For the fifth year, GoSecure encouraged everyone to join Hacktoberfest, an annual, month-long event that encourages contributions to open-source software. Each year, GoSecure tags several issues for collaboration and this blog post summarizes the work that was contributed to our repositories.
Capturing NetNTLM hashes when downgrade attacks are not possible with PyRDP
Some time ago, it was brought to our attention that Responder added support to capture NetNTLMv2 hashes over the Remote Desktop Protocol (RDP). Since then we had it on our roadmap, but we knew the implementation would be complicated with TSRequests parsing, BER encoding, SPNego packets and related structures. We are glad to say that Lisandro Ubiedo was up to the task with his pull request (PR).
Support for fractional framerates
For a while now, we have known that our captured sessions when converted to videos did not have precise timing. The longer the videos the bigger the drift between real time, as can be seen via a pcap or a replay file, versus time in a converted video. Alexandre Beaulieu started to tackle the task but it turns out, it was not as simple as we expected.
Get rid of unmaintained dependencies
An important job of software maintenance is to get rid of unmaintained dependencies. However, such work is rarely a priority and the testing burden, especially when it is about testing a GUI, makes it a tedious task. In his PR, Alex replaced the unmaintained notify2 by py-notifier inside PyRDP and we are very glad he did.
Fixing Pcap to JSON conversion
Our convert tool supports converting replay files (.pyrdp) into JSON for very finely grained data about the RDP interactions which includes mouse movement and keystrokes. However, unlike with other output formats, the conversion to JSON from Pcap was never implemented. Alex decided he was up to the task with this PR.
Adding support for multi-session Pcap conversion
Traditionally, our convert tool only supported extracting one session per Pcap. We implemented it that way since PyRDP could only intercept between sessions going to one host and reconstructing TCP sessions has a lot of corner cases that we would rather avoid doing ourselves. However, since then, our integration with scapy for session reconstruction, dynamic certificate cloning and transparent proxying means that packet capture in front of PyRDP often holds multiple sessions. Alex’s Hacktoberfest PR added that feature to PyRDP.
Wrapping up
We are deeply grateful for the variety of contributions that we received this year. We were excited to bring one of our contributors, Lisandro, onboard at GoSecure since this event. You can expect to read a great write-up of the NetNTLM capturing technique he implemented soon.
