Windows Operating System Detection via RDP
Tenable Network Security's research group has released a new Nessus plugin which can make use of the Remote Desktop Protocol (RDP) to accurately detect Windows Vista, 2000 Server, 2003 Server and XP Professional. The Remote Desktop Protocol is also sometimes referred to as Terminal Services. This protocol allows remote users and administrators to view the desktop of a Windows system offering this service to control the mouse, keyboard, run applications and otherwise run the system remotely.
Being able to communicate with RDP (which runs on port 3389) to determine the Windows operating system is very useful. Windows systems that are not part of a domain are often managed through RDP. If they have been hardened with a firewall to only offer the RDP service, this technique is an efficient way to identify the operating system.
As a form of detection, this type is perhaps the easiest for a human to perform, yet requires a high degree of skill and sophistication to perform this with a computer. You and I can usually simply look at a login screen and recognize the "Windows XP Pro", "Windows 2003" or other types of visual queues to identify an operating system. However, performing this type of analysis with a computer is non-trivial.
Consider the following login screen below:
|
You could probably tell this was some sort of Windows system before even trying to enlarge the above image.
Can you tell which version of Microsoft it is?
Can you tell which language this OS has been provisioned for?
Attempting to do this via RDP was an interesting challenge. The RDP protocol offers a variety of information including bitmaps and streams of text (which are really more bitmaps). One could imagine performing optical character recognition on the login screen bitmap logos or even creating a table of checksums for known bitmap images. Both of these techniques aren't reliable as many organizations and third part vendors (like Novell) can change the login bitmaps. Tenable was able to develop a technique to reliably fingerprint the information used to render text during the login process. This text can be used to identify and discriminate Windows XP Pro, Windows 2000, Windows 2003 and Vista operating systems.
Output from this plugin has also been integrated into the os_fingerprint.nasl script, which combines a wide variety of credentialed and non-credentialed operating system guessing techniques to accurately determine a remote operating system.
The plugin is currently available to Direct Feed and Security Center customers and works with the Nessus 3 vulnerability scanner on all available versions. Updating your plugins will automatically make this check available to your Nessus scanner.
Related Articles
Study: Tenable Offers Fastest, Broadest Coverage of CISA's KEV Catalog
October 23, 2023Tenable ranked first in multiple vulnerability management categories, including the most comprehensive coverage and quickest detection of CISA's Known Exploited Vulnerabilities, according to a Miercom report commissioned by Tenable.
Tuning Network Assessments for Performance and Resource Usage
September 13, 2022Using the correct tool for the job and optimizing scanner placement will have a large impact on scan efficiency with Nessus, Tenable.io and Tenable.sc.
Terrascan Joins the Nessus Community, Enabling Nessus To Validate Modern Cloud Infrastructures
May 17, 2022The addition of Terrascan to the Nessus family of products helps users better secure cloud native infrastructure by identifying misconfigurations, security weaknesses, and policy violations by scanning Infrastructure as Code repositories.
Active Directory Under Attack: Five Eyes Guidance Targets Crucial Security Gaps
November 21, 2024A landmark global report from cybersecurity agencies emphasizes 17 attack techniques against Microsoft Active Directory and cautions organizations to step up protections. In the first of our two-part series, we offer five steps you can take today to shore up your AD defenses.
Five Cyber Agencies Sound Alarm About Active Directory Attacks: Beyond the Basics
November 21, 2024A landmark global report emphasizes 17 attack techniques against Microsoft Active Directory and cautions organizations to step up protections. In the second of our two-part series, we take you beyond the basics to highlight three key areas to focus on.
Volt Typhoon: What State and Local Government Officials Need to Know
November 19, 2024Increased activity from the state-sponsored threat group Volt Typhoon raises concerns about the cybersecurity of U.S. critical infrastructure. Here’s how you can identify potential exposures and attack paths.
- Nessus