Unveiling the Hidden: Discovering RDP Vulnerabilities using PDF Files

The talk examines how RDP, the Windows remote desktop protocol, can be studied without the usual reverse engineering toolkit. The speaker, a security researcher at a secure access vendor, first explains the RDP Gateway role, which carries remote sessions from the internet into an internal network over a TLS tunnel and then forwards them to a target host. Instead of starting with a debugger or disassembler, the research relied on Microsoft's publicly released protocol specifications, open-source client implementations, and packet captures.

Following the specification's rules for message formatting, the researcher found two server message types that were sent without the required null terminator. Sending them crashed a client, and further analysis traced the fault to an off-by-one flaw that could lead to remote code execution on the RDP client. A second line of work looked at the authentication cookie used to set up the UDP side channel. The documented structure contained the username, target server and port, and the signed encoding was recognizable as ASN.1 CMS. Substituting a self-signed certificate got past verification, which allowed log forgery, server-side request forgery into internal UDP services, and amplified denial-of-service traffic, since the gateway sends several packets per connection. Other findings included use of an outdated TLS version over UDP and one further issue not yet disclosed.

The main takeaway is that widely deployed protocols can still hide serious flaws, and that closed source does not mean unexaminable. Researchers were encouraged to start with the documentation, and defenders were urged to read it to understand their exposure. The affected behavior was described as present since Windows Server 2008, so patching was the key recommendation.