GoSecure / pyrdp

RDP monster-in-the-middle (mitm) and library for Python with the ability to watch connections live or after the fact
https://www.gosecure.net/blog/2020/10/20/announcing-pyrdp-1/
GNU General Public License v3.0
1.5k stars 242 forks source link

Allow Extended Data Blocks in the ClientData and ServerData PDU #233

Open Res260 opened 4 years ago

Res260 commented 4 years ago

Right now, when receiving the clientData PDU (MCS connect initial, https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/db6713ee-1c0e-4064-a3b3-0fac30b4037b), PyRDP only parses the 3 required data blocks (clientCoreData, clientSecurityData, clientNetworkData) and one optionnal data block (clientClusterData).

However, more data blocks exist (see link above) such as one for multi-monitor support. This prevents more than one monitor to be used for an RDP connection through PyRDP which can reveal a MITM usage.

I worked a bit on this, I’ll submit a draft PR soon.

TODO:

obilodeau commented 3 years ago

We are planning to release 1.1.0 in the next month or so. Do you feel like working on this to make the cut or not?

Res260 commented 3 years ago

Probably not, it would require a lot of testing and require changes to a lot of parts on the code base. I might be overestimating the effort, though. If someone wants to work on it I can share what I did.

obilodeau commented 3 years ago

You can open a draft PR if you want but it's not a necessity since we are not going to work on this for 1.1.0. Thanks for the quick reply.