Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

RDP: improve detection over UDP #2043

Merged
merged 1 commit into from
Jul 13, 2023
Merged

RDP: improve detection over UDP #2043

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 42 additions & 14 deletions src/lib/protocols/rdp.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,9 @@

static void ndpi_int_rdp_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow) {
NDPI_LOG_INFO(ndpi_struct, "found RDP\n");
ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_RDP, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
ndpi_set_risk(ndpi_struct, flow, NDPI_DESKTOP_OR_FILE_SHARING_SESSION, "Found RDP"); /* Remote assistance */
}

static void ndpi_search_rdp(struct ndpi_detection_module_struct *ndpi_struct,
Expand All @@ -49,10 +51,7 @@ static void ndpi_search_rdp(struct ndpi_detection_module_struct *ndpi_struct,
&& get_u_int8_t(packet->payload, 4) == packet->payload_packet_len - 5
&& get_u_int8_t(packet->payload, 5) == 0xe0
&& get_u_int16_t(packet->payload, 6) == 0 && get_u_int16_t(packet->payload, 8) == 0 && get_u_int8_t(packet->payload, 10) == 0) {
NDPI_LOG_INFO(ndpi_struct, "found RDP\n");
rdp_found:
ndpi_int_rdp_add_connection(ndpi_struct, flow);
ndpi_set_risk(ndpi_struct, flow, NDPI_DESKTOP_OR_FILE_SHARING_SESSION, "Found RDP"); /* Remote assistance */
return;
}

Expand All @@ -61,33 +60,62 @@ static void ndpi_search_rdp(struct ndpi_detection_module_struct *ndpi_struct,
u_int16_t s_port = ntohs(packet->udp->source);
u_int16_t d_port = ntohs(packet->udp->dest);

/* Detection:
* initial syn/syn-ack pair for RDPUDP v1 & v2
* mid-flow (only v1) */

if((packet->payload_packet_len >= 10) && ((s_port == RDP_PORT) || (d_port == RDP_PORT))) {
if(s_port == RDP_PORT) {
/* Server -> Client */
if(flow->l4.udp.rdp_from_srv_pkts == 0)
memcpy(flow->l4.udp.rdp_from_srv, packet->payload, 3), flow->l4.udp.rdp_from_srv_pkts = 1;
else {
if(flow->l4.udp.rdp_from_srv_pkts == 0) {
if(memcmp(packet->payload, flow->l4.udp.rdp_from_srv, 3) == 0 &&
packet->payload_packet_len >= 16 &&
(ntohs(get_u_int16_t(packet->payload, 6)) & 0x0003) && /* Flags: syn-ack */
ntohs(get_u_int16_t(packet->payload, 12)) <= 1600 && /* Sensible values for upstream MTU */
ntohs(get_u_int16_t(packet->payload, 14)) <= 1600) { /* Sensible values for downstream MTU */
/* Initial "syn-ack" */
ndpi_int_rdp_add_connection(ndpi_struct, flow);
return;
} else {
/* Mid-flow session? */
memcpy(flow->l4.udp.rdp_from_srv, packet->payload, 3), flow->l4.udp.rdp_from_srv_pkts = 1;
}
} else {
if(memcmp(flow->l4.udp.rdp_from_srv, packet->payload, 3) != 0)
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
else {
flow->l4.udp.rdp_from_srv_pkts = 2 /* stage 2 */;

if(flow->l4.udp.rdp_to_srv_pkts == 2)
goto rdp_found;

if(flow->l4.udp.rdp_to_srv_pkts == 2) {
ndpi_int_rdp_add_connection(ndpi_struct, flow);
return;
}
}
}
} else {
/* Client -> Server */
if(flow->l4.udp.rdp_to_srv_pkts == 0)
memcpy(flow->l4.udp.rdp_to_srv, packet->payload, 3), flow->l4.udp.rdp_to_srv_pkts = 1;
else {
if(flow->l4.udp.rdp_to_srv_pkts == 0) {
if(get_u_int32_t(packet->payload, 0) == 0xFFFFFFFF &&
packet->payload_packet_len >= 16 &&
(ntohs(get_u_int16_t(packet->payload, 6)) & 0x0001) && /* Flags: syn */
ntohs(get_u_int16_t(packet->payload, 12)) <= 1600 && /* Sensible values for upstream MTU */
ntohs(get_u_int16_t(packet->payload, 14)) <= 1600) { /* Sensible values for downstream MTU */
/* Initial "syn" */
memcpy(flow->l4.udp.rdp_from_srv, packet->payload + 8, 3);
} else {
/* Mid-flow session? */
memcpy(flow->l4.udp.rdp_to_srv, packet->payload, 3), flow->l4.udp.rdp_to_srv_pkts = 1;
}
} else {
if(memcmp(flow->l4.udp.rdp_to_srv, packet->payload, 3) != 0)
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
else {
flow->l4.udp.rdp_to_srv_pkts = 2 /* stage 2 */;

if(flow->l4.udp.rdp_from_srv_pkts == 2)
goto rdp_found;
if(flow->l4.udp.rdp_from_srv_pkts == 2) {
ndpi_int_rdp_add_connection(ndpi_struct, flow);
return;
}
}
}
}
Expand Down
Binary file modified tests/cfgs/default/pcap/rdp.pcap
View file
Open in desktop
Binary file not shown.
Binary file added tests/cfgs/default/pcap/rdp2.pcap
View file
Open in desktop
Binary file not shown.
Binary file added tests/cfgs/default/pcap/rdp3.pcap
View file
Open in desktop
Binary file not shown.
4 changes: 2 additions & 2 deletions tests/cfgs/default/result/rdp.pcap.out
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,6 @@ Patricia risk mask: 2/0 (search/found)
Patricia risk: 0/0 (search/found)
Patricia protocols: 2/0 (search/found)

RDP 2010 622743 1
RDP 20 3658 1

1 TCP 172.16.2.185:52494 <-> 192.168.2.142:3389 [proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 4][cat: RemoteAccess/12][936 pkts/58890 bytes <-> 1074 pkts/563853 bytes][Goodput ratio: 30/92][7.55 sec][bytes ratio: -0.811 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 6/5 850/850 40/38][Pkt Len c2s/s2c min/avg/max/stddev: 44/44 63/525 622/1317 44/511][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found RDP][PLAIN TEXT (192.168.2.142)][Plen Bins: 1,63,22,5,1,0,0,0,0,0,0,1,0,0,1,1,0,1,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0]
1 TCP 172.16.2.185:52494 <-> 192.168.2.142:3389 [proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 4][cat: RemoteAccess/12][13 pkts/1677 bytes <-> 7 pkts/1981 bytes][Goodput ratio: 64/84][0.37 sec][bytes ratio: -0.083 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/43 25/56 45/86 20/16][Pkt Len c2s/s2c min/avg/max/stddev: 44/56 129/283 616/1223 152/394][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found RDP][PLAIN TEXT (192.168.2.142)][Plen Bins: 16,16,16,16,0,8,0,0,0,8,0,0,0,0,0,0,0,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,8,0,0,0,0,0,0,0,0,0,0,0]
26 changes: 26 additions & 0 deletions tests/cfgs/default/result/rdp2.pcap.out
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
Guessed flow protos: 0

DPI Packets (UDP): 6 (3.00 pkts/flow)
Confidence DPI : 2 (flows)
Num dissector calls: 261 (130.50 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)
LRU cache tls_cert: 0/0/0 (insert/search/found)
LRU cache mining: 0/0/0 (insert/search/found)
LRU cache msteams: 0/0/0 (insert/search/found)
LRU cache stun_zoom: 0/0/0 (insert/search/found)
Automa host: 0/0 (search/found)
Automa domain: 0/0 (search/found)
Automa tls cert: 0/0 (search/found)
Automa risk mask: 0/0 (search/found)
Automa common alpns: 0/0 (search/found)
Patricia risk mask: 4/0 (search/found)
Patricia risk: 0/0 (search/found)
Patricia protocols: 4/0 (search/found)

RDP 33 6343 2

1 UDP 10.50.181.210:60355 <-> 10.50.73.36:3389 [VLAN: 1108][proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 2][cat: RemoteAccess/12][4 pkts/1907 bytes <-> 3 pkts/1468 bytes][Goodput ratio: 90/90][0.13 sec][bytes ratio: 0.130 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 4/7 41/48 80/90 31/42][Pkt Len c2s/s2c min/avg/max/stddev: 199/64 477/489 1278/1278 463/558][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found RDP][PLAIN TEXT (drcsalgfc)][Plen Bins: 14,0,14,0,28,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,28,0,0,0,0,0,0,0,0,0]
2 UDP 10.8.37.100:51652 <-> 10.100.2.87:3389 [VLAN: 1308][proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 4][cat: RemoteAccess/12][12 pkts/1418 bytes <-> 14 pkts/1550 bytes][Goodput ratio: 60/58][0.73 sec][bytes ratio: -0.044 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 80/65 428/261 140/94][Pkt Len c2s/s2c min/avg/max/stddev: 64/60 118/111 384/148 82/26][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found RDP][Plen Bins: 19,46,19,11,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
25 changes: 25 additions & 0 deletions tests/cfgs/default/result/rdp3.pcap.out
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
Guessed flow protos: 0

DPI Packets (UDP): 2 (2.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 112 (112.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)
LRU cache tls_cert: 0/0/0 (insert/search/found)
LRU cache mining: 0/0/0 (insert/search/found)
LRU cache msteams: 0/0/0 (insert/search/found)
LRU cache stun_zoom: 0/0/0 (insert/search/found)
Automa host: 0/0 (search/found)
Automa domain: 0/0 (search/found)
Automa tls cert: 0/0 (search/found)
Automa risk mask: 0/0 (search/found)
Automa common alpns: 0/0 (search/found)
Patricia risk mask: 2/0 (search/found)
Patricia risk: 0/0 (search/found)
Patricia protocols: 2/0 (search/found)

RDP 6 5028 1

1 UDP 192.168.122.181:54759 <-> 192.168.122.2:3389 [proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 2][cat: RemoteAccess/12][4 pkts/2694 bytes <-> 2 pkts/2334 bytes][Goodput ratio: 94/96][1.76 sec][bytes ratio: 0.072 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/1649 550/1649 1011/1649 418/0][Pkt Len c2s/s2c min/avg/max/stddev: 184/1060 674/1167 1274/1274 494/107][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found RDP][PLAIN TEXT (OKBI.HARDENING.COM)][Plen Bins: 0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0]
Loading