CiscoCXSecurity/rdp-sec-check CiscoCXSecurity/rdp-sec-check

Security
  • Stars
    star
    166
  • Rank 220,655 (Top 5 %)
  • Language
    Perl
  • License
    GNU General Publi...
  • Created almost 9 years ago
  • Updated about 3 years ago
Twitter logo Share LinkedIn logo Share Facebook logo Share
CiscoCXSecurity/rdp-sec-check
github

CiscoCXSecurity

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

rdp-sec-check is a Perl script to enumerate security settings of an RDP Service (AKA Terminal Services)

rdp-sec-check

Perl script to enumerate security settings of an RDP Service (AKA Terminal Services)

Key features

  • Support for targets file
  • Support for saving the tool output to a specified logfile
  • Control over the connection and responses timeouts
  • Control over the number of retries when timeouts occurs

Overview

rdp-sec-check is a Perl script to enumerate the different security settings of an remote destktop service (AKA Terminal Services).

It does not require authentication, only network connectivity to TCP port 3389.

It can determine many (though not quite all) of the security settings from the RDP-Tcp Properties | General tab:

  • Check which security layers are supported by the service: Standard RDP Security, TLSv1.0, CredSSP
  • For Standard RDP Security it detects the level of encryption supported: 40-bit, 56-bit, 128-bit, FIPS

The following potential security issues are flagged if present:

  • The service supports Standard RDP Security – rhis is known to be vulnerable to an active “Man-In-The-Middle” attack
  • The service supports weak encryption (40-bit or 56-bit)
  • The service does not mandate Network Level Authentication (NLA) - NLA can help to prevent certain types of Denial of Service attack
  • The service supports FIPS encryption but doesn’t mandate it – may only be interesting for jurisdictions where FIPS is required

Requirements

rdp-sec-check is a simple Perl script that requires one module from CPAN. Run cpan as root then install the Encoding::BER module:

# cpan
cpan[1]> install Encoding::BER

Examples

Example output 1: An old Windows 2000 RDP service

$ rdp-sec-check.pl 10.0.0.94
Starting rdp-sec-check v0.8-beta ( https://labs.portcullis.co.uk/application/rdp-sec-check/ ) at Mon Jul  9 13:34:38 2012
 
Target:    10.0.0.94
IP:        10.0.0.94
Port:      3389
 
[+] Checking supported protocols
 
[-] Checking if RDP Security (PROTOCOL_RDP) is supported...Negotiation ignored - old Windows 2000/XP/2003 system?
[-] Checking if TLS Security (PROTOCOL_SSL) is supported...Negotiation ignored - old Windows 2000/XP/2003 system?
[-] Checking if CredSSP Security (PROTOCOL_HYBRID) is supported [uses NLA]...Negotiation ignored - old Windows 2000/XP/2003 system??
 
[+] Checking RDP Security Layer
 
[-] Checking RDP Security Layer with encryption ENCRYPTION_METHOD_NONE...Not supported
[-] Checking RDP Security Layer with encryption ENCRYPTION_METHOD_40BIT...Supported.  Server encryption level: ENCRYPTION_LEVEL_CLIENT_COMPATIBLE
[-] Checking RDP Security Layer with encryption ENCRYPTION_METHOD_128BIT...Not supported
[-] Checking RDP Security Layer with encryption ENCRYPTION_METHOD_56BIT...Supported.  Server encryption level: ENCRYPTION_LEVEL_CLIENT_COMPATIBLE
[-] Checking RDP Security Layer with encryption ENCRYPTION_METHOD_FIPS...Not supported
 
[+] Summary of protocol support
 
[-] 10.0.0.94:3389 supports PROTOCOL_RDP   : TRUE
[-] 10.0.0.94:3389 supports PROTOCOL_HYBRID: FALSE
[-] 10.0.0.94:3389 supports PROTOCOL_SSL   : FALSE
 
[+] Summary of RDP encryption support
 
[-] 10.0.0.94:3389 has encryption level: ENCRYPTION_LEVEL_CLIENT_COMPATIBLE
[-] 10.0.0.94:3389 supports ENCRYPTION_METHOD_NONE   : FALSE
[-] 10.0.0.94:3389 supports ENCRYPTION_METHOD_40BIT  : TRUE
[-] 10.0.0.94:3389 supports ENCRYPTION_METHOD_128BIT : FALSE
[-] 10.0.0.94:3389 supports ENCRYPTION_METHOD_56BIT  : TRUE
[-] 10.0.0.94:3389 supports ENCRYPTION_METHOD_FIPS   : FALSE
 
[+] Summary of security issues
 
[-] 10.0.0.94:3389 has issue NLA_NOT_SUPPORTED_DOS
[-] 10.0.0.94:3389 has issue ONLY_RDP_SUPPORTED_MITM
[-] 10.0.0.94:3389 has issue WEAK_RDP_ENCRYPTION_SUPPORTED
 
rdp-sec-check v0.8-beta completed at Mon Jul  9 13:34:39 2012

Example output 2: A Windows 2003 SP0 RDP service

$ rdp-sec-check.pl 10.0.0.93
Starting rdp-sec-check v0.8-beta ( https://labs.portcullis.co.uk/application/rdp-sec-check/ ) at Mon Jul  9 13:35:34 2012
 
Target:    10.0.0.93
IP:        10.0.0.93
Port:      3389
 
[+] Checking supported protocols
 
[-] Checking if RDP Security (PROTOCOL_RDP) is supported...Negotiation ignored - old Windows 2000/XP/2003 system?
[-] Checking if TLS Security (PROTOCOL_SSL) is supported...Negotiation ignored - old Windows 2000/XP/2003 system?
[-] Checking if CredSSP Security (PROTOCOL_HYBRID) is supported [uses NLA]...Negotiation ignored - old Windows 2000/XP/2003 system??
 
[+] Checking RDP Security Layer
 
[-] Checking RDP Security Layer with encryption ENCRYPTION_METHOD_NONE...Not supported
[-] Checking RDP Security Layer with encryption ENCRYPTION_METHOD_40BIT...Supported.  Server encryption level: ENCRYPTION_LEVEL_CLIENT_COMPATIBLE
[-] Checking RDP Security Layer with encryption ENCRYPTION_METHOD_128BIT...Supported.  Server encryption level: ENCRYPTION_LEVEL_CLIENT_COMPATIBLE
[-] Checking RDP Security Layer with encryption ENCRYPTION_METHOD_56BIT...Supported.  Server encryption level: ENCRYPTION_LEVEL_CLIENT_COMPATIBLE
[-] Checking RDP Security Layer with encryption ENCRYPTION_METHOD_FIPS...Supported.  Server encryption level: ENCRYPTION_LEVEL_CLIENT_COMPATIBLE
 
[+] Summary of protocol support
 
[-] 10.0.0.93:3389 supports PROTOCOL_RDP   : TRUE
[-] 10.0.0.93:3389 supports PROTOCOL_HYBRID: FALSE
[-] 10.0.0.93:3389 supports PROTOCOL_SSL   : FALSE
 
[+] Summary of RDP encryption support
 
[-] 10.0.0.93:3389 has encryption level: ENCRYPTION_LEVEL_CLIENT_COMPATIBLE
[-] 10.0.0.93:3389 supports ENCRYPTION_METHOD_NONE   : FALSE
[-] 10.0.0.93:3389 supports ENCRYPTION_METHOD_40BIT  : TRUE
[-] 10.0.0.93:3389 supports ENCRYPTION_METHOD_128BIT : TRUE
[-] 10.0.0.93:3389 supports ENCRYPTION_METHOD_56BIT  : TRUE
[-] 10.0.0.93:3389 supports ENCRYPTION_METHOD_FIPS   : TRUE
 
[+] Summary of security issues
 
[-] 10.0.0.93:3389 has issue NLA_NOT_SUPPORTED_DOS
[-] 10.0.0.93:3389 has issue FIPS_SUPPORTED_BUT_NOT_MANDATED
[-] 10.0.0.93:3389 has issue ONLY_RDP_SUPPORTED_MITM
[-] 10.0.0.93:3389 has issue WEAK_RDP_ENCRYPTION_SUPPORTED

Example output 3: A typical Windows 2003 RDP service

$ rdp-sec-check.pl 10.0.0.111
Starting rdp-sec-check v0.8-beta ( https://labs.portcullis.co.uk/application/rdp-sec-check/ ) at Mon Jul  9 13:36:56 2012
 
Target:    10.0.0.111
IP:        10.0.0.111
Port:      3389
 
[+] Checking supported protocols
 
[-] Checking if RDP Security (PROTOCOL_RDP) is supported...Supported
[-] Checking if TLS Security (PROTOCOL_SSL) is supported...Not supported - SSL_NOT_ALLOWED_BY_SERVER
[-] Checking if CredSSP Security (PROTOCOL_HYBRID) is supported [uses NLA]...Not supported - SSL_NOT_ALLOWED_BY_SERVER
 
[+] Checking RDP Security Layer
 
[-] Checking RDP Security Layer with encryption ENCRYPTION_METHOD_NONE...Not supported
[-] Checking RDP Security Layer with encryption ENCRYPTION_METHOD_40BIT...Supported.  Server encryption level: ENCRYPTION_LEVEL_CLIENT_COMPATIBLE
[-] Checking RDP Security Layer with encryption ENCRYPTION_METHOD_128BIT...Supported.  Server encryption level: ENCRYPTION_LEVEL_CLIENT_COMPATIBLE
[-] Checking RDP Security Layer with encryption ENCRYPTION_METHOD_56BIT...Supported.  Server encryption level: ENCRYPTION_LEVEL_CLIENT_COMPATIBLE
[-] Checking RDP Security Layer with encryption ENCRYPTION_METHOD_FIPS...Supported.  Server encryption level: ENCRYPTION_LEVEL_CLIENT_COMPATIBLE
 
[+] Summary of protocol support
 
[-] 10.0.0.111:3389 supports PROTOCOL_RDP   : TRUE
[-] 10.0.0.111:3389 supports PROTOCOL_HYBRID: FALSE
[-] 10.0.0.111:3389 supports PROTOCOL_SSL   : FALSE
 
[+] Summary of RDP encryption support
 
[-] 10.0.0.111:3389 has encryption level: ENCRYPTION_LEVEL_CLIENT_COMPATIBLE
[-] 10.0.0.111:3389 supports ENCRYPTION_METHOD_NONE   : FALSE
[-] 10.0.0.111:3389 supports ENCRYPTION_METHOD_40BIT  : TRUE
[-] 10.0.0.111:3389 supports ENCRYPTION_METHOD_128BIT : TRUE
[-] 10.0.0.111:3389 supports ENCRYPTION_METHOD_56BIT  : TRUE
[-] 10.0.0.111:3389 supports ENCRYPTION_METHOD_FIPS   : TRUE
 
[+] Summary of security issues
 
[-] 10.0.0.111:3389 has issue NLA_NOT_SUPPORTED_DOS
[-] 10.0.0.111:3389 has issue FIPS_SUPPORTED_BUT_NOT_MANDATED
[-] 10.0.0.111:3389 has issue ONLY_RDP_SUPPORTED_MITM
[-] 10.0.0.111:3389 has issue WEAK_RDP_ENCRYPTION_SUPPORTED
 
rdp-sec-check v0.8-beta completed at Mon Jul  9 13:36:56 2012

Example output 4: A well configured Windows 2008 RDP service

$ rdp-sec-check.pl 10.0.0.21
Starting rdp-sec-check v0.8-beta ( https://labs.portcullis.co.uk/application/rdp-sec-check/ ) at Mon Jul  9 13:32:30 2012
 
Target:    10.0.0.21
IP:        10.0.0.21
Port:      3389
 
[+] Checking supported protocols
 
[-] Checking if RDP Security (PROTOCOL_RDP) is supported...Not supported - HYBRID_REQUIRED_BY_SERVER
[-] Checking if TLS Security (PROTOCOL_SSL) is supported...Not supported - HYBRID_REQUIRED_BY_SERVER
[-] Checking if CredSSP Security (PROTOCOL_HYBRID) is supported [uses NLA]...Supported
 
[+] Checking RDP Security Layer
 
[-] Checking RDP Security Layer with encryption ENCRYPTION_METHOD_NONE...Not supported
[-] Checking RDP Security Layer with encryption ENCRYPTION_METHOD_40BIT...Not supported
[-] Checking RDP Security Layer with encryption ENCRYPTION_METHOD_128BIT...Not supported
[-] Checking RDP Security Layer with encryption ENCRYPTION_METHOD_56BIT...Not supported
[-] Checking RDP Security Layer with encryption ENCRYPTION_METHOD_FIPS...Not supported
 
[+] Summary of protocol support
 
[-] 10.0.0.21:3389 supports PROTOCOL_RDP   : FALSE
[-] 10.0.0.21:3389 supports PROTOCOL_HYBRID: TRUE
[-] 10.0.0.21:3389 supports PROTOCOL_SSL   : FALSE
 
[+] Summary of RDP encryption support
 
[-] 10.0.0.21:3389 supports ENCRYPTION_METHOD_NONE   : FALSE
[-] 10.0.0.21:3389 supports ENCRYPTION_METHOD_40BIT  : FALSE
[-] 10.0.0.21:3389 supports ENCRYPTION_METHOD_128BIT : FALSE
[-] 10.0.0.21:3389 supports ENCRYPTION_METHOD_56BIT  : FALSE
[-] 10.0.0.21:3389 supports ENCRYPTION_METHOD_FIPS   : FALSE
 
[+] Summary of security issues
 
rdp-sec-check v0.8-beta completed at Mon Jul  9 13:32:31 2012

Note

See https://labs.portcullis.co.uk/tools/rdp-sec-check/

More Repositories

1

enum4linux

enum4Linux is a Linux alternative to enum.exe for enumerating data from Windows and Samba hosts
Perl
936
star
2

bbqsql

SQL Injection Exploitation Tool
Python
673
star
3

NeoPI

Python
462
star
4

linikatz

linikatz is a tool to attack AD on UNIX
C
425
star
5

creddump7

Python
357
star
6

suddensix

IPV6 MITM attack tool
Shell
92
star
7

udp-proto-scanner

udp-proto-scanner is a Perl script which discovers UDP services by sending triggers to a list of hosts
Perl
86
star
8

unix-audit

Framework for generating audit commands for Unix security audits
Shell
65
star
9

mptcp-abuse

A collection of tools and resources to explore MPTCP on your network. Initially released at Black Hat USA 2014.
Python
58
star
10

udpy_proto_scanner

udpy_proto_scanner is a Python script which discovers UDP services by sending triggers to a list of hosts
Python
40
star
11

QRCode-Video-Data-Exfiltration

Exfiltrate data with QR code videos generated from files by HTML5/JS.
JavaScript
35
star
12

presentations

Presentations from the CX Security Labs team
28
star
13

ssl-cipher-suite-enum

ssl-cipher-suite enum is a Perl script to enumerate supported SSL cipher suites supported by network services (principally HTTPS)
Perl
28
star
14

sslxray

sslxray is an SSL/TLS scanning tool designed to detect a wide range of issues
Python
22
star
15

log4j

Detection rules to look for Log4J usage and exploitation
YARA
18
star
16

http-dir-enum

http-dir-enum is a tool for finding content that is not linked on a website. Its main use is for finding directories that exist on a server. Simply provide a dictionary file and a URL.
Perl
15
star
17

httpShell

CoffeeScript
14
star
18

WXPolicyEnforcer

Injectable Windows DLL which enforces a W^X memory policy on a process
C
14
star
19

CVE-2015-5119_walkthrough

Archive from the article CVE-2015-5119 Flash ByteArray UaF: A beginner's walkthrough
ActionScript
13
star
20

sudo-parser

sudo-parser is a tool to audit complex sudoers files
Perl
13
star
21

tlsplayback

tlsplayback is a set of Proof of Concepts (PoC) showing real-world replay attacks against TLS 1.3 libraries and browsers by exploiting 0-RTT
Python
12
star
22

mat

MAT is a tool to assess mobile applications
HTML
5
star
23

secdump

secdump is a simple meterpreter module that uploads and runs gsecdump
Ruby
4
star
24

FreeRDP-pth

FreeRDP-pth is a slightly modified version of FreeRDP that tries to authenticate using a password hash instead of a password
C
4
star
25

onesixtyone

Onesixtyone is an SNMP scanner that sends multiple SNMP requests to multiple IP addresses, trying different community strings and waiting for replies
C
3
star
26

SSHatter

SSHatter is a Perl script to perform brute force attacks on SSH
Perl
3
star
27

UNIXSocketScanner

UNIXSocketScanner is a Perl script to scan UNIX domain sockets
Perl
2
star
28

cspCalculator

cspCalculator is a PoC implementation of a dynamic Content Security Policy creator
JavaScript
2
star
29

ms08-067-check

MS08-067 check is Python script which can anonymously check if a target machine or a list of target machines are affected by MS08-067 vulnerability
Python
2
star
30

allthevhosts

allthevhosts is a tool to scrape a series of web applications (including Bing and You Get Signal’s database) and looks at Subject Alternative Names in the SSL certificate to find as many web applications which resolve to an IP address as possible
Python
2
star
31

detect-horizontal-user-brute-force-attack

PowerShell PoC for detecting horizontal user brute force attacks
PowerShell
1
star
32

rmiInfo

rmiInfo is a tool to help extract information from Java Remote Method Invocation (RMI) services, which can then be used to find possible security vulnerabilities
Java
1
star
33

bsql-brute-forcer

bsql-brute-forcer is a Perl script allows extraction of data from Blind SQL Injections
Perl
1
star
34

iker

iker is a Python script to analyse the security of the key exchange phase in IPsec based VPNs
Python
1
star
35

nbtscan

NBTscan is a program for scanning IP networks for NetBIOS name information
C
1
star
36

ownCloud_RCE_CVE-2013-0303

ownCloud PoC for CVE-2013-0303
Python
1
star
37

acccheck

acccheck is a Perl script is designed as a password dictionary attack tool that targets windows authentication via the SMB protocol
Perl
1
star
38

massSSgrab

massSSgrab is a tool that uses the JCIFS library to grab copies of both system and SAM files from “C:\windows\repair\” directory from multiple hosts
Java
1
star
39

vessl

vessl is a bash script that can fetch and verify the SSL certificate of a remote server
Shell
1
star
40

protoanal

Protocol analysis is a Python module which can be used in scripted analysis or interactively using ipython
Python
1
star
41

crash

crash is a tool to catch crashes from OS X applications and print debugging information such as registers, disassembled code and a memory dump of the stack
C
1
star
42

apache-users

apache-users is a Perl script for finding user home directories that are exposed from Apache web server
Perl
1
star
43

openssl3-nov2022

Detection rules to look for OpenSSL 3.x usage and exploitation
1
star
44

tcpy_scanner

Fast cross-platform TCP Connect Scanner written in Python
Python
1
star
45

MIBparse

MIBparse.pl has been designed as an offline parser to quickly parse output from SNMP tools such as ‘snmpwalk’
Perl
1
star
46

viewstate

Viewstate is an ASP.Net viewstate decoder, checker, parser and encoder
C
1
star
47

NVAPT

NVAPT is a set of shell scripts for a Not Very Advanced Persistent Threat PoC for iOS
Shell
1
star
48

AMES

AMES is a tool to parse the new Nessus output files and autogenerate an easy to copy and paste command line exploit using Metasploit CLI
Python
1
star
49

bannergrab

BannerGrab is a tool that performs connection, trigger-based and basic information collection from network services
C
1
star
50

HeaderCheck

HeaderCheck is a Python script used to check the security settings of various headers returned by web servers
Python
1
star
51

ManySSL

ManySSL is a Perl script to enumerate supported SSL cipher suites supported by network services (principally HTTPS)
Perl
1
star
52

wordpress-build-review

WordPress Build Review is a tool to check the basic security settings in a WordPress installation
Shell
1
star
53

smaSHeM

smaSHeM is a System V shared memory segment manipulator
Shell
1
star
54

hoppy

hoppy is a Python script to probe HTTP options and perform scanning for information disclosure issues
Python
1
star
55

RPDscan

RPDscan (Remmina Password Decrypt Scanner) is a tool to find and decrypt saved passwords in Remmina RDP configurations
Python
1
star
56

mysql-bruteforcer

MySQL Bruteforcer is a Python script to assess the strength of the local MySQL access passwords
Python
1
star
57

whitepapers

Papers from the CX Security Labs team
1
star
58

get-dhcp-opts

get-dhcp-opts is a tool to discover DHCP/BOOTP servers on your LAN, and dump the DHCP/BOOTP options
Python
1
star
59

whoislikeaboss

whoislikeaboss is a tool that takes the IP addresses given in a file (one per line), and will give you the range and owner of each of the addresses (with duplicates removed) so you can spot anything that looks fishy before you start testing
Python
1
star
60

winlanfoe

winlanfoe is a tool that parses the output from enum4linux and displays Domain/Workgroup membership, IP address, Operating System (OS) information and if a host is a domain controller
Perl
1
star
61

osboxdeploy

OSBoxDeploy is a set of Ansible playbooks and associated artefacts to deploy OpenStack compute hosted Docker containers. It is work in progress, so do not expect too much, too soon
Python
1
star