OK, to be clear, this is purely hypothetical and only for lab testing.

If a Windows Server only has port 3389 open, given that no remote code exploit for MS12-020 has yet to manifest itself, what are the available attack vectors? Brute force?

Thanks. 

I usually just try SMB because it's so much faster and uses the same account database. The only time I usually see RDP open when SMB isn't is for jump boxes, and those are usually configured to use multi-factor authentication, so there's no real point in trying a password-guessing attack.

If you can MitM with Cain, it'll try to drop the security level of the RDP session, and if successful, can capture RDP network communications in clear-text.