Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Wrong certificate when using NLA redirection. #423

Open
spameier opened this issue Nov 25, 2022 · 1 comment · May be fixed by #424
Open

Wrong certificate when using NLA redirection. #423

spameier opened this issue Nov 25, 2022 · 1 comment · May be fixed by #424
Labels
enhancement New feature or request
Milestone
v2.1.1

Comments

@spameier
Copy link
Contributor

Right now, when the user connects to an NLA enforcing server and NLA redirection is active in pyRDP, the client is presented with the certificate of the redirection host.

In my test environment i have two servers: pyrdp-server.pyrdp.local and pyrdp-server-no-nla.pyrdp.local. When the user wants to connect to the NLA enforcing server she or he is presented with a warning that the server certificate is not matching the requested hostname.
image

Corresponding output from pyrdp-mitm.py:

$ ./bin/pyrdp-mitm.py --nla-redirection-host pyrdp-server-no-nla.pyrdp.local --nla-redirection-port 3389 pyrdp-server.pyrdp.local
[2022-11-25 12:57:50,595] - INFO - GLOBAL - pyrdp.mitm - Target: pyrdp-server.pyrdp.local:3389
[2022-11-25 12:57:50,595] - INFO - GLOBAL - pyrdp.mitm - Output directory: /home/user/pyrdp-upstream/pyrdp_output
[2022-11-25 12:57:50,596] - INFO - GLOBAL - pyrdp - MITM Server listening on 0.0.0.0:3389
[2022-11-25 12:57:58,778] - INFO - Donald735443 - pyrdp.mitm.connections.tcp - New client connected from 192.168.254.107:50519
[2022-11-25 12:57:58,779] - INFO - Donald735443 - pyrdp.mitm.connections.x224 - Cookie: mstshash=PYRDP-CLI
[2022-11-25 12:57:58,782] - INFO - Donald735443 - pyrdp.mitm.connections.tcp - Server connected
[2022-11-25 12:57:58,786] - INFO - Donald735443 - pyrdp.mitm.connections.x224 - The server forces the use of NLA. Using redirection host: pyrdp-server-no-nla.pyrdp.local:3389
[2022-11-25 12:57:58,786] - INFO - Donald735443 - pyrdp.mitm.connections.x224 - Cookie: mstshash=PYRDP-CLI
[2022-11-25 12:57:58,788] - INFO - Donald735443 - pyrdp.mitm.connections.tcp - Server connected
[2022-11-25 12:57:59,880] - INFO - Donald735443 - pyrdp.mitm.connections.cert - Cloned server certificate to pyrdp_output/certs/pyrdp-server-no-nla.pyrdp.local.crt
[2022-11-25 12:57:59,898] - INFO - Donald735443 - pyrdp.mitm.connections.tcp - Client connection closed. Connection to the other side was lost in a non-clean fashion: Connection lost.
[2022-11-25 12:57:59,899] - INFO - Donald735443 - pyrdp.mitm.connections.tcp - Connection report: report: 1.0, connectionTime: 1.1198546886444092, totalInput: 0, totalOutput: 0, replayFilename: rdp_replay_20221125_12-57-58_778_Donald735443.pyrdp

I think this should be changed, what do you think?
@spameier spameier linked a pull request Nov 25, 2022 that will close this issue
Open
@obilodeau
Copy link
Member

Yes, very interesting observation and it makes a lot of sense to avoid giving away that hint to the client.

@obilodeau obilodeau added the enhancement New feature or request label Dec 19, 2022
@obilodeau obilodeau added this to the v1.3.0 milestone Jun 27, 2023
@obilodeau obilodeau modified the milestones: v1.3.0, v2.0.1 Dec 14, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or request
Projects
None yet
Milestone
v2.1.1
Development

Successfully merging a pull request may close this issue.

nla redirection: use certificate of original server spameier/pyrdp
2 participants
@obilodeau @spameier