla_screenshot=False, domain=None, local_auth=False, screenshot=False, screentime=10, res='1024x768', execute=None,
ps_execute=None, cmd_delay=5, clipboard_delay=30, no_output=False)
DEBUG Protocol: rdp netexec.py:135
DEBUG Protocol Path: /home/reelix/.local/share/pipx/venvs/netexec/lib/python3.14/site-packages/nxc/protocols/rdp.py netexec.py:138
DEBUG Protocol DB Path: /home/reelix/.local/share/pipx/venvs/netexec/lib/python3.14/site-packages/nxc/protocols/rdp/database.py netexec.py:140
DEBUG Protocol Object: <class 'protocol.rdp'>, type: <class 'type'> netexec.py:143
DEBUG Protocol DB Object: <class 'protocol.database'> netexec.py:145
DEBUG DB Path: /home/reelix/.nxc/workspaces/default/rdp.db netexec.py:148
DEBUG Creating ThreadPoolExecutor netexec.py:45
DEBUG Creating thread for <class 'protocol.rdp'> netexec.py:48
DEBUG Socket info: host=10.129.113.246, hostname=10.129.113.246, kerberos=False, ipv6=False, link-local ipv6=False connection.py:179
DEBUG Kicking off proto_flow connection.py:245
DEBUG Checking NLA for 10.129.113.246 rdp.py:177
[18:31:09] INFO Successfully created connection object for target '10.129.113.246' connection.py:250
[18:31:09] INFO RDP 10.129.113.246 3389 10.129.113.246 Probably old, doesn't not support HYBRID or HYBRID_EX (nla:False) rdp.py:111
DEBUG Trying to authenticate using plaintext with domain connection.py:513
[18:31:09] INFO RDP 10.129.113.246 3389 10.129.113.246 None\RemovedUser:RemovedPass (Server refused our connection request! Reason: SSL_NOT_ALLOWED_BY_SERVER) rdp.py:350
DEBUG Calling command arguments connection.py:262
DEBUG Closing connection to: 10.129.113.246 connection.py:196
reelix@reelix-cachy ~/htb/Touch nxc rdp 10.129.113.246 -u 'RemovedUser' -p 'RemovedPass' -k --debug
[18:31:17] DEBUG NXC VERSION: 1.5.1 - Yippie-Ki-Yay - 306bf295 - 957 netexec.py:94
DEBUG PYTHON VERSION: 3.14.7 (main, Aug 14 2026, 06:38:32) [GCC 16.2.1 20260810] netexec.py:95
DEBUG RUNNING ON: Linux Release: 7.2.6-1-cachyos netexec.py:96
DEBUG Passed args: Namespace(version=False, threads=256, timeout=None, jitter=None, exclude_hosts=None, skip_self=False, no_progress=False, log=None, verbose=False, debug=True, force_ipv6=False, dns_server=None, dns_tcp=False, dns_timeout=3, protocol='rdp', target=['10.129.113.246'], netexec.py:97
username=['RemovedUser'], password=['RemovedPass'], cred_id=[], ignore_pw_decoding=False, no_bruteforce=False, continue_on_success=False, gfail_limit=None, ufail_limit=None, fail_limit=None, kerberos=True, use_kcache=False, aesKey=None, kdcHost=None, pfx_cert=None, pfx_base64=None,
pfx_pass=None, pem_cert=None, pem_key=None, module=None, module_options=[], list_modules=None, show_module_options=False, hash=[], port=3389, rdp_timeout=5, nla_screenshot=False, domain=None, local_auth=False, screenshot=False, screentime=10, res='1024x768', execute=None,
ps_execute=None, cmd_delay=5, clipboard_delay=30, no_output=False)
DEBUG Protocol: rdp netexec.py:135
DEBUG Protocol Path: /home/reelix/.local/share/pipx/venvs/netexec/lib/python3.14/site-packages/nxc/protocols/rdp.py netexec.py:138
DEBUG Protocol DB Path: /home/reelix/.local/share/pipx/venvs/netexec/lib/python3.14/site-packages/nxc/protocols/rdp/database.py netexec.py:140
DEBUG Protocol Object: <class 'protocol.rdp'>, type: <class 'type'> netexec.py:143
DEBUG Protocol DB Object: <class 'protocol.database'> netexec.py:145
DEBUG DB Path: /home/reelix/.nxc/workspaces/default/rdp.db netexec.py:148
DEBUG Creating ThreadPoolExecutor netexec.py:45
DEBUG Creating thread for <class 'protocol.rdp'> netexec.py:48
DEBUG Socket info: host=10.129.113.246, hostname=10.129.113.246, kerberos=True, ipv6=False, link-local ipv6=False connection.py:179
DEBUG Kicking off proto_flow connection.py:245
DEBUG Checking NLA for 10.129.113.246 rdp.py:177
[18:31:22] INFO Successfully created connection object for target '10.129.113.246' connection.py:250
[18:31:22] INFO RDP 10.129.113.246 3389 10.129.113.246 Probably old, doesn't not support HYBRID or HYBRID_EX (nla:False) rdp.py:111
DEBUG Trying to authenticate using Kerberos connection.py:510
[18:31:22] INFO RDP 10.129.113.246 3389 10.129.113.246 None\RemovedUser:RemovedPass (can only concatenate str (not "NoneType") to str) rdp.py:316
DEBUG Calling command arguments connection.py:262
DEBUG Closing connection to: 10.129.113.246 connection.py:196
reelix@reelix-cachy ~/htb/Touch nxc rdp 10.129.113.246 -u 'RemovedUser' -p 'RemovedPass' --local-auth --debug
[18:31:40] DEBUG NXC VERSION: 1.5.1 - Yippie-Ki-Yay - 306bf295 - 957 netexec.py:94
DEBUG PYTHON VERSION: 3.14.7 (main, Aug 14 2026, 06:38:32) [GCC 16.2.1 20260810] netexec.py:95
DEBUG RUNNING ON: Linux Release: 7.2.6-1-cachyos netexec.py:96
DEBUG Passed args: Namespace(version=False, threads=256, timeout=None, jitter=None, exclude_hosts=None, skip_self=False, no_progress=False, log=None, verbose=False, debug=True, force_ipv6=False, dns_server=None, dns_tcp=False, dns_timeout=3, protocol='rdp', target=['10.129.113.246'], netexec.py:97
username=['RemovedUser'], password=['RemovedPass'], cred_id=[], ignore_pw_decoding=False, no_bruteforce=False, continue_on_success=False, gfail_limit=None, ufail_limit=None, fail_limit=None, kerberos=False, use_kcache=False, aesKey=None, kdcHost=None, pfx_cert=None, pfx_base64=None,
pfx_pass=None, pem_cert=None, pem_key=None, module=None, module_options=[], list_modules=None, show_module_options=False, hash=[], port=3389, rdp_timeout=5, nla_screenshot=False, domain=None, local_auth=True, screenshot=False, screentime=10, res='1024x768', execute=None,
ps_execute=None, cmd_delay=5, clipboard_delay=30, no_output=False)
DEBUG Protocol: rdp netexec.py:135
DEBUG Protocol Path: /home/reelix/.local/share/pipx/venvs/netexec/lib/python3.14/site-packages/nxc/protocols/rdp.py netexec.py:138
DEBUG Protocol DB Path: /home/reelix/.local/share/pipx/venvs/netexec/lib/python3.14/site-packages/nxc/protocols/rdp/database.py netexec.py:140
DEBUG Protocol Object: <class 'protocol.rdp'>, type: <class 'type'> netexec.py:143
DEBUG Protocol DB Object: <class 'protocol.database'> netexec.py:145
DEBUG DB Path: /home/reelix/.nxc/workspaces/default/rdp.db netexec.py:148
DEBUG Creating ThreadPoolExecutor netexec.py:45
DEBUG Creating thread for <class 'protocol.rdp'> netexec.py:48
DEBUG Socket info: host=10.129.113.246, hostname=10.129.113.246, kerberos=False, ipv6=False, link-local ipv6=False connection.py:179
DEBUG Kicking off proto_flow connection.py:245
DEBUG Checking NLA for 10.129.113.246 rdp.py:177
[18:31:45] INFO Resolved domain: 10.129.113.246 with dns, kdcHost: 10.129.113.246 rdp.py:162
INFO Successfully created connection object for target '10.129.113.246' connection.py:250
[18:31:45] INFO RDP 10.129.113.246 3389 10.129.113.246 None (name:10.129.113.246) (domain:10.129.113.246) (nla:False) rdp.py:113
DEBUG rdp add_host() - hosts returned: [(1, '10.129.113.246', 3389, '10.129.113.246', '10.129.113.246', None, False)] database.py:48
DEBUG Update Hosts: [{'id': 1, 'ip': '10.129.113.246', 'port': 3389, 'hostname': '10.129.113.246', 'domain': '10.129.113.246', 'os': None, 'nla': False}] database.py:81
DEBUG Trying to authenticate using plaintext with domain connection.py:513
[18:31:46] INFO RDP 10.129.113.246 3389 10.129.113.246 10.129.113.246\RemovedUser:RemovedPass (Server refused our connection request! Reason: SSL_NOT_ALLOWED_BY_SERVER) rdp.py:350
[18:31:46] DEBUG Calling command arguments connection.py:262
DEBUG Closing connection to: 10.129.113.246
Expected behavior
The account authenticates over RDP with the correct credentials.
NetExec info
- OS:
CachyOS - Linux reelix-cachy 7.2.6-1-cachyos #1 SMP PREEMPT_DYNAMIC Thu, 17 Sep 2026 10:26:35 +0000 x86_64 GNU/Linux - Version of nxc: 1.5.1 - Yippie-Ki-Yay - 306bf29 - 957
- Installed from: github
Additional context
This issue can be replicated using the currently active HackTheBox box "Touch" using discovered credentials.
Activity
NeffIsBack commentedon Oct 9, 2026
Hi and thanks for the bug report!
@azoxlpf do you perhaps have the time to take a look at this? You probably are much more familiar with RDP than me :D