[Network] Finding Open Windows Terminal Servers

something you could do when you are bored and you are sitting around in a foreign network …

1. $namp 10.0.0.* - get all clients in your network
2. $nmap -p 3389 10.10.0.* -oG terminals.txt - get all machines with a open windows terminal, “oG” makes the output ~greppable~
3. $cat terminals.txt | grep open - just show lines with open ports …
4. $cat terminals.txt | grep open | cut -d ” ” -f 2 > openterminals.txt - … and cut the 2nd field = just IPs with open ports
5. $nmap -O 1L openterminals.txt - … get the OS of those
6. $nmap -sV -p 3389 10.10.0.180 - take a more detailed view on one of those client IPs