Re: RDP protocol details

For anyone interested I got the Client_Security_Data added to the rdp
analyzer.  Pull request is open.  Please let me know thoughts.

https://github.com/zeek/zeek/pull/400

On Wed, Jun 5, 2019 at 3:34 PM Neslog <[email protected]> wrote:

> lol, too funny.  I look forward to it and thanks.
>
> That said I'm looking for where the client sends it's supported encryption
> algos and methods.  I'm still learning the protocol, doesn't look like Bro
> is parsing out the encryption methods or encoding methods.  Actually see
> the Client security data commented out in rep-protocol.pac.
>
>                 #0xc002  -> client_security:   Client_Security_Data;
>
> Looks like there's still more work to be done with parsing out the data?
>
>
>
>
> On Wed, Jun 5, 2019 at 3:14 PM Justin Azoff <[email protected]> wrote:
>
>> not so much bro -> zeek but that it was just added 8 days ago:
>>
>> https://github.com/zeek/zeek/pull/384
>>
>> try.{bro,zeek}.org will work once I build a new master container... I'll
>> try to get to that soon if not today.
>>
>> On Wed, Jun 5, 2019 at 3:07 PM Neslog <[email protected]> wrote:
>>
>>> Solved: Answer at the bottom.
>>>
>>> Yes, that's the data I'm looking for.  Unfortunately when I try to load
>>> the event with those details I receive an error.
>>>
>>> error in ././trybro.bro, line 11: identifier not defined:
>>> RDP::ClientChannelList
>>> http://try.bro.org/#/trybro/saved/329529
>>>
>>> I pulled this event from bro/src/analyzer/protocol/rdp/events.bif.
>>> event rdp_client_network_data%(c: connection, channels:
>>> RDP::ClientChannelList%);
>>>
>>> Am I missing something?  maybe need to define that in my init-bare?
>>>
>>> Digging into it deeper... looks like it was using GitHub.com/bro vs
>>> GitHub.com/zeek.  Guess I'll have to officially migrate off Bro to Zeek.
>>>
>>> On Wed, Jun 5, 2019 at 2:32 PM Justin Azoff <[email protected]>
>>> wrote:
>>>
>>>> Does this help?
>>>>
>>>>
>>>> https://github.com/zeek/zeek/blob/1e488d7ebe2c889b20333a4196512e069e34f630/scripts/base/init-bare.zeek#L4279-L4306
>>>>
>>>> channels is a vector of RDP::ClientChannelDef
>>>>
>>>> On Wed, Jun 5, 2019 at 2:15 PM Neslog <[email protected]> wrote:
>>>>
>>>>> Hi I'm looking at RDP protocol and looking for some details.  I'm
>>>>> looking for encryption algorithms
>>>>> and methods supported by the client.  I believe it would be in the
>>>>> following event but not sure where I pulled it from.
>>>>>
>>>>> event rdp_client_network_data(c: connection, channels:
>>>>> ClientChannelList)
>>>>>
>>>>> Appreciate any insights.
>>>>> _______________________________________________
>>>>> Zeek mailing list
>>>>> [email protected]
>>>>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
>>>>
>>>>
>>>>
>>>> --
>>>> Justin
>>>>
>>>
>>
>> --
>> Justin
>>
>

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek