False positives in xrdp weak credential scanning

[maoning]

False positives in xrdp weak credential scanning

[vanhauser-thc]

I looked into this and this seems to be a change on the server side. libfreerdp does not know if a connection was successful or not.

you can try this yourself:
xfreerdp /u:guest /p:PASSWORD /v:localhost +auth-only
now if PASSWORD is correct this will show exactly the same response and error code as when PASSWORD is incorrect.

maybe there is some magic in libfreerdp one can do to identify if a real session is active or another login window or error window is present. but I have not much clue about RDP that I would be able to do that with my limited amount of time that I have.

Someone with time needs to look into this.

[vanhauser-thc]

why are you creating an issue for an outdated version of hydra? please try the current version.

[maoning]

I've tried hydra v9.5 today, it no long prints out [ERROR] freerdp: The connection failed to establish., but the overall behaviour is the same. Hydra always reports credentials found when scanning an xrdp service.

[vanhauser-thc]

ah damn I hoped the various fixes were enough for your case.
do you have a Dockerfile for such an RDP instance so I can easily check this?

[maoning]

I found https://github.com/satishweb/docker-xrdp that can be used to reproduce this issue. My original testing was done by setting up xrdp on a gcp vm. Both work the same way.