Hello everyone in this lesson. I will show you how you can decrypted
RDP protocol and what kind of
information we can have decryptility RDP
traffic.
Now let's begin.
Percy let's talk about Rd people called briefly the
remote desktop protocol RDP is
a protocol developed by Microsoft that provides
a user with a graphical interface to
connect to another computer over a network
connection and the user employs RDP client
software for this purpose. As you know, while the
other computer must run
RDP server software RDP uses a
client server architecture where the remote
computer This Server listens for incoming connections
from RDP clients and decline
established connection to the server or
the case the user and then this
place this servers desktop in
a window on the clients computer. Let's look
at the RDP traffic encrypted with
TLS protocol now and our
focus is on RDP protocol.
So let's take a second to
On RDP and see what it returns when we
typed an RDP filter expression.
Look at this we can see no packets associated
with the RDP protocol. Now, this is
because RDP is using TLS to encrypt the
data in our PK file in our
traffic. And so we will
not be able to see anything that happens with
RDP traffic at this moment. So now
let's decrypt the RDP traffic
using the TLs key values.
And as you can see at this moment, we cannot
see any packet associated with the RDP
protocol all the data that
we can see.
Is a TLS packet and
we can see only the application
data in here and these application
status are encrypted with
the ALS protocol. So when we
look at the
Application data part under the transport
layer security. You can see only the
encrypted application data part
and you cannot see
what it contains exactly so now
it will decrypty RDP traffic in here
and then
we will be able to see the all RDP
traffic in our PK file, but
at this moment we cannot see any.
Data any packet associated with the RDP
or any other protocols all the
data.
Is with the TLs protocol at
this moment?
So now let me show you how you can decrypt the RDP traffic
in the easiest way.
To do this you can go to the edit menu and references
menu. Then you
will choose the protocol as TLS.
and
in the transport layer security TLS window,
we will use the RSA Keys list
menu, and we will click on the edit.
In here, it will add the our server
information and the key file. We will
show our key file to Wireshark and
we will locate the key file
in here. So to add our
information click on the
Last button and in here, we will
type our server IP address in our
traffic as you can see.
Our client is who signs the
client Hello message. So in this
situation arcline is this machine
with this IP address and our server?
Is who sense the TLs server
Hello message and so in
illustration are server is
this machine and it has the IP
address 10.0.2 dot
15 so our IP address
our server IP address is that and I
will type it into the IP address field.
Then I will add the port information
of the server and the server
sport is 33 and
89 and I
will add the server port number here.
So then I will choose my SSL or
TLS key file in here.
Click on browse and then I will
choose my key file.
as in here and open
then I will click on OK button.
And when I click on the OK button
in this window or traffic will be changed.
And we will see the traffic as
decrypted mode.
As in the decrypted form and you
will see the change when I
click on the OK button.
So you can see now decrypted traffic
in our PK file and now
there is no more application data
expression.
in the info field
we can see clearly the RDP traffic
and the create SSP protocol information
here. So let me
talk about the process after the
TLs handshake.
What we are seeing in this traffic.
Starts with the create SSP packets. Let
me explain this for a
while and create SSP, maybe
some of you know about
the credit SSP protocol after
the tennis handshake process in here.
We see the authentication packets
begin with the
negotiate packet begins with the ntlm SSP.
Negotiate packet. And in here
are protocol is great SSP, and we
couldn't see the credit SSP protocol information
before the description
of the traffic.
And credit SSP means credential
security support provider. So
it is a credit SSP is a
security protocol that is used in Windows
operating systems to allow remote servers to
delegate the user's credentials from the client computer
to the Target server. And this is
typically used in remote desktop protocol
in RDP protocol connections. When
a user attempts to connect to a remote server using
RDP declined computers
spread SSP component is used to secure
delegate. The user's credentials
to the remote server the remote server
can then use the delegated credentials
to access resources on the
computer or on other servers that
the user has access to so create
SSP uses encryption to
ensure that users credentials are
Will transmitted over the network
and are only available to the intended recipient.
This helps to prevent unorderized access
to the user's credentials and to
protect against various types of network based
attacks. So in here create SSP
allows to delegate the
user's credentials from the client.
Is in here these packets this negotiate
packets are coming from the
client and credit SSP allows
to delegate the user's credentials from the
client side to the Target server for
remote or the indication.
So keep in mind that this is
the key point of the organication the remote
identification and now let me show
you the ntlm SSP negotiate
packets details.
So when we look at the details under the
transport layer security now, we can
see clearly the credential security support provider
details, but before the decryption of
the traffic, we couldn't see the create
SSP details because the credit
SSP data are encrypted by
the TLs protocol, but now
I have decrypted to traffic and I
Can See Clearly these information
under the transport layer
security. So when I expand the
all the fields we can
see some information under this
field.
And let me explain one by
one.
First the negotiate packet is
a packet user in the RDP to initiate the
process of authenticating a user it is
part of the ntlm and the
land managers and the local
local area network manager security
protocol and which is and which
is used for authentication in RDP. When
an RDP client established a connection to
an RDP server by this TLS and
Shake process the first packet
it stands is the anti-alamassa speed
negotiate packet. And in this situation, of
course the ntlm is the authentication method
which is which is used by the client and
it is the first packet sent from
the client to the server during the
ntlm authentication process and contains
the clients supported and
authentication options with the
flex value we will investigate them soon
and
The packet contains some several
fields in here. So let's start
with the negot token to explain.
The negot token value is a binary
value in negotiate packet that represents
the clients and the alarm negotiation information
and it is an encoded as
you can see. It is an encoded representation
of the ntlm negotiation plagues and
other information such as the client's domain
name workstation name and version information.
So the Negro token value is used by
the server to the determine the
clients and PLM authentication options.
And when we look
at the options value with the flex
value.
so
in here, we see some some Flex
value and
scrolling down
so you can see in here negotiate version is
set.
Anti-session or we can
see the extended security is set. This
means that the client that the
client requires.
And support the extended security option and
we can see another negotiate
always sign in here
and the negotiate always sign flag
indicates that the client
requires all messages to be signed.
So then we can see some other
values in here the
negotiate sign.
and
the target type server we
can see in here the target type server.
So the other one is negotiate ntlmt and
it is set as you can see.
And this is indicating that the client requires the
use of land manager lmkts. So
this is indicating that the
client requires the use of land manager
keys and then we can
see some other information.
So now let me explain the negotiate Flags
in here. And first one is negotiate flag
and is set because the client
wants to negotiate with the server and
key exchange also is set.
Then we see the extended security is
set.
And the negotiate always sign is set.
This flag is indicating that
the client requires all messages to
be signed.
So then scrolling down.
And we see in here negotiate ntlm
key is set and
this flag indicates that
the client supports ntlm or the
indication.
So then we can see the negotiate
land manager key and this
flag is indicating that the client
requires the use of land manager Keys the
client requires the use of LM keys.
So then we are
scrolling down again and we have a in
here negotiate seal.
So negotiate seal black is
also set in here and the this
flag indicates that the client requires
message encryption.
So then
and in here the request Target value is
set and this black indicates that
the client requires to server to
return the target name in the authentication process. So these
flags play an important role in the
determining the ntlm or the education
process such as the type of encryption and
signing to use the
target name and the type of the target. So
on and we see
another information as the
version field in here and
the this field contains version
information about client that the
client supports which version of
the ntlm.
So to sum up ntlm SSP negotiate
packet is the first packet user to identicate
the user and the server will reply
with an challenge packet which contains a
challenge that the client must respond to than the
client will send and authentication packet
which contains the response to the challenge
packet and the user's
credentials if the server accepts the
credentials the authentication process is
complete and the user will
be granted access to the server.
So now let's look at the ntlm SSP
challenge packet as the second packet
in detail.
Let me show you the details
in here.
So in this field you can see some details
about the servers in
the challenge effect.
So the target name is the first field
as you can see and the target
name contains the name of the
domain or server that the client is trying to
connect to.
And then you can see the target info field in here.
You can see some detailed information
such as net buyers domain
name netbios computer name and DNS
domain name as well. DNS computer
name time step formations in here.
And you can see some attribute
in here. So and the
version information also you can see
so the target info contains additional
information about Target in
here such as the targets
DNS or net bios name and then
you can see ntlm Server challenge
value in here. So this
field contains a random value a random
8 byte challenge value that
the client must use to prove its identity.
and when I click on the
show bytes as bits.
and click on the
And tlm server challenge, you can see the values
response to a bytes.
on the
packet
bytes pain in here
so here is as you can see we have
8 bytes value corresponds to
the ntlm server challenge
value
and
we can close this.
so
we have seen some important information about the
target about the server such as
Target name.
The DNS name in The Challenge
packet, which is sent by the server
and you can access the important information
about the server within this
challenge packet.
Okay. Now let's look at the next packet.
Which is sent by the client as antialam SSP
authentication pack and when we
click on the ntlm SSP authentication packet.
We see some information about the
client.
that when you click
the details of the credential security support provider
when we expand it is
this is some detailed information about
the client.
as response to the challenge packet
Which is a signed by the server. So with
this authentication packet, the client
is responding to the server.
and for the challenge, so when we look at the
details in authentication packet, you can
see some a land manager response and
ntlm response value
as you can see the response version.
And net bios domain name you can see.
Which is used by the server and
some Target name?
value in here
the term SRV with this IP
information with this IP address under
the ntlm secure service
providers field. You can see some important
information about the client
and the user you can find the domain
name of the client.
in here Windows 7
Is our domain name the domain name is Windows 7
and username is user so
we can find the username in
this field. And the host name
is in here as again when 7
so we can find some important
information about the client and user and
we can see the decision key in here.
as
included version encoded form
and negotiate Flags value
is in here again, and the version
the information.
About the client and we can see the public
key for the authentication in
encoded for.
So as a result after the authentication packet,
which is sent by the client the
server will validate the response and the
credentials and if they are valid the server
will send a message indicating that the order
indication process is successful. Otherwise, it
will deny the access so making analysis
by decrypting the RDP traffic may
provide lots of precious information on our
Network and you can learn which clients
are trying to connect to a specific server on
our Network and how many unsuccessful connection
attempts are there in the traffic
and which IP addresses are
trying to establish connection to the server.
So, of course we can find answers to
many questions like this by decrypting
and analyzing RDP traffic.
That's all for now. See you on the next video.