For the fifth year, GoSecure encouraged everyone to join Hacktoberfest, an annual, month-long event that encourages contributions to open-source software. Each year, GoSecure tags several issues for collaboration and this blog post summarizes the work that was contributed to our repositories.

 
Hacktoberfest 2021 Logo
 

Capturing NetNTLM hashes when downgrade attacks are not possible with PyRDP

Some time ago, it was brought to our attention that Responder added support to capture NetNTLMv2 hashes over the Remote Desktop Protocol (RDP). Since then we had it on our roadmap, but we knew the implementation would be complicated with TSRequests parsing, BER encoding, SPNego packets and related structures. We are glad to say that Lisandro Ubiedo was up to the task with his pull request (PR).

Pull-Request Screenshot
 

Support for fractional framerates

For a while now, we have known that our captured sessions when converted to videos did not have precise timing. The longer the videos the bigger the drift between real time, as can be seen via a pcap or a replay file, versus time in a converted video. Alexandre Beaulieu started to tackle the task but it turns out, it was not as simple as we expected.

Pull-Request Screenshot
 

Get rid of unmaintained dependencies

An important job of software maintenance is to get rid of unmaintained dependencies. However, such work is rarely a priority and the testing burden, especially when it is about testing a GUI, makes it a tedious task. In his PR, Alex replaced the unmaintained notify2 by py-notifier inside PyRDP and we are very glad he did.

Pull-Request Screenshot
 

Fixing Pcap to JSON conversion

Our convert tool supports converting replay files (.pyrdp) into JSON for very finely grained data about the RDP interactions which includes mouse movement and keystrokes. However, unlike with other output formats, the conversion to JSON from Pcap was never implemented. Alex decided he was up to the task with this PR.

Pull-Request Screenshot
 

Adding support for multi-session Pcap conversion

Traditionally, our convert tool only supported extracting one session per Pcap. We implemented it that way since PyRDP could only intercept between sessions going to one host and reconstructing TCP sessions has a lot of corner cases that we would rather avoid doing ourselves. However, since then, our integration with scapy for session reconstruction, dynamic certificate cloning and transparent proxying means that packet capture in front of PyRDP often holds multiple sessions. Alex’s Hacktoberfest PR added that feature to PyRDP.

Pull-Request Screenshot
 

Wrapping up

We are deeply grateful for the variety of contributions that we received this year. We were excited to bring one of our contributors, Lisandro, onboard at GoSecure since this event. You can expect to read a great write-up of the NetNTLM capturing technique he implemented soon.

GoSecure Titan® Managed Extended Detection & Response (MXDR)​

GoSecure Titan® Managed Extended Detection & Response (MXDR)​ Foundation

GoSecure Titan® Vulnerability Management as a Service (VMaaS)

GoSecure Titan® Managed Security Information & Event Monitoring (SIEM)

GoSecure Titan® Managed Perimeter Defense​ (MPD)

GoSecure Titan® Inbox Detection and Response (IDR)

GoSecure Titan® Platform

GoSecure Professional Security Services

Incident Response Services

Security Maturity Assessment

Privacy Services

PCI DSS Services

Penetration Testing Services​

Security Operations

MicrosoftLogo

GoSecure MXDR for Microsoft

Comprehensive visibility and response within your Microsoft security environment

USE CASES

Cyber Risks

Risk-Based Security Measures

Sensitive Data Security

Safeguard sensitive information

Private Equity Firms

Make informed decisions

Cybersecurity Compliance

Fulfill regulatory obligations

Cyber Insurance

A valuable risk management strategy

Ransomware

Combat ransomware with innovative security

Zero-Day Attacks

Halt zero-day exploits with advanced protection

Consolidate, Evolve & Thrive

Get ahead and win the race with the GoSecure Titan® Platform

24/7 MXDR FOUNDATION

GoSecure Titan® Endpoint Detection and Response (EDR)

GoSecure Titan® Next Generation Antivirus (NGAV)

GoSecure Titan® Network Detection and Response (NDR)

GoSecure Titan® Inbox Detection and Reponse (IDR)

GoSecure Titan® Intelligence

ABOUT GOSECURE

GoSecure is a recognized cybersecurity leader and innovator, pioneering the integration of endpoint, network, and email threat detection into a single Managed Extended Detection and Response (MXDR) service. For over 20 years, GoSecure has been helping customers better understand their security gaps and improve their organizational risk and security maturity through MXDR and Professional Services solutions delivered by one of the most trusted and skilled teams in the industry.

LATEST PRESS RELEASE

GOSECURE BLOG

SECURITY ADVISORIES

24/7 Emergency – (888)-287-5858