Skip to content

Commit

Permalink
RDP: improve detection over UDP
Browse files Browse the repository at this point in the history
  • Loading branch information
@IvanNardi
IvanNardi committed Jul 12, 2023
1 parent 669a02c commit 5d78273
Show file tree
Hide file tree
Showing 7 changed files with 95 additions and 16 deletions.
56 changes: 42 additions & 14 deletions src/lib/protocols/rdp.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,9 @@

static void ndpi_int_rdp_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow) {
NDPI_LOG_INFO(ndpi_struct, "found RDP\n");
ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_RDP, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
ndpi_set_risk(ndpi_struct, flow, NDPI_DESKTOP_OR_FILE_SHARING_SESSION, "Found RDP"); /* Remote assistance */
}

static void ndpi_search_rdp(struct ndpi_detection_module_struct *ndpi_struct,
Expand All @@ -49,10 +51,7 @@ static void ndpi_search_rdp(struct ndpi_detection_module_struct *ndpi_struct,
&& get_u_int8_t(packet->payload, 4) == packet->payload_packet_len - 5
&& get_u_int8_t(packet->payload, 5) == 0xe0
&& get_u_int16_t(packet->payload, 6) == 0 && get_u_int16_t(packet->payload, 8) == 0 && get_u_int8_t(packet->payload, 10) == 0) {
NDPI_LOG_INFO(ndpi_struct, "found RDP\n");
rdp_found:
ndpi_int_rdp_add_connection(ndpi_struct, flow);
ndpi_set_risk(ndpi_struct, flow, NDPI_DESKTOP_OR_FILE_SHARING_SESSION, "Found RDP"); /* Remote assistance */
return;
}

Expand All @@ -61,33 +60,62 @@ static void ndpi_search_rdp(struct ndpi_detection_module_struct *ndpi_struct,
u_int16_t s_port = ntohs(packet->udp->source);
u_int16_t d_port = ntohs(packet->udp->dest);

/* Detection:
* initial syn/syn-ack pair for RDPUDP v1 & v2
* mid-flow (only v1) */

if((packet->payload_packet_len >= 10) && ((s_port == RDP_PORT) || (d_port == RDP_PORT))) {
if(s_port == RDP_PORT) {
/* Server -> Client */
if(flow->l4.udp.rdp_from_srv_pkts == 0)
memcpy(flow->l4.udp.rdp_from_srv, packet->payload, 3), flow->l4.udp.rdp_from_srv_pkts = 1;
else {
if(flow->l4.udp.rdp_from_srv_pkts == 0) {
if(memcmp(packet->payload, flow->l4.udp.rdp_from_srv, 3) == 0 &&
packet->payload_packet_len >= 16 &&
(ntohs(get_u_int16_t(packet->payload, 6)) & 0x0003) && /* Flags: syn-ack */
ntohs(get_u_int16_t(packet->payload, 12)) <= 1600 && /* Sensible values for upstream MTU */
ntohs(get_u_int16_t(packet->payload, 14)) <= 1600) { /* Sensible values for downstream MTU */
/* Initial "syn-ack" */
ndpi_int_rdp_add_connection(ndpi_struct, flow);
return;
} else {
/* Mid-flow session? */
memcpy(flow->l4.udp.rdp_from_srv, packet->payload, 3), flow->l4.udp.rdp_from_srv_pkts = 1;
}
} else {
if(memcmp(flow->l4.udp.rdp_from_srv, packet->payload, 3) != 0)
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
else {
flow->l4.udp.rdp_from_srv_pkts = 2 /* stage 2 */;

if(flow->l4.udp.rdp_to_srv_pkts == 2)
goto rdp_found;

if(flow->l4.udp.rdp_to_srv_pkts == 2) {
ndpi_int_rdp_add_connection(ndpi_struct, flow);
return;
}
}
}
} else {
/* Client -> Server */
if(flow->l4.udp.rdp_to_srv_pkts == 0)
memcpy(flow->l4.udp.rdp_to_srv, packet->payload, 3), flow->l4.udp.rdp_to_srv_pkts = 1;
else {
if(flow->l4.udp.rdp_to_srv_pkts == 0) {
if(get_u_int32_t(packet->payload, 0) == 0xFFFFFFFF &&
packet->payload_packet_len >= 16 &&
(ntohs(get_u_int16_t(packet->payload, 6)) & 0x0001) && /* Flags: syn */
ntohs(get_u_int16_t(packet->payload, 12)) <= 1600 && /* Sensible values for upstream MTU */
ntohs(get_u_int16_t(packet->payload, 14)) <= 1600) { /* Sensible values for downstream MTU */
/* Initial "syn" */
memcpy(flow->l4.udp.rdp_from_srv, packet->payload + 8, 3);
} else {
/* Mid-flow session? */
memcpy(flow->l4.udp.rdp_to_srv, packet->payload, 3), flow->l4.udp.rdp_to_srv_pkts = 1;
}
} else {
if(memcmp(flow->l4.udp.rdp_to_srv, packet->payload, 3) != 0)
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
else {
flow->l4.udp.rdp_to_srv_pkts = 2 /* stage 2 */;

if(flow->l4.udp.rdp_from_srv_pkts == 2)
goto rdp_found;
if(flow->l4.udp.rdp_from_srv_pkts == 2) {
ndpi_int_rdp_add_connection(ndpi_struct, flow);
return;
}
}
}
}
Expand Down
Binary file modified tests/cfgs/default/pcap/rdp.pcap
View file
Binary file not shown.
Binary file added tests/cfgs/default/pcap/rdp2.pcap
View file
Binary file not shown.
Binary file added tests/cfgs/default/pcap/rdp3.pcap
View file
Binary file not shown.
4 changes: 2 additions & 2 deletions tests/cfgs/default/result/rdp.pcap.out
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,6 @@ Patricia risk mask: 2/0 (search/found)
Patricia risk: 0/0 (search/found)
Patricia protocols: 2/0 (search/found)

RDP 2010 622743 1
RDP 20 3658 1

1 TCP 172.16.2.185:52494 <-> 192.168.2.142:3389 [proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 4][cat: RemoteAccess/12][936 pkts/58890 bytes <-> 1074 pkts/563853 bytes][Goodput ratio: 30/92][7.55 sec][bytes ratio: -0.811 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 6/5 850/850 40/38][Pkt Len c2s/s2c min/avg/max/stddev: 44/44 63/525 622/1317 44/511][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found RDP][PLAIN TEXT (192.168.2.142)][Plen Bins: 1,63,22,5,1,0,0,0,0,0,0,1,0,0,1,1,0,1,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0]
1 TCP 172.16.2.185:52494 <-> 192.168.2.142:3389 [proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 4][cat: RemoteAccess/12][13 pkts/1677 bytes <-> 7 pkts/1981 bytes][Goodput ratio: 64/84][0.37 sec][bytes ratio: -0.083 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/43 25/56 45/86 20/16][Pkt Len c2s/s2c min/avg/max/stddev: 44/56 129/283 616/1223 152/394][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found RDP][PLAIN TEXT (192.168.2.142)][Plen Bins: 16,16,16,16,0,8,0,0,0,8,0,0,0,0,0,0,0,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,8,0,0,0,0,0,0,0,0,0,0,0]
26 changes: 26 additions & 0 deletions tests/cfgs/default/result/rdp2.pcap.out
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
Guessed flow protos: 0

DPI Packets (UDP): 6 (3.00 pkts/flow)
Confidence DPI : 2 (flows)
Num dissector calls: 261 (130.50 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)
LRU cache tls_cert: 0/0/0 (insert/search/found)
LRU cache mining: 0/0/0 (insert/search/found)
LRU cache msteams: 0/0/0 (insert/search/found)
LRU cache stun_zoom: 0/0/0 (insert/search/found)
Automa host: 0/0 (search/found)
Automa domain: 0/0 (search/found)
Automa tls cert: 0/0 (search/found)
Automa risk mask: 0/0 (search/found)
Automa common alpns: 0/0 (search/found)
Patricia risk mask: 4/0 (search/found)
Patricia risk: 0/0 (search/found)
Patricia protocols: 4/0 (search/found)

RDP 33 6343 2

1 UDP 10.50.181.210:60355 <-> 10.50.73.36:3389 [VLAN: 1108][proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 2][cat: RemoteAccess/12][4 pkts/1907 bytes <-> 3 pkts/1468 bytes][Goodput ratio: 90/90][0.13 sec][bytes ratio: 0.130 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 4/7 41/48 80/90 31/42][Pkt Len c2s/s2c min/avg/max/stddev: 199/64 477/489 1278/1278 463/558][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found RDP][PLAIN TEXT (drcsalgfc)][Plen Bins: 14,0,14,0,28,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,28,0,0,0,0,0,0,0,0,0]
2 UDP 10.8.37.100:51652 <-> 10.100.2.87:3389 [VLAN: 1308][proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 4][cat: RemoteAccess/12][12 pkts/1418 bytes <-> 14 pkts/1550 bytes][Goodput ratio: 60/58][0.73 sec][bytes ratio: -0.044 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 80/65 428/261 140/94][Pkt Len c2s/s2c min/avg/max/stddev: 64/60 118/111 384/148 82/26][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found RDP][Plen Bins: 19,46,19,11,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
25 changes: 25 additions & 0 deletions tests/cfgs/default/result/rdp3.pcap.out
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
Guessed flow protos: 0

DPI Packets (UDP): 2 (2.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 112 (112.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)
LRU cache tls_cert: 0/0/0 (insert/search/found)
LRU cache mining: 0/0/0 (insert/search/found)
LRU cache msteams: 0/0/0 (insert/search/found)
LRU cache stun_zoom: 0/0/0 (insert/search/found)
Automa host: 0/0 (search/found)
Automa domain: 0/0 (search/found)
Automa tls cert: 0/0 (search/found)
Automa risk mask: 0/0 (search/found)
Automa common alpns: 0/0 (search/found)
Patricia risk mask: 2/0 (search/found)
Patricia risk: 0/0 (search/found)
Patricia protocols: 2/0 (search/found)

RDP 6 5028 1

1 UDP 192.168.122.181:54759 <-> 192.168.122.2:3389 [proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 2][cat: RemoteAccess/12][4 pkts/2694 bytes <-> 2 pkts/2334 bytes][Goodput ratio: 94/96][1.76 sec][bytes ratio: 0.072 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/1649 550/1649 1011/1649 418/0][Pkt Len c2s/s2c min/avg/max/stddev: 184/1060 674/1167 1274/1274 494/107][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found RDP][PLAIN TEXT (OKBI.HARDENING.COM)][Plen Bins: 0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0]

0 comments on commit 5d78273

Please sign in to comment.