For the fifth year, GoSecure encouraged everyone to join Hacktoberfest, an annual, month-long event that encourages contributions to open-source software. Each year, GoSecure tags several issues for collaboration and this blog post summarizes the work that was contributed to our repositories.

 
Hacktoberfest 2021 Logo
 

Capturing NetNTLM hashes when downgrade attacks are not possible with PyRDP

Some time ago, it was brought to our attention that Responder added support to capture NetNTLMv2 hashes over the Remote Desktop Protocol (RDP). Since then we had it on our roadmap, but we knew the implementation would be complicated with TSRequests parsing, BER encoding, SPNego packets and related structures. We are glad to say that Lisandro Ubiedo was up to the task with his pull request (PR).

Pull-Request Screenshot
 

Support for fractional framerates

For a while now, we have known that our captured sessions when converted to videos did not have precise timing. The longer the videos the bigger the drift between real time, as can be seen via a pcap or a replay file, versus time in a converted video. Alexandre Beaulieu started to tackle the task but it turns out, it was not as simple as we expected.

Pull-Request Screenshot
 

Get rid of unmaintained dependencies

An important job of software maintenance is to get rid of unmaintained dependencies. However, such work is rarely a priority and the testing burden, especially when it is about testing a GUI, makes it a tedious task. In his PR, Alex replaced the unmaintained notify2 by py-notifier inside PyRDP and we are very glad he did.

Pull-Request Screenshot
 

Fixing Pcap to JSON conversion

Our convert tool supports converting replay files (.pyrdp) into JSON for very finely grained data about the RDP interactions which includes mouse movement and keystrokes. However, unlike with other output formats, the conversion to JSON from Pcap was never implemented. Alex decided he was up to the task with this PR.

Pull-Request Screenshot
 

Adding support for multi-session Pcap conversion

Traditionally, our convert tool only supported extracting one session per Pcap. We implemented it that way since PyRDP could only intercept between sessions going to one host and reconstructing TCP sessions has a lot of corner cases that we would rather avoid doing ourselves. However, since then, our integration with scapy for session reconstruction, dynamic certificate cloning and transparent proxying means that packet capture in front of PyRDP often holds multiple sessions. Alex’s Hacktoberfest PR added that feature to PyRDP.

Pull-Request Screenshot
 

Wrapping up

We are deeply grateful for the variety of contributions that we received this year. We were excited to bring one of our contributors, Lisandro, onboard at GoSecure since this event. You can expect to read a great write-up of the NetNTLM capturing technique he implemented soon.

Détection et réponse gérées Titan
Antivirus de nouvelle génération
Détection et réponse sur les terminaux
Détection et réponse sur le réseau
Détection et réponse sur les boîtes de messagerie
Détection et réponse face aux menaces internes
Gestion des pare-feu
Gestion des SIEM
La gestion des vulnérabilités en tant que service
GoSecure Titan
Logiciel Titan
Sécurité de la messagerie
Sécurité Web
Boîte à outils «Responder PRO Forensics»
Services professionnels
Services de préparation aux brèches
Évaluation de la cybersécurité
Services de réponse aux incidents
Services des équipes « Red & Purple »
Services de tests d'intrusion
Services de conformité et d'audit
Évaluation de la compromission de la sécurité
Technologies tierces

Pin It on Pinterest

Share This