WIP: Fake RDP server when NLA is enforced by spameier · Pull Request #426 · GoSecure/pyrdp

spameier · 2022-12-13T21:23:08Z

As part of a project at school, I extended the existing redirection functionality with a locally hosted RDP server. It works as follows:

A local RDP server is with a fake login screen and no authentication is launched (A Tkinter GUI with freerdp-shadow-cli inside Xephyr).
Once a user tries to connect to a NLA enforcing RDP server, the traffic is redirected to the fake login screen.
Once the user enters credentials, a rdp client (xfreerdp) is launched, replacing the fake login screen.
The user now sees the remote server through fake RDP server.

So far it's work in progress and has a lot of rough edges, but feedback would be very much appreciated.

Here's a quick demo:

Client: https://pixeldrain.com/u/K5m5dJwi
Kali: https://pixeldrain.com/u/c7U5jUbn

obilodeau

This is very interesting and in a direction I had never thought of. Great work! I would love to see it in action if you can provide a recorded session.

Missing:

Impact on dependencies outside of python (X11, TK, Fonts, freerdp-shadow-cli, xfreerdp)
Documentation
Handle TODOs and FIXMEs

obilodeau · 2022-12-16T18:07:50Z

pyrdp/mitm/RDPMITM.py

+        if self.state.isRedirected():
+            self.log.info(
+                "Fetching certificate of the original host %(host)s:%(port)d because of NLA redirection",
+                {
+                    "host": self.state.config.targetHost,
+                    "port": self.state.config.targetPort,
+                },
+            )
+            pem = ssl.get_server_certificate(
+                (self.state.config.targetHost, self.state.config.targetPort)
+            )
+            cert = crypto.load_certificate(crypto.FILETYPE_PEM, pem)
+        else:
+            cert = self.server.tcp.transport.getPeerCertificate()


There are issues with this code that are being looked at in #424

pyrdp/mitm/FakeServer.py

obilodeau · 2022-12-16T18:15:34Z

pyrdp/mitm/FakeServer.py

+        self.entry_password = Entry(
+            self.root,
+            show="•",
+            font=("Segoe UI", 20),


Does this add special dependencies?

Good point! I'm not sure honestly, it's certainly not on my Kali VM and I never exactly looked at it. Also I'm not a fonts expert 😄.

I'm switching to DejaVu Sans but that's not available on Windows I think. I also didn't find a way to only specify a font family (e. g. Sans Serif)..

pyrdp/mitm/FakeServer.py

spameier · 2022-12-17T00:06:10Z

I would love to see it in action if you can provide a recorded session.

Here's a quick demo:

Client: https://pixeldrain.com/u/K5m5dJwi
Kali: https://pixeldrain.com/u/c7U5jUbn

obilodeau · 2022-12-19T17:13:49Z

Thanks for the videos. It is a very interesting approach!

There are some things that I think would need to change. Among them, the clearest is the GUI popping up during the interception. I think the fake server should be headless with the option of using the pyrdp-player to listen to the connection just like with pyrdp when it is operating regularly. The reasoning is that a common attack scenario is to run this in a cloud instance or a Raspberry Pi and intercept many connections.

There are also CI build errors:

Not sure exactly how without checking but logging is pretty standard throughout pyrdp. It is either a singleton that can be pulled from everywhere or you can fetch it from an object easy to access. I don't think it is stored in the state.

spameier · 2022-12-19T19:21:37Z

Thanks for your feedback!

I think the fake server should be headless with the option of using the pyrdp-player to listen to the connection just like with pyrdp when it is operating regularly.

Yes, of course. Using Xephyr with the GUI is useful while testing and for demonstration purposes. Luckily pyvirtualdisplay already supports the headless Xvfb as a backend. I don't think it will give much trouble to change that and will look into it in the future.

The CI is currently failing because I added the getLog callback to RDPMITMState. I think that should be solved differently anyway.

otherwise checks whether fake server was configured or not fail

This reduces the error message an mstsc client sees from two to one. before: - The server name on the certificate is incorrect - The certificate is not from a trusted certifying authority after: - The certificate is not from a trusted certifying authority

spameier force-pushed the fake-server branch 2 times, most recently from 9f54176 to ecd5d15 Compare December 14, 2022 14:43

obilodeau requested changes Dec 16, 2022

View reviewed changes

obilodeau added this to the v1.3.0 milestone Dec 16, 2022

This comment was marked as outdated.

Sign in to view

spameier force-pushed the fake-server branch 2 times, most recently from dc7af31 to 0116006 Compare December 20, 2022 11:13

obilodeau mentioned this pull request Dec 20, 2022

Can I return the information after the client connection is completed #427

Closed

spameier force-pushed the fake-server branch from a248c27 to cad6d09 Compare December 21, 2022 18:40

spameier added 18 commits January 31, 2023 23:04

fake server: rebase onto master

fda7e08

fake server: only import FakeServer if it is actually needed

63794fb

fake server: fix paths

b94c988

fake server: implement logging

e23afd1

fake server: make target host and port dynamic

cfce354

fake server: remove logger from tcl widget

902c4f6

fake server: tidy imports

faf3b99

fake server: change font

93197fe

fake server: fix tests after adding logging to state

10c4b90

fake server: switch to headles Xvfb

cf2fb9a

fake server: improve logging

f6d9c91

fake server: fix leftover from background

9dd6447

fake server: reduce changes in log.py

aa19a3e

fake server: allow to set password

c698683

fake server: log output of subprocesses

bdbac80

fake server: change listen port to ephemeral range

3a4f6bd

fake server: automatically submit credentials if provided

4fd9bab

fake server: fix screen not initialized, add log terminating statement

93de680

spameier added 4 commits January 31, 2023 23:04

fake server: wait to become ready when setting username and password

9db0e34

fake server: set default config value for fake server

46e0131

otherwise checks whether fake server was configured or not fail

nla redirection: use certificate of original server

af39274

spameier force-pushed the fake-server branch from 5a118fe to af39274 Compare January 31, 2023 22:04

obilodeau modified the milestones: v1.3.0, v2.1.0 Dec 14, 2023

obilodeau modified the milestones: v2.1.0, v2.2.0 Jan 23, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

WIP: Fake RDP server when NLA is enforced#426

WIP: Fake RDP server when NLA is enforced#426
spameier wants to merge 22 commits intoGoSecure:mainfrom
spameier:fake-server

spameier commented Dec 13, 2022 •

edited

Loading

Uh oh!

obilodeau left a comment

Uh oh!

obilodeau Dec 16, 2022

Uh oh!

Uh oh!

Uh oh!

obilodeau Dec 16, 2022

Uh oh!

spameier Dec 17, 2022 •

edited

Loading

Uh oh!

spameier Dec 17, 2022

Uh oh!

Uh oh!

spameier commented Dec 17, 2022 •

edited

Loading

Uh oh!

obilodeau commented Dec 19, 2022

Uh oh!

spameier commented Dec 19, 2022

Uh oh!

This comment was marked as outdated.

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

spameier commented Dec 13, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

obilodeau left a comment

Choose a reason for hiding this comment

Uh oh!

obilodeau Dec 16, 2022

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

obilodeau Dec 16, 2022

Choose a reason for hiding this comment

Uh oh!

spameier Dec 17, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

spameier Dec 17, 2022

Choose a reason for hiding this comment

Uh oh!

Uh oh!

spameier commented Dec 17, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

obilodeau commented Dec 19, 2022

Uh oh!

spameier commented Dec 19, 2022

Uh oh!

This comment was marked as outdated.

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

spameier commented Dec 13, 2022 •

edited

Loading

spameier Dec 17, 2022 •

edited

Loading

spameier commented Dec 17, 2022 •

edited

Loading