\n\nThis page has been machine-translated from the original page.
\n
This article explains how to capture and decrypt RDP packets with WireShark.
\nIf you just want to view RDP packet contents with WireShark, the easiest way is to use the pcap and pem files distributed on the official site below.
\nReference: Wiki · Wireshark Foundation
\nThis article will proceed while referencing the steps in Wiresharkによるパケット解析講座 11: RDPトラフィックの復号.
\nThere were some situations where following that article’s steps exactly didn’t work well, so I’ll cover those aspects as well.
\n\nI set up the following environment for this project:
\nThe RDP server host has remote desktop connection enabled.
\nBoth are connected via VirtualBox internal network.
\nThe applications used are as follows:
\nFirst, open the Group Policy Editor (gpedit.msc) on the client side and remove Forward Secrecy ciphers.
Forward Secrecy is not an encryption method using the server’s private and public keys, but rather an encryption technique using data created from secret keys held by both the client and server.
\nUsing Forward Secrecy has the advantage that even if one party’s secret key is leaked, the data cannot be decrypted and security is maintained.
\nBy default, Windows RDP communication uses encryption with Forward Secrecy, so packets cannot be decrypted from WireShark using a single private key.
\nTherefore, it’s necessary to first remove Forward Secrecy ciphers on the client side.
\nAs shown in the image below, open the SSL cipher order setting from the SSL configuration settings and set it to [Enabled].
\nWhen enabled, a list of SSL ciphers will be stored in the [Options] field.
\nWhen I enabled it in my environment (Windows 10 Pro 20H2), the following cipher suites were defined by default:
\nTLS_AES_256_GCM_SHA384、TLS_AES_128_GCM_SHA256、TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384、TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256、TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384、TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256、TLS_DHE_RSA_WITH_AES_256_GCM_SHA384、TLS_DHE_RSA_WITH_AES_128_GCM_SHA256、TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384、TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256、TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384、TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256、TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA、TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA、TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA、TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA、TLS_RSA_WITH_AES_256_GCM_SHA384、TLS_RSA_WITH_AES_128_GCM_SHA256、TLS_RSA_WITH_AES_256_CBC_SHA256、TLS_RSA_WITH_AES_128_CBC_SHA256、TLS_RSA_WITH_AES_256_CBC_SHA、TLS_RSA_WITH_AES_128_CBC_SHA、TLS_RSA_WITH_3DES_EDE_CBC_SHA、TLS_RSA_WITH_NULL_SHA256、TLS_RSA_WITH_NULL_SHA、TLS_PSK_WITH_AES_256_GCM_SHA384、TLS_PSK_WITH_AES_128_GCM_SHA256、TLS_PSK_WITH_AES_256_CBC_SHA384TLS_PSK_WITH_AES_128_CBC_SHA256、TLS_PSK_WITH_NULL_SHA384、TLS_PSK_WITH_NULL_SHA256In this step, manually delete some of the default cipher suites.
\nWhat’s being removed here are cipher suites related to DHE (Diffie-Hellman key exchange) and ECDHE (Elliptic Curve Diffie-Hellman key exchange), which are currently practical Forward Secrecy encryption methods.
\nAfter deletion, the settings will look like this:
\nI’ll simplify it to just TLS_RSA_WITH_AES_128_CBC_SHA256.
TLS_RSA_WITH_AES_128_CBC_SHA256Copy and paste this setting value into the [SSL Cipher Suites] form and press the OK button to complete the configuration.
\nJust to be safe, execute the following command in the command prompt to apply the Group Policy settings:
\ngpupdate /forceThis completes the disabling of Forward Secrecy.
\n※ As mentioned later, this step alone is insufficient, and in my environment the cipher suite wasn’t changed until I restarted the OS.
\nNext, export the certificate from the RDP server side.
\nTools like Mimikatz can also be used for export, but I used Jailbreak, which was used in the reference article.
\nTo retrieve using Mimikatz, refer to the following procedure:
\nReference: FreeRDP-wiki/Mimikatz.md at master · ypid/FreeRDP-wiki
\nDownload the ZIP file from the Jailbreak repository and execute jailbreak64.exe stored in the binaries folder from a command prompt running with administrator privileges.
jailbreak64.exe %WINDIR%\\system32\\mmc.exe %WINDIR%\\system32\\certlm.msc -64When execution completes, the certificate store screen launches, and you can confirm that an RDP certificate has been created in [Remote Desktop]>[Certificates], so export it.
\nI tried to decrypt the captured packets here, but for some reason it didn’t work.
\nI tried changing keys and various other things, but ultimately it didn’t work.
\nNo wonder, when I checked the Server Hello packet during RDP communication, it appeared to be using ECDHE as the cipher suite. (Forward Secrecy wasn’t disabled…)
\nApparently gpupdate /force alone was insufficient, so I restarted the OS.
After that, I captured packets again and successfully obtained RDP communication packets using the TLS_RSA_WITH_AES_128_CBC_SHA256 cipher suite.
Finally made it here.
\nFinally, decrypt the captured packets.
\nOpen the captured pcap file in WireShark and open [Preferences] from the [Edit] tab in the toolbar.
\nNext, select [TLS] from the protocol list in the left tree and open the settings.
\nFinally, enter the following settings from the edit in [RSA keys list]:
\nIP address : \"RDP server's IP address\"\nPort : \"RDP connection destination port (3389)\"\nProtocol : \"tpkt\"\nKey File : \"RSA key file extracted from certificate\"When this setting is applied, RDP packets are decrypted and become filterable.
\nGreat work!!
\nBasically, I followed the steps in Wiresharkによるパケット解析講座 11: RDPトラフィックの復号, but some steps didn’t reproduce well exactly as written in the article, so I struggled a bit.
\nAs a result, I learned about WireShark and Windows cipher suites, so I think it was worthwhile to try it.
\nIf I feel like it, I’ll write an article about the details of the RDP protocol.
\nHowever, I’m not really motivated to read this approximately 500-page reference, so it will really be when I feel like it.
\nReference: [MS-RDPBCGR]: Remote Desktop Protocol: Basic Connectivity and Graphics Remoting | Microsoft Docs
","fields":{"slug":"/wireshark-decrypt-rdppacket-en","tagSlugs":["/tag/wire-shark-en/","/tag/windows-en/","/tag/network-en/","/tag/english/"]},"frontmatter":{"date":"2021-10-19","description":"This article explains how to capture and decrypt RDP packets with WireShark.","tags":["WireShark (en)","Windows (en)","Network (en)","English"],"title":"Removing Forward Secrecy to Decrypt RDP Packets with WireShark","socialImage":{"publicURL":"/static/dc4d8b7f8795f3c3d3489d9957d155f2/no-image.png"}}}},"pageContext":{"slug":"/wireshark-decrypt-rdppacket-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}