{"action":"created","issue":{"url":"https://api.github.com/repos/SySS-Research/Seth/issues/22","repository_url":"https://api.github.com/repos/SySS-Research/Seth","labels_url":"https://api.github.com/repos/SySS-Research/Seth/issues/22/labels{/name}","comments_url":"https://api.github.com/repos/SySS-Research/Seth/issues/22/comments","events_url":"https://api.github.com/repos/SySS-Research/Seth/issues/22/events","html_url":"https://github.com/SySS-Research/Seth/issues/22","id":332154208,"node_id":"MDU6SXNzdWUzMzIxNTQyMDg=","number":22,"title":"Seth error out (\"NameError: name 'crypto' is not defined\") - via Standard RDP Security (NLA not enforced, no TLS)","user":{"login":"mocredz","id":40238820,"node_id":"MDQ6VXNlcjQwMjM4ODIw","avatar_url":"https://avatars2.githubusercontent.com/u/40238820?v=4","gravatar_id":"","url":"https://api.github.com/users/mocredz","html_url":"https://github.com/mocredz","followers_url":"https://api.github.com/users/mocredz/followers","following_url":"https://api.github.com/users/mocredz/following{/other_user}","gists_url":"https://api.github.com/users/mocredz/gists{/gist_id}","starred_url":"https://api.github.com/users/mocredz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mocredz/subscriptions","organizations_url":"https://api.github.com/users/mocredz/orgs","repos_url":"https://api.github.com/users/mocredz/repos","events_url":"https://api.github.com/users/mocredz/events{/privacy}","received_events_url":"https://api.github.com/users/mocredz/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":15,"created_at":"2018-06-13T20:36:26Z","updated_at":"2018-06-14T09:19:42Z","closed_at":"2018-06-14T09:01:26Z","author_association":"NONE","body":"Hi all,\r\n\r\nI am having an issue getting Seth to work with a RDP connection (see error on the bottom).  The server is not enforcing NLA, and the client is configured to using **standard RDP security**, so that RDP session pops right up and user are prompted user/password inside the RDP session.\r\n\r\nThe setup is:\r\n\r\n- Client RDP config has these settings below which differs from the default RDP profile.  The `enablecredsspsupport:i:0` setting allows RDP to sessions to first established (no prompt for username/password first).  This is done so for the two-factor authentication, where users do not use AD credential to log in but some sort of PIN + Passcode.  The authentication level `authentication level:i:0` is so it does not do validate or authenticate the server's SSL/TLS certificate, allow it just to connect:\r\n```\r\nauthentication level:i:0\r\nenablecredsspsupport:i:0\r\n```\r\n- Server does not enforce NLA, running Windows 2018 R2\r\n- The setup currently is all system on the same subnet, including the attacker machine, which runs the latest version of Kali 2018.2.\r\n\r\n**Video recording:**  https://vimeo.com/274944143\r\n**Seth error message:**  https://pastebin.com/GHEQumTx\r\n**[RDP-NoCredSSPSupport-NoServerAuthentication.rdp](https://github.com/SySS-Research/Seth/files/2101516/RDP-NoCredSSPSupport-NoServerAuthentication.rdp.txt)**: https://pastebin.com/DS0NfgnD\r\n\r\nWhen taking out `authentication level:i:0` and leaving in `enablecredsspsupport:i:0` for the RDP config *(video starting minute 1:58)*, where it has a SSL warning, it will work.  If I configured `seth.sh` to downgrade to level 0 from the default level of 3, it fails with the same error message.  Once I add the `authentication level:i:0` back in to the RDP config, it fails completely, doesn't matter if seth.sh is set to the default of `SETH_DOWNGRADE=3`.\r\n\r\nI believe this is the `authentication level:i:0` config in the RPD profile is breaking Seth, as the default downgrade is level 3, which still requires SSL, so without it, Seth didn't know what to do.  However, upon making `SETH_DOWNGRADE=0` in `seth.sh`, the same error still error:\r\n\r\n```\r\nroot@kali:~/scripts/Seth# ./seth.sh eth0 172.16.10.{134,50,200}\r\n███████╗███████╗████████╗██╗  ██╗\r\n██╔════╝██╔════╝╚══██╔══╝██║  ██║   by Adrian Vollmer\r\n███████╗█████╗     ██║   ███████║   seth@vollmer.syss.de\r\n╚════██║██╔══╝     ██║   ██╔══██║   SySS GmbH, 2017\r\n███████║███████╗   ██║   ██║  ██║   https://www.syss.de\r\n╚══════╝╚══════╝   ╚═╝   ╚═╝  ╚═╝\r\n[*] Spoofing arp replies...\r\n[*] Turning on IP forwarding...\r\n[*] Set iptables rules for SYN packets...\r\n[*] Waiting for a SYN packet to the original destination...\r\n[+] Got it! Original destination is 172.16.10.200\r\n[*] Clone the x509 certificate of the original destination...\r\n[*] Adjust the iptables rule for all packets...\r\n[*] Run RDP proxy...\r\nListening for new connection\r\nConnection received from 172.16.10.50:49509\r\nDowngrading authentication options from 1 to 0\r\nListening for new connection\r\nConnection lost ([Errno 104] Connection reset by peer)\r\nConnection received from 172.16.10.50:49510\r\nListening for new connection\r\nException in thread Thread-2:\r\nTraceback (most recent call last):\r\n  File \"/usr/lib/python3.6/threading.py\", line 916, in _bootstrap_inner\r\n    self.run()\r\n  File \"/root/scripts/Seth/seth/main.py\", line 47, in run\r\n    self.forward_data()\r\n  File \"/root/scripts/Seth/seth/main.py\", line 173, in forward_data\r\n    data = tamper_data(data, self.vars, From=From)\r\n  File \"/root/scripts/Seth/seth/parsing.py\", line 313, in tamper_data\r\n    result = replace_server_cert(bytes, vars[\"crypto\"])\r\n  File \"/root/scripts/Seth/seth/parsing.py\", line 197, in replace_server_cert\r\n    crypto[\"pubkey_blob\"])\r\n  File \"/root/scripts/Seth/seth/crypto.py\", line 223, in sign_certificate\r\n    return s.to_bytes(len(crypto[\"sign\"]), \"little\")\r\nNameError: name 'crypto' is not defined\r\n```"},"comment":{"url":"https://api.github.com/repos/SySS-Research/Seth/issues/comments/397229553","html_url":"https://github.com/SySS-Research/Seth/issues/22#issuecomment-397229553","issue_url":"https://api.github.com/repos/SySS-Research/Seth/issues/22","id":397229553,"node_id":"MDEyOklzc3VlQ29tbWVudDM5NzIyOTU1Mw==","user":{"login":"mocredz","id":40238820,"node_id":"MDQ6VXNlcjQwMjM4ODIw","avatar_url":"https://avatars2.githubusercontent.com/u/40238820?v=4","gravatar_id":"","url":"https://api.github.com/users/mocredz","html_url":"https://github.com/mocredz","followers_url":"https://api.github.com/users/mocredz/followers","following_url":"https://api.github.com/users/mocredz/following{/other_user}","gists_url":"https://api.github.com/users/mocredz/gists{/gist_id}","starred_url":"https://api.github.com/users/mocredz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mocredz/subscriptions","organizations_url":"https://api.github.com/users/mocredz/orgs","repos_url":"https://api.github.com/users/mocredz/repos","events_url":"https://api.github.com/users/mocredz/events{/privacy}","received_events_url":"https://api.github.com/users/mocredz/received_events","type":"User","site_admin":false},"created_at":"2018-06-14T09:19:42Z","updated_at":"2018-06-14T09:19:42Z","author_association":"NONE","body":"Thanks @AdrianVollmer, I tried the latest commit https://github.com/SySS-Research/Seth/commit/09a6267121c7e97ca59b268b76fb81c0343112b2 it is not parsing it correctly, however, I am able to see that in debug mode the text are coming across.  Any pointers on fixing it?"}}
{"actor":{"display_login":"mocredz"}}