Account moved to: https://gitlab.com/illwill
Metasploit Module to recover saved .rdp password credentials are encrypted using the CryptProtectData API from CRYPT32.DLL.The usage of CryptProtectData API means the encrypted password can be decrypted only by the user that created that .rdp file on the same machine.