Parser to enumerate RDP username.

[RSAAdmin]

Hello all,

I figured someone has probably done this before so i figured i would ask on the board first before i start working on this.

Has anyone created a parser to get the mstshash value inside RDP sessions in order to help detect which accounts are being targetted in brute force attacks ?

i.e:"   àCookie: mstshash=administrator

[RSAAdmin]

Sounds easy enough if it is in a cookie.  You have a pcap you can share with that type of content?

[RSAAdmin]

Thanks for the prompt response.   Here is a pcap of some morto worm activity.

http://destr0y.net/rdp.pcap

you will notice the ."Cookie: mstshash=a"  in the packet

[RSAAdmin · Accepted solution]

The object you identified is what we call a "token."  Its a byte-pattern in a session that should be rather constant where-ever the condition appears, in this case, the RDP protocol login.

In hex, it is actually 5 doublets of 00 followed by the "Cookie: mstshash=" and that appears to be fairly common in the several pcaps I found for RDP.

Here is the parser I put together.  It identifies the token in question, then captures the variable between the token and a carriage return and alerts that meta out into the username key.

<?xml version="1.0" encoding="utf-8"?>

<parsers xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="parsers.xsd">

                <parser name="RDP-User" desc="This extracts the RDP Username">

                                <declaration>

                                                <token name="tcookiestart" value="&#x00;&#x00;&#x00;&#x00;&#x00;&#x43;&#x6F;&#x6F;&#x6B;&#x69;&#x65;&#x3A;&#x20;&#x6D;&#x73;&#x74;&#x73;&#x68;&#x61;&#x73;&#x68;&#x3D;"  />

                                                <number name="vPosition" scope="stream" />

                                                <string name="vusername" scope="stream" />

                                                <meta name="meta" key="username" format="Text" />

                                </declaration>

                                <match name="tcookiestart">

                                                <find name="vPosition" value="&#x0d;&#x0a;" length="512">

                                                                <read name="vusername" length="$vPosition">

                                                                                <register name="meta" value="$vusername" />

                                                                </read>

                                                </find>

                                </match>

                </parser>

</parsers>

Save that text as a .parser file in your c:\program data\netwitness\parsers directory.  Then close investigator and reopen it.  Now import your rdp pcap and it should populate the username key.  Let me know if you have any issues.

BTW, there are other tokens in the protocol negotiations, including the machine name and whether or not clipboard access is allowed, but I couldn't determine a good token to use.  I do see DUCA in common, but there is variable space in between that token and the machine name.  Tougher to do and requires more programming logic than I can muster.  Maybe someone else on the community can try to extract the machinename tokens and add it to this thread?

[ThomasSchaub]

It's interesting that the v9.8 SysAdmin guide (on page 260) specifies two meta data types for the RDP parser, 'action' and 'username'.  That said, running v9.8.5.5 on our decoders, there are no meta types available uder RDP (see figure 1).  Any thoughts as to whether these might have been deprecated at some point or do you think this a bug/error in the release?

Tnx, Tom

Figure 1

[EricPartington]

This is now GA in the RDP lua parser (username) along with a few other updates including screen resolution and keyboard languages