On a compromised system with SYSTEM privileges, an attacker can hijack existing RDP sessions without knowing the user's password: