3 ms·

Even nat won't save you. Most NAT assumes unlimited outbound 0.0.0.0/0 tcp/udp/icmp . Almost all configuration is that permissive. And I just need 1 packet to

• userbinator 7y ago
  NAT traversal is possible if you happen to be in control of the machines behind the NAT --- that's not very relevant here, since it requires running a special server on the machine you want to exploit (and if you can already do that, i.e. run code on the machine, then there's no point in exploiting RDP...) The scenario I'm referring to, and the one the article describes, is a remote attacker trying to connect to port 3389 of a machine behind a NAT --- without being able to already access the machine in the first place. In other words: you have a public IP X; there's a machine with private IP Y (which you don't know but may be able to guess easily) behind its NAT. No ports are forwarded. You have no access to the machine. How do you establish a connection to port 3389 (or for that matter, any other listening port) on it?
• upofadown 7y ago
  They probably meant to say that most were behind a firewall. NAT is not any sort of particular protection against anything. Because NAT almost always comes with a firewall there is a tendency to conflate the two things.