Skip to content

Honeypot not playing the Recorded Session Scenario (RSS) #69

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ner00 opened this issue Apr 1, 2018 · 0 comments
Closed

Honeypot not playing the Recorded Session Scenario (RSS) #69

ner00 opened this issue Apr 1, 2018 · 0 comments

Comments

@ner00
Copy link

ner00 commented Apr 1, 2018

I get the following error from the client when connecting to the honeypot:

Because of a protocol error, this session will be disconnected. Please try connecting to the remote computer again.

First, I used rdpy-rdpmitm.py to run the MITM server and record the RSS file:
root@root:~# rdpy-rdpmitm.py -o /root/rss/ 192.168.0.100

This recorded 2 files:

20180401215207_192.168.0.100_1.rss
20180401215208_192.168.0.100_2.rss

The first one has only 10KB and the second has 7MB. The 10KB file was not accepted by the honeypot as argument, but the 2nd file is accepted.

So, I tried using the second recorded session file with the honeypot:

root@root:~# rdpy-rdphoneypot.py /root/rss/20180401215208_192.168.0.100_2.rss
[*] INFO:	Build size map
[*] INFO:	(1920, 1080) -> /root/rss/20180401215208_192.168.0.100_2.rss

But then, when I connect a client to the honeypot, it gets disconnected with the following error (client side):

Because of a protocol error, this session will be disconnected. Please try connecting to the remote computer again.

On the honeypot console I get the following:

[*] INFO:	Connection from 192.168.0.100:24664
[*] INFO:	Connection from 192.168.0.100:24665
[*] INFO:	select file (1920, 1080) -> /root/rss/20180401215208_192.168.0.100_2.rss
[*] INFO:	Credentials:
		domain:
		username:
		password:
		hostname: DESKTOP-ASJ3R1

[*] INFO:	Credentials:
		domain:
		username:
		password:
		hostname: DESKTOP-ASJ3R1

What am I doing wrong?

@ner00 ner00 changed the title Honeypot not playing the recorded session scenario (RSS) Honeypot not playing the Recorded Session Scenario (RSS) Apr 1, 2018
@ner00 ner00 closed this as completed Jan 12, 2021
evanzhou2000 added a commit to evanzhou2000/rdpy that referenced this issue Jun 28, 2021
…nario (RSS)

* this bug is caused by the setColorDepth not be recorded. so it still try to show 32bit image on a 16bit screen!
evanzhou2000 added a commit to evanzhou2000/rdpy that referenced this issue Jun 28, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant