A Logo

Feel free to include my content in your page via my
RSS feed

Help Irongeek.com pay for
bandwidth and research equipment:

Subscribestar or Patreon

Search Irongeek.com:

Affiliates:
Irongeek Button
Social-engineer-training Button

Help Irongeek.com pay for bandwidth and research equipment:

paypalpixle


Welcome to the Jumble: Improving RDP Tooling for Malware Analysis and Pentesting - ?ilio Gonzalez, Francis Labelle Derbycon 2019 (Hacking Illustrated Series InfoSec Tutorial Videos)

Welcome to the Jumble: Improving RDP Tooling for Malware Analysis and Pentesting
?ilio Gonzalez, Francis Labelle
Derbycon 2019

The RDP protocol has a wide variety of interesting features, yet no tool supported the complexity of the protocol for information security purposes. To address this, created PyRDP, an open-source, general-purpose RDP man-in-the-middle (MITM) tool. It allows complete interception of RDP sessions with offensive capabilities and advanced features to analyze such sessions, such as listing the client?s drive content, saving the transferred files and clipboard content. This opens the door for new techniques in malware research and pentesting for a protocol that is increasingly looked at by security researchers. We will demonstrate this by showing replays of a bad actor we caught using PyRDP. The talk will also give recommendations to mitigate the risk of MITM attacks on a network.

Francis and ?ilio are undergraduate students from (respectively) ?ole de Technologie Sup?ieure and Universit?de Sherbrooke in Canada. Both have a strong interest in information security and are involved with their university?s computer science club. Francis participates competitively in several CTF competitions with the DCIETS team and is interested in the offensive side of cybersecurity. ?ilio organizes several computer science-related events for the students of his university and likes to learn about the defensive side of cybersecurity.

@res260, @xshill_

Back to Derbycon 2019 video list

Printable version of this article

15 most recent posts on Irongeek.com:


    If you would like to republish one of the articles from this site on your webpage or print journal please contact IronGeek.

    Copyright 2019, IronGeek
    Louisville / Kentuckiana Information Security Enthusiast