chapinb
commented
4 years ago I am also getting the error reported as item 5:
INFO: Connection from <ip>:1885
Unhandled Error
Traceback (most recent call last):
File "/usr/local/lib/python2.7/dist-packages/twisted/python/log.py", line 103, in callWithLogger
return callWithContext({"system": lp}, func, *args, **kw)
File "/usr/local/lib/python2.7/dist-packages/twisted/python/log.py", line 86, in callWithContext
return context.call({ILogContext: newCtx}, func, *args, **kw)
File "/usr/local/lib/python2.7/dist-packages/twisted/python/context.py", line 122, in callWithContext
return self.currentContext().callWithContext(ctx, func, *args, **kw)
File "/usr/local/lib/python2.7/dist-packages/twisted/python/context.py", line 85, in callWithContext
return func(*args,**kw)
--- <exception caught here> ---
File "/usr/local/lib/python2.7/dist-packages/twisted/internet/posixbase.py", line 614, in _doReadOrWrite
why = selectable.doRead()
File "/usr/local/lib/python2.7/dist-packages/twisted/internet/tcp.py", line 243, in doRead
return self._dataReceived(data)
File "/usr/local/lib/python2.7/dist-packages/twisted/internet/tcp.py", line 249, in _dataReceived
rval = self.protocol.dataReceived(data)
File "/usr/local/lib/python2.7/dist-packages/rdpy/core/layer.py", line 209, in dataReceived
self.recv(expectedData)
File "/usr/local/lib/python2.7/dist-packages/rdpy/protocol/rdp/tpkt.py", line 195, in readData
self._presentation.recv(data)
File "/usr/local/lib/python2.7/dist-packages/rdpy/protocol/rdp/x224.py", line 148, in recvData
self._presentation.recv(data)
File "/usr/local/lib/python2.7/dist-packages/rdpy/protocol/rdp/t125/mcs.py", line 542, in recvErectDomainRequest
raise InvalidExpectedDataException("Invalid MCS PDU : ERECT_DOMAIN_REQUEST expected")
rdpy.core.error.InvalidExpectedDataException: Invalid MCS PDU : ERECT_DOMAIN_REQUEST expectedI understand that some malformed traffic will be sent as a byproduct of port scanning/etc. but wanted to echo that this is in multiple environments. If anticipated, can we have a try/except that catches and prints that it is malformed (with detail?)
hackdefendr
citronneur
bontchev
lwtsao
d0nEgg1
ehmueller
I tried setting up an RDP honeypot using
rdpy-rdphoneypot.pybut it was an utter failure becauserdpy-rdphoneypot.pyis broken in multiple ways, essentially making it unusable.1) When connecting to the honeypot manually with a Windows 7 RDP client, it sort of works, in the sense that I am shown the recorded session. However, I am never asked for a password and no password is recorded in the log. Somebody has asked how to fix this problem in issue #93 but never got a reply.
2) When actual attackers connect to the honeypot, it seems that the RDP protocol is not quite compatible with theirs. As a result, the honeypot logs only the connection but no username, password, etc.:
3) Occasionally the honeypot crashes with the following error:
Issue #25 suggests that this happens when the attacking tool Hydra is used because of some kind of protocol incompatibility. Any chance of this problem being solved?
4) Occasionally the honeypot crashes with the following error:
Somebody has asked what it means in issue #66 but never got a reply.
5) Occasionally the honeypot crashes with the following error:
I have no idea what that means but it's probably again some kind of protocol incompatibility with some attacking tool.
Is there any chance of these problems ever getting fixed or should I give up on the idea of using this tool as an RDP honeypot?