search

GoSecure / pyrdp

RDP monster-in-the-middle (mitm) and library for Python with the ability to watch connections live or after the fact
https://www.gosecure.net/blog/2020/10/20/announcing-pyrdp-1/
GNU General Public License v3.0
1.55k stars 249 forks source link

The connection speed of pyrdp-mitm.py is very slow How to improve the connection speed? Rdpy is much faster than your pyrdp #162

Closed jiacheng9966 closed 4 years ago

jiacheng9966 commented 5 years ago

The connection speed of pyrdp-mitm.py is very slow How to improve the connection speed? Rdpy is much faster than your pyrdp

obilodeau commented 5 years ago

You don't give us enough information to properly answer to your question. It could be many reasons because there has been a ton of change in the codebase since we forked from RDPy.

The best way to help would be to provide a side-by-side profile of PyRDP and RDPy.

Here is how to profile a python application:

python -m cProfile -o pyrdp.prof bin/pyrdp-mitm.py <args>

Then redo another one for RDPy but saving to a different file and send us both files. Try to do similar actions during the RDP session and have a session of a similar duration.

alxbl commented 4 years ago

Hi @jiacheng9966, PyRDP uses raw bitmaps for video transfer, which requires much more bandwidth than clients using more efficient video transfer methods. We've started working on support for MS-RDPEGDI which is the RDP extension for supporting drawing orders, but this is still a while from being done.

In the meantime, there is a branch gdi-passthrough which adds an experimental --gdi command line option to pyrdp-mitm which should use the more efficient video transfer method. The only downside with this is that the pyrdp-player cannot currently decode this video, so you will get logs, clipboard, files, and payload functionality, but it will not be possible to hijack sessions or record the screen yet.

If you want to try the branch, I'd be very interested in hearing your feedback about the performance impact. Do note that this is still very experimental and untested, though.

EDIT: This should be fixed by #187 once it lands. If not, please re-open with more details as to which parts are slow and data to help us address the issue.