If the overall cyber security as well malware breach points you're all referring too, requires that of simple IP to IP connections, or LAN spreads, of ports which are not necessarily open at all times, but once either an active session on the server side either opens an/ the range of ports (that of a service, remote connection, etc) a user(s) could commit and xfer a payload of packets, resulting in an authorized login or command received and executed server side.
Take the very first step into account, the genesis of all basic data transmission, resulting with either a denial or OK verification result;
A) first request from client to server for a RDP connection via preset port
B) client-side receives either auth or denial packet(s), login or fail; that is a generic and basic use case
Inject C) Hypothetical session with A + B, but include a MITM attack vector. https://github.com/citronneur/rdpy
Justification: Rdpy is an open source python script that allows one to hijack windows RDP sessions and perform MITM attacks, to record communication and display actions performed on servers. This tool could not only perform the 'Man In The Middle' proxy functionality but also allows to run an RDP honeypot to make the attackers system run a fake RDP session.
Rdp Honeypot will set the daemon that you can use on the network for testing purposes or to detect suspicious activities such as worm attacks or any machine that is running brute force on the network. RDPY is fully implemented in python, except the bitmap decompression algorithm which is implemented in C for performance purposes, this provides a honeypot.
Inject D) Blockchain / Crypto integration hypothesis: If the RDP host on server-side is accessible via the desired and chosen port, then one would technically write something similar to that of an Dapp execution style call, or script. Where inherently, this would allow the client side initial request packet(s) to contain what the server-side/ Dapp listening daemon requires to then open the required port(s). The client side transmit an encrypted layer containing the proper authorization token(s)/ and or "coin(s)", of which are decrypted and then sequentially verified via the server-side blockchain that either a) the entire private server-side blockchain a precompiled set of scripts and pre-built modules, to allow for a pre-generated and auto-deployed token amount; which directly in turn is what the client-side genesis token based pool was spawned from
(We can go into this and how pre-set and pre-mined block ranges are how client transmits it's Auth pattens, but we won't for that if time's sake, and due to my thumbs on this qwerty phone keyboard are hurtin'.)
So, once the individual coin/ range of blocks, etc, are authorized on both sides ---> the Dapp variables and pre-written code, which have proper chmod access, can spawn many things server-side, from opening ports, load virtual machines, anything you can dream of.