Encountered an error while attempting to connect to a non-Windows 10 system #470
Comments
|
How do you run Does the destination RDP system enforce NLA (default) or not? If it enforces NLA you need to perform private key extraction. This is documented here. You are using the |
obilodeau
added
bug
|
Aaah, it could be the TLS version expected that is too new for these old operating systems. Can you grab a pcap of the client without PyRDP and with PyRDP? I could then compare SSL/TLS versions. |
|
The command being run: It appears that the target RDP system does enforce NLA, and I will proceed to attempt the extraction of the private key. I am using the native mstsc client included in the Windows 11 system, and it works properly when connecting to a Windows 10 system that is being proxied by pyrdp. Here are the two pcap files I've captured; I've placed them inside a compressed archive. The target RDP system here is Windows XP SP3. Thank you. |
|
When using pyrdp to proxy a Windows Server 2008 R2 system where Network Level Authentication (NLA) has been disabled, I encountered the following error upon attempting a remote connection: The command I used to run pyrdp is: |
|
That last error contains: Windows 2008 R2 probably requires an SSL version that is too old for recent OpenSSL to accept. We could bundle our own OpenSSL with weak ciphers enabled to handle cases like these. To be sure, can you run |
|
I executed the command you provided, and obtained the following results: root@987ad9bd7b52:/vs# openssl s_client -connect 192.168.122.100:3389
CONNECTED(00000003)
40272C2A5B7F0000:error:0A000102:SSL routines:ssl_choose_client_version:unsupported protocol:../ssl/statem/statem_lib.c:1952:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 835 bytes and written 300 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
--- |
|
I misguided you, that was not helpful. Try with this instead: |
|
I executed the aforementioned command, and the result was as follows: root@987ad9bd7b52:/vs# nmap -Pn -sV --script ssl-enum-ciphers -p 3389 192.168.122.100
Starting Nmap 7.80 ( https://nmap.org ) at 2024-02-01 13:58 CST
Nmap scan report for 192.168.122.100
Host is up (0.00030s latency).
PORT STATE SERVICE VERSION
3389/tcp open ms-wbt-server?
| ssl-enum-ciphers:
| TLSv1.0:
| ciphers:
| TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
| TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
| TLS_RSA_WITH_RC4_128_SHA (rsa 2048) - C
| TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A
| TLS_RSA_WITH_RC4_128_MD5 (rsa 2048) - C
| compressors:
| NULL
| cipher preference: server
| warnings:
| 64-bit block cipher 3DES vulnerable to SWEET32 attack
| Broken cipher RC4 is deprecated by RFC 7465
| Ciphersuite uses MD5 for message integrity
| Weak certificate signature: SHA1
|_ least strength: C
MAC Address: 52:54:00:DE:6E:CF (QEMU virtual NIC)
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 90.32 seconds |
|
Sorry for the lack of updates, I couldn't find time to dedicate to this issue in the last couple of weeks. I think we will need to provide a special build of OpenSSL that accepts deprecated ciphers. Reference: https://stackoverflow.com/questions/37619759/how-to-force-openssl-to-use-old-ciphers |
Hi,
When I attempt to use pyrdp to proxy for non-Windows 10 versions of Windows, such as Windows Server 2003 R2, Windows XP SP3, and Windows 7, I consistently encounter the following errors:
The text was updated successfully, but these errors were encountered: