Rdp replayer

download Rdp replayer

of 24

  • date post

    06-Jul-2015
  • Category

    Engineering

  • view

    329
  • download

    8

Embed Size (px)

description

2010 Digital Forensic Seminar RDP replayer

Transcript of Rdp replayer

  • 1. 2010 Digital forensic seminar RDP Replayer @BoB jaemunks@gmail.com http://blog.naver.com/jaemunks

2. Challenge , D , xxx-xxxx-xxxx 100 , 010-xxxx-xxx , . . , . , . . 1. RC4 ? 2. ? 3. ? 4. () . 5. . 6. RDP replayer . 3. Challenge . : *.E01 : sample.pcap 2 . , PC . PCAP . PC PC D . 4. Challenge Wireshark PCAP . TCP . PCAP RDP . RC4 , Encryption . . 5. Challenge PC PC Windows XP . Truecrypt , D . RDP . 6. RDP(Remote Desktop Protocol) ? RDP client UI 7. RDP(Remote Desktop Protocol) ? . RDP . MS RDP Spec . http://msdn.microsoft.com/en-us/library/cc240919.aspx 8. RDP . . , . , . . , . . RDP . RDP client RDP server Encrypted data RDP(Remote Desktop Protocol) ? 9. RDP client RDP server RDP(Remote Desktop Protocol) ? e, n d S e, n S client = PC Server = PC e, n S C C C 1. 2. , S 10. RDP client RDP server RDP(Remote Desktop Protocol) ? e, n d S C client = PC Server = PC e, n S C Client Server S C . 11. RDP client RDP server RDP(Remote Desktop Protocol) ? S C client = PC Server = PC S C RC4 Keygen Source RC4 RC4 Keygen Source RC4 = 12. RDP(Remote Desktop Protocol) ? , . . . RC4 . 1. C S , 2. RSA . RC4 , . 13. RDP(Remote Desktop Protocol) ? . ( ) , ? - . , Hybrid . RDP Server PC Client PC , . , . RC4 ? - RDP Server PC Client PC . . , , UI . . . 14. Challenge -1 , 1 . Server PC = PC (, PC) , , . Wireshark . 15. Challenge -1 Sample.PCAP RDP . 1 2 . ServerSecurityData . ServerRandom ServerCertificate . . . 1 2 16. Challenge -1 1 Server Random . 2 Server . 1 2 17. Challenge -1 0c d7 35 28 ef dc b5 aa 73 e1 ed 3b 01 dc 85 b7 d6 f8 46 1e 83 7a 6f 4a cc d1 fa f9 92 90 e0 56 ServerRandom 1 2 b3 21 fb e4 20 0a 09 7a 33 a6 07 62 24 23 a3 5b c1 9f 78 01 f9 86 f9 cb 40 9d 92 ec d5 60 73 75 9f 7f 26 ce 11 14 5b e6 f8 b5 f2 bd 19 ca 57 c4 9a 2b 22 23 ba b0 a4 b2 23 16 49 54 c5 7e 92 d4 00 00 00 00 00 00 00 00 ServerCertificate ServerCertificate . , Wireshark ServerCertificate modulus . . http://msdn.microsoft.com/en-us/library/cc240919.aspx 18. Challenge -1 SecurityExchange . encryptedClientRandom -> . 19. Challenge -1 8c 2f 71 93 a2 ab e6 ce 93 de 3a d5 1e 9d 4c 95 92 cb 62 0e b7 af f3 46 99 53 c2 e8 3f 25 2f 7d b6 8d 17 d3 aa d0 65 b6 99 ca 0d 06 55 c8 ae 60 c7 11 2a bd b9 85 44 52 8f be b2 bc 16 73 53 01 00 00 00 00 00 00 00 00 EncryptedClientRandom Wireshark ServerRandom = S ServerCertificate = n, e EncryptedClientRandom = 3. 1 ? , RDP . 20. Challenge -1 RC4 S C . S . C . ? EncryptedClientRandom . Encrypted . . C ? . . , . 21. Challenge -1 . C . . . 2 . http://forensicinsight.org/wp-content/uploads/2013/02/F-INSIGHT-Summary-of- RDP-replayer.pdf http://www.oxid.it/downloads/rdp-gbu.pdf 2 URL RDP . . 22. Challenge -1 XP . HKEY_LOCAL_MACHINESECURITYPolicySecrets L$HYDRAENCKEY_28ada6da-d622-11d1-9cb9-00c04fb16e75 . , LSAdumperview , . . 23. Challenge -1 , . modulus e RSA , d . b1 2d 58 bb e9 5f df b1 79 76 55 c0 3c 74 9e f4 44 14 32 61 45 4d 99 5c 1f fd 8d 17 c9 7d 0d 5b 26 88 17 69 c7 4a 05 4b 01 32 6b e1 98 7c 67 5b a3 6e 11 89 e7 ef 4a 24 0e 68 5c e2 26 3c fe 9d ServerPrivateKey encryptedClientRandom . . RSA . RSA . = C = (EncryptedClientRandom) d = (ServerPrivateKey) N = modulus(ServerCertificate) P = (DecryptedClientRandom) 24. Challenge -1 DecryptedClientRandom . RSA . JAVA . RC4 , 2 . RC4 Keygen Source RC4 . Keygen Source Rdesktop generate key.c .