Why RDP Waits 3 Minutes to Accept Certificate?

[nblair2]

I am wondering why the RDP handler waits for 3 whole minutes before accepting a new certificate? Is there any reason that this period needs to be so long? Would you accept a PR shortening this to something much shorter, like 30 seconds?

[sei-dupdyke]

Does it wait, or is that the timeout?

Regardless, you're right — But my choice would be that this should be configurable as part of the handler, like save-array here:

https://github.com/cmu-sei/GHOSTS/blob/master/src/Ghosts.Client/Sample%20Timelines/Excel.json#L18C95-L18C153

and handled in the code here:

GHOSTS/src/Ghosts.Client/Handlers/Excel.cs

Line 183 in c284e84

if (key.ToString().StartsWith("save-array:"))

😄

[nblair2]

You're right - 3 minutes is the timeout (with retries every minute).

The behavior I am experiencing means that anytime a certificate needs to be accepted there is a 1 minute delay between attempted log in and certificate acceptance. I think this could be solved by either moving the sleep in line 243 to after line 244 and/or increasing the retry rate to something slightly more aggressive like 10 or 15 seconds (while maintaining the 3 minute timeout).

[sei-dupdyke]

Could it be rewritten more like a while loop where until the connection is made it loops on an increasing delay, like 5 seconds the first time, then 10, 20, 40, etc. (exponential falloff)?

[nblair2]

Now we're thinking like computer scientists 😉. I'll take a look but setting up to compile / test my take me a couple of days.

[sei-dupdyke]

:) looks like there is a C# library named Polly that manages this, but I have not looked at it beyond knowing it exists.

[nblair2]

Tested. I changed it so the first wait is a LOT shorter (15 total seconds) before trying to send the key combo to accept a certificate, and then the second wait is a little longer (4.25 minutes). Both waits use exponential back off to check if an RDP window has appeared yet.

[nblair2]

Implemented in #484. Still need to test.

[nblair2]

Tested.

[sei-dupdyke]

Awesome, thank you!

[brown249]

Unsubscribe please to this.

…

On Mon, 13 Jan 2025 at 16:24, Dustin Updyke ***@***.***> wrote: :) looks like there is a C# library named Polly that manages this, but I have not looked at it beyond knowing it exists. — Reply to this email directly, view it on GitHub <#483 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AUPUUUINA6IEXVAXVHHFNMT2KPEA5AVCNFSM6AAAAABU62L3WSVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTCOBSGA2TSMY> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

-- *The entire content of this communication is confidential. This message and any attachments are for the designated or intended recipient only and may contain privileged or proprietary information. If you have received it in error, please notify the sender immediately and delete permanently the original from your system. Any unauthorised use is strictly prohibited, may be unlawful, and subject to criminal or civil liability. You should always  check for viruses before opening any attachments. Consider the environment. Please do not print this email unless it is absolutely necessary.*

[nblair2]

For anyone finding this in the future, a simpler solution is using client hostnames for RDP targets (eg: server.evilcorp.com) over raw IP addresses.