Fuzzing and Exploiting Virtual Channels in Microsoft Remote Desktop Protocol for Fun and Profit
summary
A custom WinAFL fork is adapted to send mutated inputs over RDP virtual channels using WinAFL with DynamoRIO process mode and seed logging from the SND channel. Black‑box coverage‑guided fuzzing yields 2 crashes in 4 hours and the first exploitable bug appears within two hours; seven RDP client vulnerabilities are noted in 2019. An info‑leak plus heap RCE chain manipulates allocations via DRDYNVC heap feng shui and finally spawns calc via RCE.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:19Motivation and goals
- 2:54Understanding RDP clients
- 5:54Virtual channel exploitation
- 9:30Fuzzing strategy
- 11:59Fuzzer implementation
- 14:43Targeting RDP channels
- 17:01Vulnerability analysis
- 20:15Fuzzer setup and results
- 22:35Exploitation techniques
- 25:37Demos of exploitation
- 29:13Future work and conclusions
- 33:44Live demo and Q&A
related talks
41mRDP and The Power of Deterministic Snapshot Fuzzing
39mDiving into Windows Remote Access Service for Pre-Auth Bugs
49mHe Said, She Said – Poisoned RDP Offense and Defense
44mFor the Greater Good: Leveraging VMware's RPC Interface for fun and profit
28mFuzzing Malware for Fun & Profit
43mHuman Involvement Behind Remote Desktop Protocol Brute-Force Attacks
39mI Watched You Roll the Die: Unparalleled RDP Monitoring Reveal Attackers' Tradecraft
46mFor The Win: The Art Of The Windows Kernel Fuzzing