From 0c5a17accb509ff950829d50c2af0b031bcbe3a5 Mon Sep 17 00:00:00 2001 From: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> Date: Thu, 13 Jul 2023 10:50:13 +0200 Subject: RDP: improve detection over UDP (#2043) --- src/lib/protocols/rdp.c | 56 ++++++++++++++++++++++++-------- tests/cfgs/default/pcap/rdp.pcap | Bin 654927 -> 4002 bytes tests/cfgs/default/pcap/rdp2.pcap | Bin 0 -> 7632 bytes tests/cfgs/default/pcap/rdp3.pcap | Bin 0 -> 5148 bytes tests/cfgs/default/result/rdp.pcap.out | 4 +-- tests/cfgs/default/result/rdp2.pcap.out | 26 +++++++++++++++ tests/cfgs/default/result/rdp3.pcap.out | 25 ++++++++++++++ 7 files changed, 95 insertions(+), 16 deletions(-) create mode 100644 tests/cfgs/default/pcap/rdp2.pcap create mode 100644 tests/cfgs/default/pcap/rdp3.pcap create mode 100644 tests/cfgs/default/result/rdp2.pcap.out create mode 100644 tests/cfgs/default/result/rdp3.pcap.out diff --git a/src/lib/protocols/rdp.c b/src/lib/protocols/rdp.c index dfc47d72b..363f48628 100644 --- a/src/lib/protocols/rdp.c +++ b/src/lib/protocols/rdp.c @@ -33,7 +33,9 @@ static void ndpi_int_rdp_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { + NDPI_LOG_INFO(ndpi_struct, "found RDP\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_RDP, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); + ndpi_set_risk(ndpi_struct, flow, NDPI_DESKTOP_OR_FILE_SHARING_SESSION, "Found RDP"); /* Remote assistance */ } static void ndpi_search_rdp(struct ndpi_detection_module_struct *ndpi_struct, @@ -49,10 +51,7 @@ static void ndpi_search_rdp(struct ndpi_detection_module_struct *ndpi_struct, && get_u_int8_t(packet->payload, 4) == packet->payload_packet_len - 5 && get_u_int8_t(packet->payload, 5) == 0xe0 && get_u_int16_t(packet->payload, 6) == 0 && get_u_int16_t(packet->payload, 8) == 0 && get_u_int8_t(packet->payload, 10) == 0) { - NDPI_LOG_INFO(ndpi_struct, "found RDP\n"); - rdp_found: ndpi_int_rdp_add_connection(ndpi_struct, flow); - ndpi_set_risk(ndpi_struct, flow, NDPI_DESKTOP_OR_FILE_SHARING_SESSION, "Found RDP"); /* Remote assistance */ return; } @@ -61,33 +60,62 @@ static void ndpi_search_rdp(struct ndpi_detection_module_struct *ndpi_struct, u_int16_t s_port = ntohs(packet->udp->source); u_int16_t d_port = ntohs(packet->udp->dest); + /* Detection: + * initial syn/syn-ack pair for RDPUDP v1 & v2 + * mid-flow (only v1) */ + if((packet->payload_packet_len >= 10) && ((s_port == RDP_PORT) || (d_port == RDP_PORT))) { if(s_port == RDP_PORT) { /* Server -> Client */ - if(flow->l4.udp.rdp_from_srv_pkts == 0) - memcpy(flow->l4.udp.rdp_from_srv, packet->payload, 3), flow->l4.udp.rdp_from_srv_pkts = 1; - else { + if(flow->l4.udp.rdp_from_srv_pkts == 0) { + if(memcmp(packet->payload, flow->l4.udp.rdp_from_srv, 3) == 0 && + packet->payload_packet_len >= 16 && + (ntohs(get_u_int16_t(packet->payload, 6)) & 0x0003) && /* Flags: syn-ack */ + ntohs(get_u_int16_t(packet->payload, 12)) <= 1600 && /* Sensible values for upstream MTU */ + ntohs(get_u_int16_t(packet->payload, 14)) <= 1600) { /* Sensible values for downstream MTU */ + /* Initial "syn-ack" */ + ndpi_int_rdp_add_connection(ndpi_struct, flow); + return; + } else { + /* Mid-flow session? */ + memcpy(flow->l4.udp.rdp_from_srv, packet->payload, 3), flow->l4.udp.rdp_from_srv_pkts = 1; + } + } else { if(memcmp(flow->l4.udp.rdp_from_srv, packet->payload, 3) != 0) NDPI_EXCLUDE_PROTO(ndpi_struct, flow); else { flow->l4.udp.rdp_from_srv_pkts = 2 /* stage 2 */; - - if(flow->l4.udp.rdp_to_srv_pkts == 2) - goto rdp_found; + + if(flow->l4.udp.rdp_to_srv_pkts == 2) { + ndpi_int_rdp_add_connection(ndpi_struct, flow); + return; + } } } } else { /* Client -> Server */ - if(flow->l4.udp.rdp_to_srv_pkts == 0) - memcpy(flow->l4.udp.rdp_to_srv, packet->payload, 3), flow->l4.udp.rdp_to_srv_pkts = 1; - else { + if(flow->l4.udp.rdp_to_srv_pkts == 0) { + if(get_u_int32_t(packet->payload, 0) == 0xFFFFFFFF && + packet->payload_packet_len >= 16 && + (ntohs(get_u_int16_t(packet->payload, 6)) & 0x0001) && /* Flags: syn */ + ntohs(get_u_int16_t(packet->payload, 12)) <= 1600 && /* Sensible values for upstream MTU */ + ntohs(get_u_int16_t(packet->payload, 14)) <= 1600) { /* Sensible values for downstream MTU */ + /* Initial "syn" */ + memcpy(flow->l4.udp.rdp_from_srv, packet->payload + 8, 3); + } else { + /* Mid-flow session? */ + memcpy(flow->l4.udp.rdp_to_srv, packet->payload, 3), flow->l4.udp.rdp_to_srv_pkts = 1; + } + } else { if(memcmp(flow->l4.udp.rdp_to_srv, packet->payload, 3) != 0) NDPI_EXCLUDE_PROTO(ndpi_struct, flow); else { flow->l4.udp.rdp_to_srv_pkts = 2 /* stage 2 */; - if(flow->l4.udp.rdp_from_srv_pkts == 2) - goto rdp_found; + if(flow->l4.udp.rdp_from_srv_pkts == 2) { + ndpi_int_rdp_add_connection(ndpi_struct, flow); + return; + } } } } diff --git a/tests/cfgs/default/pcap/rdp.pcap b/tests/cfgs/default/pcap/rdp.pcap index 46b934027..59e3fa71c 100644 Binary files a/tests/cfgs/default/pcap/rdp.pcap and b/tests/cfgs/default/pcap/rdp.pcap differ diff --git a/tests/cfgs/default/pcap/rdp2.pcap b/tests/cfgs/default/pcap/rdp2.pcap new file mode 100644 index 000000000..3daa036f9 Binary files /dev/null and b/tests/cfgs/default/pcap/rdp2.pcap differ diff --git a/tests/cfgs/default/pcap/rdp3.pcap b/tests/cfgs/default/pcap/rdp3.pcap new file mode 100644 index 000000000..fe7921566 Binary files /dev/null and b/tests/cfgs/default/pcap/rdp3.pcap differ diff --git a/tests/cfgs/default/result/rdp.pcap.out b/tests/cfgs/default/result/rdp.pcap.out index a83e8d311..9afad188f 100644 --- a/tests/cfgs/default/result/rdp.pcap.out +++ b/tests/cfgs/default/result/rdp.pcap.out @@ -20,6 +20,6 @@ Patricia risk mask: 2/0 (search/found) Patricia risk: 0/0 (search/found) Patricia protocols: 2/0 (search/found) -RDP 2010 622743 1 +RDP 20 3658 1 - 1 TCP 172.16.2.185:52494 <-> 192.168.2.142:3389 [proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 4][cat: RemoteAccess/12][936 pkts/58890 bytes <-> 1074 pkts/563853 bytes][Goodput ratio: 30/92][7.55 sec][bytes ratio: -0.811 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 6/5 850/850 40/38][Pkt Len c2s/s2c min/avg/max/stddev: 44/44 63/525 622/1317 44/511][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found RDP][PLAIN TEXT (192.168.2.142)][Plen Bins: 1,63,22,5,1,0,0,0,0,0,0,1,0,0,1,1,0,1,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0] + 1 TCP 172.16.2.185:52494 <-> 192.168.2.142:3389 [proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 4][cat: RemoteAccess/12][13 pkts/1677 bytes <-> 7 pkts/1981 bytes][Goodput ratio: 64/84][0.37 sec][bytes ratio: -0.083 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/43 25/56 45/86 20/16][Pkt Len c2s/s2c min/avg/max/stddev: 44/56 129/283 616/1223 152/394][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found RDP][PLAIN TEXT (192.168.2.142)][Plen Bins: 16,16,16,16,0,8,0,0,0,8,0,0,0,0,0,0,0,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,8,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/rdp2.pcap.out b/tests/cfgs/default/result/rdp2.pcap.out new file mode 100644 index 000000000..7f5cce745 --- /dev/null +++ b/tests/cfgs/default/result/rdp2.pcap.out @@ -0,0 +1,26 @@ +Guessed flow protos: 0 + +DPI Packets (UDP): 6 (3.00 pkts/flow) +Confidence DPI : 2 (flows) +Num dissector calls: 261 (130.50 diss/flow) +LRU cache ookla: 0/0/0 (insert/search/found) +LRU cache bittorrent: 0/0/0 (insert/search/found) +LRU cache zoom: 0/0/0 (insert/search/found) +LRU cache stun: 0/0/0 (insert/search/found) +LRU cache tls_cert: 0/0/0 (insert/search/found) +LRU cache mining: 0/0/0 (insert/search/found) +LRU cache msteams: 0/0/0 (insert/search/found) +LRU cache stun_zoom: 0/0/0 (insert/search/found) +Automa host: 0/0 (search/found) +Automa domain: 0/0 (search/found) +Automa tls cert: 0/0 (search/found) +Automa risk mask: 0/0 (search/found) +Automa common alpns: 0/0 (search/found) +Patricia risk mask: 4/0 (search/found) +Patricia risk: 0/0 (search/found) +Patricia protocols: 4/0 (search/found) + +RDP 33 6343 2 + + 1 UDP 10.50.181.210:60355 <-> 10.50.73.36:3389 [VLAN: 1108][proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 2][cat: RemoteAccess/12][4 pkts/1907 bytes <-> 3 pkts/1468 bytes][Goodput ratio: 90/90][0.13 sec][bytes ratio: 0.130 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 4/7 41/48 80/90 31/42][Pkt Len c2s/s2c min/avg/max/stddev: 199/64 477/489 1278/1278 463/558][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found RDP][PLAIN TEXT (drcsalgfc)][Plen Bins: 14,0,14,0,28,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,28,0,0,0,0,0,0,0,0,0] + 2 UDP 10.8.37.100:51652 <-> 10.100.2.87:3389 [VLAN: 1308][proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 4][cat: RemoteAccess/12][12 pkts/1418 bytes <-> 14 pkts/1550 bytes][Goodput ratio: 60/58][0.73 sec][bytes ratio: -0.044 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 80/65 428/261 140/94][Pkt Len c2s/s2c min/avg/max/stddev: 64/60 118/111 384/148 82/26][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found RDP][Plen Bins: 19,46,19,11,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/rdp3.pcap.out b/tests/cfgs/default/result/rdp3.pcap.out new file mode 100644 index 000000000..38ea11883 --- /dev/null +++ b/tests/cfgs/default/result/rdp3.pcap.out @@ -0,0 +1,25 @@ +Guessed flow protos: 0 + +DPI Packets (UDP): 2 (2.00 pkts/flow) +Confidence DPI : 1 (flows) +Num dissector calls: 112 (112.00 diss/flow) +LRU cache ookla: 0/0/0 (insert/search/found) +LRU cache bittorrent: 0/0/0 (insert/search/found) +LRU cache zoom: 0/0/0 (insert/search/found) +LRU cache stun: 0/0/0 (insert/search/found) +LRU cache tls_cert: 0/0/0 (insert/search/found) +LRU cache mining: 0/0/0 (insert/search/found) +LRU cache msteams: 0/0/0 (insert/search/found) +LRU cache stun_zoom: 0/0/0 (insert/search/found) +Automa host: 0/0 (search/found) +Automa domain: 0/0 (search/found) +Automa tls cert: 0/0 (search/found) +Automa risk mask: 0/0 (search/found) +Automa common alpns: 0/0 (search/found) +Patricia risk mask: 2/0 (search/found) +Patricia risk: 0/0 (search/found) +Patricia protocols: 2/0 (search/found) + +RDP 6 5028 1 + + 1 UDP 192.168.122.181:54759 <-> 192.168.122.2:3389 [proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 2][cat: RemoteAccess/12][4 pkts/2694 bytes <-> 2 pkts/2334 bytes][Goodput ratio: 94/96][1.76 sec][bytes ratio: 0.072 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/1649 550/1649 1011/1649 418/0][Pkt Len c2s/s2c min/avg/max/stddev: 184/1060 674/1167 1274/1274 494/107][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found RDP][PLAIN TEXT (OKBI.HARDENING.COM)][Plen Bins: 0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0] -- cgit v1.2.3