For the fifth year, GoSecure encouraged everyone to join Hacktoberfest, an annual, month-long event that encourages contributions to open-source software. Each year, GoSecure tags several issues for collaboration and this blog post summarizes the work that was contributed to our repositories.

 
Hacktoberfest 2021 Logo
 

Capturing NetNTLM hashes when downgrade attacks are not possible with PyRDP

Some time ago, it was brought to our attention that Responder added support to capture NetNTLMv2 hashes over the Remote Desktop Protocol (RDP). Since then we had it on our roadmap, but we knew the implementation would be complicated with TSRequests parsing, BER encoding, SPNego packets and related structures. We are glad to say that Lisandro Ubiedo was up to the task with his pull request (PR).

Pull-Request Screenshot
 

Support for fractional framerates

For a while now, we have known that our captured sessions when converted to videos did not have precise timing. The longer the videos the bigger the drift between real time, as can be seen via a pcap or a replay file, versus time in a converted video. Alexandre Beaulieu started to tackle the task but it turns out, it was not as simple as we expected.

Pull-Request Screenshot
 

Get rid of unmaintained dependencies

An important job of software maintenance is to get rid of unmaintained dependencies. However, such work is rarely a priority and the testing burden, especially when it is about testing a GUI, makes it a tedious task. In his PR, Alex replaced the unmaintained notify2 by py-notifier inside PyRDP and we are very glad he did.

Pull-Request Screenshot
 

Fixing Pcap to JSON conversion

Our convert tool supports converting replay files (.pyrdp) into JSON for very finely grained data about the RDP interactions which includes mouse movement and keystrokes. However, unlike with other output formats, the conversion to JSON from Pcap was never implemented. Alex decided he was up to the task with this PR.

Pull-Request Screenshot
 

Adding support for multi-session Pcap conversion

Traditionally, our convert tool only supported extracting one session per Pcap. We implemented it that way since PyRDP could only intercept between sessions going to one host and reconstructing TCP sessions has a lot of corner cases that we would rather avoid doing ourselves. However, since then, our integration with scapy for session reconstruction, dynamic certificate cloning and transparent proxying means that packet capture in front of PyRDP often holds multiple sessions. Alex’s Hacktoberfest PR added that feature to PyRDP.

Pull-Request Screenshot
 

Wrapping up

We are deeply grateful for the variety of contributions that we received this year. We were excited to bring one of our contributors, Lisandro, onboard at GoSecure since this event. You can expect to read a great write-up of the NetNTLM capturing technique he implemented soon.

Titan Managed Detection & Response
Next-Generation Antivirus
Endpoint Detection & Response
Network Detection & Response
Inbox Detection & Response
Insider Threat Detection & Response
Managed Firewall
Managed SIEM
Vulnerability Management as a Service
GoSecure Titan
Titan Software
Email Security
Web Security
ResponderPRO Forensics Toolkit
Advisory Services
Breach Readiness Services
Cybersecurity Assessment
Incident Response Services
Red & Purple Team Services
Penetration Testing Services
Privacy & Compliance Services
Security Compromise Assessment
3rd Party Technology

Pin It on Pinterest

Share This