He Said, She Said – Poisoned RDP Offense and Defense
summary
Connecting to a malicious RDP server can silently compromise the client by abusing clipboard file-copy formats: code audits find 11 critical bugs in rdesktop and 5 critical bugs in FreeRDP, while mstsc resists simple crashes but exposes a path-traversal via file-group-descriptor that lets a server drop files (eg. into Startup) on the client, enabling VM-escape via Hyper‑V. A defense uses built‑in ETW (events 131/132 + clipboard traces) to correlate pastes with file-creation for detection; Microsoft ships a patch that validates canonical paths.
AI-written summary · about
chapters (36)
- 0:00Introduction
- 1:38Overview
- 2:31Lazy Lateral Movement
- 4:59RDP
- 5:52What is Poison
- 7:17RDP Clients
- 7:59Open Source
- 9:31RDP Protocol
- 10:48Vulnerability List
- 11:55Parsing bitmaps
- 14:17RDP Client
- 15:15Clipboard
- 16:54Blacklists
- 18:09File Copy
- 20:04File descriptor
- 21:07Path level cell
- 21:37Clipboard synchronized
- 21:55eavesdropping
- 22:16pasted on
- 22:51HyperV
- 23:26Behind the Scenes
- 24:18HyperV Test
- 25:25WDD
- 26:22Bug Bounty Program
- 27:09New Detection
- 29:01Event Tracing
- 29:59RDP Connection Provider
- 30:34Clipboard Provider
- 32:38Demo
- 33:29Detection logic
- 34:47File creation events
- 35:36File creation timestamps
- 36:49Detecting malicious behaviors
- 38:53Update
- 40:02Lessons Learned
- 42:17Questions
related talks
39mFuzzing and Exploiting Virtual Channels in Microsoft Remote Desktop Protocol for Fun and Profit
39mI Watched You Roll the Die: Unparalleled RDP Monitoring Reveal Attackers' Tradecraft
41mServer Tailgating - A Chosen-PlainText Attack on RDP
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks
43mHuman Involvement Behind Remote Desktop Protocol Brute-Force Attacks
52mStart covering your bases & Stop chasing APT headlines
46mD2T2 - Over The Edge: Pwning The Windows Kernel