ctxis / rdp-replay Goto Github PK
View Code? Open in Web Editor NEWReplay RDP traffic from PCAP
License: Apache License 2.0
Replay RDP traffic from PCAP
License: Apache License 2.0
RDP REPLAY ========== Contents ======== extractrdpkeys/ Source and binaries for extracting RDP keys from DPAPI libfree_rdp/ Original library circa 2013 README You found this already! test/ Test samples and instructions Makefile Top level make file replay/ Source directory for the replay tool tools/ Other support software ============================================================================= Usage ===== $ rdp_replay -h Usage: rdp_replay <options> -h Help. You're reading it! -l <lsa_secrets_file> File containing LSA secrets for RDP decryption -L <lsa_raw_secret> File containing a single binary LSA secret -o <output_file> Output video file (e.g. "rdp.avi") -p <rsa_priv_file> PEM file with SSL key (can be repeated) -r <pcap_file> The pcap file (default is stdin) -t <port> The TCP port to select in the pcap (default: any) -x <num> Playback tcp stream at <num> times realtime --clipboard_16le Clipboard is assumed to be UTF16le and stripped back up 8-bit --debug_chan Show channel messages --debug_caps Show capabilities messages --fullspeed Playback tcp stream at full-speed --help Help. You're still reading it! --no_cksum Don't check the packet (IP and TCP) checksums --no_cursor Don't show the cursor --realtime Playback tcp stream in realtime --reverse Reverse client/server direction (sometimes useful for extracted data) --save_clipboard Save clipboard events to file (e.g. "clip-00000000-up") --show_time Display packet capture time --show_keys Display keypress (repeat for verbose) --sound Play sounds --rdprd Display RDPDR channel requests --sw Use SW_GDI for rendering (not recommended) Simple example: $ rdp_replay -l RC4priv.txt -r capture.pcap ============================================================================= Building ========= These instructions are for building on Ubuntu 14.04. This package contains the LibfreeRDP package and the enhancements for the replay tool. Once dependencies are met, run make. The following line (run as root) should install all required packages. # apt-get install -y build-essential git-core cmake libssl-dev libx11-dev libxext-dev libxinerama-dev libxcursor-dev libxdamage-dev libxv-dev libxkbfile-dev libasound2-dev libcups2-dev libxml2 libxml2-dev libxrandr-dev libgstreamer0.10-dev libgstreamer-plugins-base0.10-dev libavutil-dev libavcodec-dev libavformat-dev libpcap-dev libreadline-dev Once these are installed, run make. This will (hopefully) produce ./replay/rdp_replay ============================================================================= Private Keys: There is a blog post available online (http://www.contextis.com/blog/rdp-replay/) that covers extracting RDP keys in some detail. Old style RC4 keys should be put in a file of the form: # Comment lines start with # # Blank lines are ignored <name>,<public_key>,<private_key> An example: Example_RC4,5253413148000000000200003f00000001000100edf118339e6cf30888cad52a43921547e3ce962eb3639785dc2433588a8c89e21606c2394095d8c4816045818e007d26178ff5c79d7a461b03836bdf6660dabd0000000000000000,81e95dd837c1adc5a68202cfa7d01d9fae10c99f690acdc458bd76de3cdc9d7f1e31d1c0ad2fa89b8433735c5dce29d7126041d62cad3f70a7248c60e9488239 These RC4 key files are specified on the command line. SSL private keys (PEM files) are specified directly on the command line. ============================================================================= LSA secrets: Private keys for RDP services (pre Vista) are stored as LSA secrets. There is a simple program available (from passcape) to read them. Example: C:\>LsaSecretReader.exe L$HYDRAENCKEY_28ada6da-d622-11d1-9cb9-00c04fb16e75 ====================================================== = LSA secret reader by Passcape Software = = Visit http://www.passcape.com for more information = ====================================================== 0000: 52 53 41 32 48 00 00 00 00 02 00 00 3F 00 00 00 0010: 01 00 01 00 ED F1 18 33 9E 6C F3 08 88 CA D5 2A 0020: 43 92 15 47 E3 CE 96 2E B3 63 97 85 DC 24 33 58 0030: 8A 8C 89 E2 16 06 C2 39 40 95 D8 C4 81 60 45 81 0040: 8E 00 7D 26 17 8F F5 C7 9D 7A 46 1B 03 83 6B DF 0050: 66 60 DA BD 00 00 00 00 00 00 00 00 C5 2E C2 9A 0060: CD 5C 85 91 09 37 C7 45 A8 76 C3 9F E8 AD D6 D6 0070: 21 2B 44 FF 9A 5B 99 70 62 88 24 ED 00 00 00 00 0080: 09 E9 24 CA 37 F3 88 DE B2 E5 02 BF F7 4B E9 C2 0090: 0C 28 D3 D8 40 72 6F 49 D2 CC E6 D3 62 2D F3 CC 00A0: 00 00 00 00 CD 0B 24 05 48 0A CA A0 F6 54 5B 32 00B0: A2 0F 3F AB EC 2A DF C9 BD D7 FB BE C0 D1 E6 CA 00C0: 25 5A C5 E3 00 00 00 00 B9 D7 FD 7F EB AB EF D5 00D0: 57 10 F0 6C F5 76 9B 79 9E 91 E3 D4 7F C7 74 71 00E0: C1 C7 2E 67 B3 DE 49 17 00 00 00 00 3B 44 55 4B 00F0: 46 21 AC 8F 38 A6 A8 A5 D7 06 31 0D 2A DA D1 D6 0100: E4 2C ED D9 4F A4 D3 6D 35 E4 54 06 00 00 00 00 0110: 81 E9 5D D8 37 C1 AD C5 A6 82 02 CF A7 D0 1D 9F 0120: AE 10 C9 9F 69 0A CD C4 58 BD 76 DE 3C DC 9D 7F 0130: 1E 31 D1 C0 AD 2F A8 9B 84 33 73 5C 5D CE 29 D7 0140: 12 60 41 D6 2C AD 3F 70 A7 24 8C 60 E9 48 82 39 0150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0170: 00 00 00 00 00 00 00 00 00 00 00 00 This gives public key of: 52 53 41 31 48 00 00 00 00 02 00 00 3f 00 00 00 01 00 01 00 ed f1 18 33 9e 6c f3 08 88 ca d5 2a 43 92 15 47 e3 ce 96 2e b3 63 97 85 dc 24 33 58 8a 8c 89 e2 16 06 c2 39 40 95 d8 c4 81 60 45 81 8e 00 7d 26 17 8f f5 c7 9d 7a 46 1b 03 83 6b df 66 60 da bd 00 00 00 00 00 00 00 00 ..and private key of 81 e9 5d d8 37 c1 ad c5 a6 82 02 cf a7 d0 1d 9f ae 10 c9 9f 69 0a cd c4 58 bd 76 de 3c dc 9d 7f 1e 31 d1 c0 ad 2f a8 9b 84 33 73 5c 5d ce 29 d7 12 60 41 d6 2c ad 3f 70 a7 24 8c 60 e9 48 82 39 NOTE: The public part of the key (from LsaSecret) starts "RSA2", but it will be "RSA1" when transmitted as public-only, in the secure exchange. You can see this easily in wireshark. How to extract the 2 available keys is shown below: LsaSecretReader.exe L$HYDRAENCKEY_28ada6da-d622-11d1-9cb9-00c04fb16e75 LsaSecretReader.exe L$HYDRAENCKEY_52d1ad03-4565-44f3-8bfd-bbb0591f4b9d ============================================================================= For SSL (Cert) based: You need mimikatz and psexec (SysInternals) Mimikatz as system: (psexec -s mimicatz.exe) privilege::debug crypto::patchcapi crypto::patchcng crypto::exportCertificates CERT_SYSTEM_STORE_LOCAL_MACHINE "Remote Desktop" This will produce a .pfx file (probably in the current directory or the one containing mimikatz.exe) Break the private key out of the pfx (windows) file: $ openssl pkcs12 -in file.pfx -nodes -out x509.pem Use password: mimikatz Get out the x509 private key. If you want to view a x509 PEM private key: $ openssl rsa -noout -in x509.pem -text
More info on How to get RDP-Replay to work in Production.
I have two issue.
Would you like to add more error handling for return values from functions like the following?
I have successfully extracted RDP certificate as long as RDP keys
When I run rdp replay, nothing shows up
%> ./rdp_replay --show_keys -r rdp.pcap -L L\$HYDRAENCKEY_28ada6da-d622-11d1-9cb9-00c04fb16e75.bin -p x509.pem
Processed private key from L$HYDRAENCKEY_28ada6da-d622-11d1-9cb9-00c04fb16e75.bin
RDP SSL MODE Requested by server!!
SSL private key found.
The server is a Windows 7 machine.
To record RDP traffic, I've tested both mstsc
on a Windows 8 client and rdesktop
on Ubuntu 16.04, both showing the same result
Can you help? Attached all keys & rdp traffic
https://raw.githubusercontent.com/CaledoniaProject/rdp-test/master/test.tar.bz2
I would like to point out that identifiers like "__pcap_delay_h__
" and "__ssl_decrypt_h__
" do not fit to the expected naming convention of the C++ language standard.
Would you like to adjust your selection for unique names?
After following the instructions provided in the below links to extract SSL private key from the server, I have still been unable to decrypt my captured RDP sessions which used TLS 1.1 (and others using TLS 1.2):
https://github.com/FreeRDP/FreeRDP/wiki/Mimikatz and https://github.com/ctxis/RDP-Replay ...
$ ./rdp_replay -r mypacketcapture.pcap -p myserver.key
RDP SSL MODE Requested by server!!
SSL private key found.
SSL-ERROR: RSA private key decrypt failed
In wireshark, some sessions I see are using TLS 1.1 and other TLS 1.2.... I'm confident that I have obtained the correct SSL private key from the server... Any assistance would be greatly appreciated!
Hi,
I'm trying to convert the attached pcap files using this command:
replay/rdp_replay -r test3/compat.pcap -L test3/key.bin --no_cksum
When I run rdp_replay I see the following message on the screen:
Processed private key from key.bin
But nothing happens. Am I doing something wrong?
Thanks,
Gabriel
I expect that exception handling is usually supported by a C++ program. I wonder why your function "main" does not contain corresponding try and catch instructions so far.
How do you think about recommendations by Matthew Wilson in an article?
Would you like to adjust the implementation if you consider effects for uncaught/unhandled exceptions like they are described by Danny Kalev?
Well let me explain you the steps that I followed one by one;
In Windows 7 Enterprise Service Pack 1 32 bit, I ran cmd.exe as an Administrator and then ran mimikatz.exe with psexec -s parameter with folowing commands as shown below.
C:\Users\IEUser\Desktop\Win32>PsExec.exe -s C:\Users\IEUser\Desktop\win32\mimika
tz.exe
PsExec v2.11 - Execute processes remotely
Copyright (C) 2001-2014 Mark Russinovich
Sysinternals - www.sysinternals.com
mimikatz 1.0 x86 (RC) /* Traitement du Kiwi (Aug 26 2012 12:48:16) */
// http://blog.gentilkiwi.com/mimikatz
mimikatz # privilege::debug
Demande d'ACTIVATION du privilège : SeDebugPrivilege : OK
mimikatz # crypto::patchcapi
Patterns CRYPT_EXPORTABLE | CRYPT_ARCHIVABLE et CRYPT_ARCHIVABLE trouvés !
Patch CRYPT_EXPORTABLE | CRYPT_ARCHIVABLE : OK
Patch CRYPT_ARCHIVABLE : OK
mimikatz # crypto::patchcng
Service : CNG Key Isolation
Recherche des patterns dans : ncrypt.dll@pid(476)
Patch ncrypt.dll@pid(476) : OK
mimikatz # crypto::exportCertificates CERT_SYSTEM_STORE_LOCAL_MACHINE "Remote De
sktop"
Emplacement : 'CERT_SYSTEM_STORE_LOCAL_MACHINE'\Remote Desktop
Then I installed Win32OpenSSL-1_0_2h on Windows 7 and then converted pfx to pem.
C:\OpenSSL-Win32\bin>openssl pkcs12 -in "CERT_SYSTEM_STORE_LOCAL_MACHINE_Remote
Desktop_0_IE10Win7.pfx" -nodes -out x509.pem
WARNING: can't open config file: /usr/local/ssl/openssl.cnf
Enter Import Password:
MAC verified OK
Then I installed Wireshark-win32-2.0.4 to Windows 7, sniffed the traffic with filter "tcp.port == 3389" and then connected to that Windows 7 from Windows 8.1 via RDP (mstsc).
Then I copied sniffed traffic (Wireshark - save as - Wireshark/tcpdump - rdp.pcap) to Ubuntu 14.04 (which I successfully played your demo1.pcap) with the x509.pem of Windows 7 and then tried to play with rdp_replay.
root@ubuntu:/Desktop/RDP-Replay-master/replay# ./rdp_replay -r rdp.pcap -p x509.pem --no_cksum/Desktop/RDP-Replay-master/replay#
root@ubuntu:
It shows nothing. So any idea which step is wrong ? If you'd like to get pcap, pem file and pfx, I can send it to you.
Regards,
Good day!
After the installation, where all required packages were downloaded (with the help of command line string in "Building") I`ve tried to build your application via command "make", but faced the issue, presented below
Could you please help me to build the application or give it to me in order to use it
RDP-Replay is such a clever integration of open source products. It strikes me that it could be a useful jumping off point to investigate, profile and analyse the interactions between Windows MSTSC and "xrdp". Is it possible to map between the LSA Secrets style key entries and the rsakeys.ini format?
Hi ,
Trying to work with the rdp_replay tool , i have set up a demo environment with a server and 1 client. I have recorded my session using tcpdump and i am able to open the file and decrypt it using the key under wireshark dissector.
In wireshark i can see i am using TLS 1.2 ->
CipherSUITE - TLS_RSA_WITH_AES_128_CBC_SHA256.
I can also follow ssl stream in wireshark.
yet the rdp_replay gives me the following output:
RDP SSL MODE Requested by server!!
SSL private key found.
SSL: Decrypt failed
any help will be appriciated
Hello,
Do you think that it would be possible to compile it for Windows, under cygwin or VS ?
Anyway, thank you for that awesome tool.
Cheers!
Hello,
I am having difficulties playing pcap file with RDP Replay tool on Ubuntu 14.04.
I extracted certificate with mimikatz from Windows 7 and also extracted LSA keys with extractrdpkeys.x86.exe.
Neither -p x509.pem nor -L HYDRAENC key works. It says;
./rdp_replay -r ../../rdp6.pcap -L ../../L$HYDRAENCKEY_28ada6da-d622-11d1-9cb9-00c04fb16e75.bin Processed private key from L$HYDRAENCKEY_28ada6da-d622-11d1-9cb9-00c04fb16e75.bin
RDP SSL MODE Requested by server!!
SSL-ERROR: No matching private key found
./rdp_replay -r ../../rdp3.pcap -p ../../outfile.pem --no_cksum
RDP SSL MODE Requested by server!!
SSL private key found.
SSL-ERROR: RSA private key decrypt failed
I am not sure what is wrong with it and in order to verify my steps, could you share your demo1.pem and demo1.pcap please because Test folder does not exist in your folder.
Regards,
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.