> For the complete documentation index, see [llms.txt](https://sarpers-organization.gitbook.io/ctftricks/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sarpers-organization.gitbook.io/ctftricks/_chapter-intro-10/protocol-analysis/networking-protocol-analysis-rdp-analysis.md).

# Rdp Analysis

## Convert PCAP for PyRDP Analysis

Analyzing captured RDP sessions often requires converting the raw packet data into a format usable by specialized tools like PyRDP. The key prerequisite is that the RDP traffic in the PCAP must be **decrypted**. The PCAP file **must** contain decrypted RDP traffic. If the RDP traffic is decrypted in Wireshark, you may need to export the 'OSI Layer 7' PDUs to a new PCAP file first. Wireshark provides a variety of options for exporting packet data. You can save captured packets by using the File → Save or File → Save As... menu items.

Before using the tools, ensure PyRDP is installed. This can typically be done using pip:

```bash
pip install pyrdp
```

Once you have the decrypted PCAP, use the `pyrdp-convert` tool, typically found in your user's local bin directory, providing the path to your PCAP file.

```bash
~/.local/bin/pyrdp-convert [your_decrypted.pcap]
```

Alternatively, the command can be run simply as:

```bash
pyrdp-convert capture.pcapng
```

This command parses the RDP stream within the PCAP, extracts the necessary session data such as screen updates and input, and saves it into a `.pyrdp` file suitable for playback and analysis using the PyRDP player tool. By default, this command will generate a file named after the input PCAP with a `.pyrdp` extension in the same directory. You can also specify an output file using the `-o` option:

```bash
pyrdp-convert capture.pcapng -o output.pyrdp
```

The `pyrdp-convert` tool also supports filtering the input PCAP using Wireshark-like display filters with the `-f` option, or filtering by time range using `--start-time` and `--end-time`.

The output file can then be used with the `pyrdp-player` tool to replay the session. For example:

```bash
pyrdp-player rdp.pyrdp
```

The `pyrdp-player` tool can also be run in headless mode using the `--headless` option, which can be useful for automated processing or generating output without a GUI. You can also specify an output directory for generated files (like screenshots) using `--output-dir`.

Beyond simple playback, the generated `.pyrdp` file can also be programmatically analyzed using the `pyrdp` library itself to extract specific session events like keyboard input, mouse movements, clipboard data, or screen updates. This allows for automated analysis workflows. An example script to load a PyRDP session file and iterate through its events is shown below:

```python
from pyrdp import RDPClient
from pyrdp.internals.input import KeyboardEvent, MouseEvent
from pyrdp.internals.clipboard import ClipboardEvent
from pyrdp.internals.update import ScreenUpdate

# Load the PyRDP session file
client = RDPClient.from_file("rdp.pyrdp")

# Iterate through the session events
for event in client.get_events():
    # Process different event types
    if isinstance(event, KeyboardEvent):
        print(f"Keyboard Event: {event.key_code}")
    elif isinstance(event, MouseEvent):
        print(f"Mouse Event: {event.x}, {event.y}, {event.button}, {event.action}")
    elif isinstance(event, ClipboardEvent):
        print(f"Clipboard Event: {event.text}")
    elif isinstance(event, ScreenUpdate):
        print(f"Screen Update: {event.bounds}")
```

This script demonstrates how to access specific event types within the session data for detailed analysis, including capturing information about screen updates.

***

## Replay RDP Session with PyRDP

Use `pyrdp-player` to visually replay a captured RDP session stored in a `.pyrdp` file. This file must first be generated by the `pyrdp-convert` tool. Once you have a captured RDP stream, you can convert it to the PyRDP specific format using `pyrdp-convert`:

```bash
pyrdp-convert -i decrypted_rdp_stream.bin -o rdp_session.pyrdp
```

After converting the RDP session to the `.pyrdp` format, you can use the `pyrdp-player` tool to watch the session.

```bash
~/.local/bin/pyrdp-player rdp_session.pyrdp
```

This opens a GUI window allowing you to watch the remote desktop screen, keyboard input, and clipboard activity exactly as it occurred during the session. Pay close attention and utilize the pause functionality within the GUI to carefully review segments where sensitive information like passwords might have been typed or data copied to the clipboard.