Open
Description
Right now, when the user connects to an NLA enforcing server and NLA redirection is active in pyRDP, the client is presented with the certificate of the redirection host.
In my test environment i have two servers: pyrdp-server.pyrdp.local and pyrdp-server-no-nla.pyrdp.local. When the user wants to connect to the NLA enforcing server she or he is presented with a warning that the server certificate is not matching the requested hostname.
Corresponding output from pyrdp-mitm.py:
$ ./bin/pyrdp-mitm.py --nla-redirection-host pyrdp-server-no-nla.pyrdp.local --nla-redirection-port 3389 pyrdp-server.pyrdp.local
[2022-11-25 12:57:50,595] - INFO - GLOBAL - pyrdp.mitm - Target: pyrdp-server.pyrdp.local:3389
[2022-11-25 12:57:50,595] - INFO - GLOBAL - pyrdp.mitm - Output directory: /home/user/pyrdp-upstream/pyrdp_output
[2022-11-25 12:57:50,596] - INFO - GLOBAL - pyrdp - MITM Server listening on 0.0.0.0:3389
[2022-11-25 12:57:58,778] - INFO - Donald735443 - pyrdp.mitm.connections.tcp - New client connected from 192.168.254.107:50519
[2022-11-25 12:57:58,779] - INFO - Donald735443 - pyrdp.mitm.connections.x224 - Cookie: mstshash=PYRDP-CLI
[2022-11-25 12:57:58,782] - INFO - Donald735443 - pyrdp.mitm.connections.tcp - Server connected
[2022-11-25 12:57:58,786] - INFO - Donald735443 - pyrdp.mitm.connections.x224 - The server forces the use of NLA. Using redirection host: pyrdp-server-no-nla.pyrdp.local:3389
[2022-11-25 12:57:58,786] - INFO - Donald735443 - pyrdp.mitm.connections.x224 - Cookie: mstshash=PYRDP-CLI
[2022-11-25 12:57:58,788] - INFO - Donald735443 - pyrdp.mitm.connections.tcp - Server connected
[2022-11-25 12:57:59,880] - INFO - Donald735443 - pyrdp.mitm.connections.cert - Cloned server certificate to pyrdp_output/certs/pyrdp-server-no-nla.pyrdp.local.crt
[2022-11-25 12:57:59,898] - INFO - Donald735443 - pyrdp.mitm.connections.tcp - Client connection closed. Connection to the other side was lost in a non-clean fashion: Connection lost.
[2022-11-25 12:57:59,899] - INFO - Donald735443 - pyrdp.mitm.connections.tcp - Connection report: report: 1.0, connectionTime: 1.1198546886444092, totalInput: 0, totalOutput: 0, replayFilename: rdp_replay_20221125_12-57-58_778_Donald735443.pyrdp
I think this should be changed, what do you think?
Metadata
Metadata
Assignees
Labels
Type
Projects
Milestone
Relationships
Participants
Activity
obilodeau commentedon Dec 1, 2022
Yes, very interesting observation and it makes a lot of sense to avoid giving away that hint to the client.