Add RustdeskPlugin Support #992

Peter-The-Great · 2025-01-16T10:31:19Z

This PR adds support to inspect Rustdesk logs on supported targets (#983). I have tested the Plugin on a both a Linux and Windows machine and they do appear to work. However, if there is any issue with the plugin, just let me know right away and I will try to look in to it.

Rustdesk doesn't support Mac as a server and the original android path was not supported as a relative path.

Peter-The-Great · 2025-01-21T08:06:16Z

IDK, what happened with the checks, but this is a complete disaster and i barely know what exactly went wrong. Although linting should make some sort of indication.

jd-gui · 2025-02-04T15:21:19Z

dissect/target/plugins/apps/remoteaccess/rustdesk.py

+
+
+    RemoteAccessLogRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
+        "remoteaccess/restdesk/log", GENERIC_LOG_RECORD_FIELDS


Typo here on the record descriptor, should be remoteaccess/rustdesk/log

jd-gui · 2025-02-04T16:28:08Z

@Peter-The-Great Should also use pep8 for formatting as the linter is expecting blank lines and some lines are too long. Have reformatted and attached the two code files here if you like
reformatted.zip

Peter-The-Great · 2025-02-04T21:28:47Z

Alright i have just added the PEP 8 code Style to the code and fixed the typo.

Horofic · 2025-02-11T11:47:39Z

dissect/target/plugins/apps/remoteaccess/rustdesk.py

@@ -0,0 +1,115 @@
+import logging


Suggested change

import logging

from __future__ import annotations

Horofic · 2025-02-11T11:48:04Z

dissect/target/plugins/apps/remoteaccess/rustdesk.py

+
+log = logging.getLogger(__name__)


Suggested change

log = logging.getLogger(__name__)

Horofic · 2025-02-11T11:48:20Z

dissect/target/plugins/apps/remoteaccess/rustdesk.py

+    SERVER_GLOBS = [
+        # Windows >= Windows 7
+        "sysvol/Windows/ServiceProfiles/LocalService/AppData/Roaming/RustDesk/log/server/*.log",
+


Suggested change

Horofic · 2025-02-11T11:48:38Z

dissect/target/plugins/apps/remoteaccess/rustdesk.py

+    USER_GLOBS = [
+        # Windows
+        "AppData/Roaming/Rustdesk/log/*.log",
+
+        # Linux
+        ".local/share/logs/RustDesk/server/*.log",
+
+        # Android
+        "storage/emulated/0/RustDesk/logs/*.log",
+
+        # Mac
+        "Library/Logs/RustDesk/*.log",


Suggested change

USER_GLOBS = [

# Windows

"AppData/Roaming/Rustdesk/log/*.log",

# Linux

".local/share/logs/RustDesk/server/*.log",

# Android

"storage/emulated/0/RustDesk/logs/*.log",

# Mac

"Library/Logs/RustDesk/*.log",

USER_GLOBS = [

# Windows

"AppData/Roaming/Rustdesk/log/*.log",

# Linux

".local/share/logs/RustDesk/server/*.log",

# Android

"storage/emulated/0/RustDesk/logs/*.log",

# Mac

"Library/Logs/RustDesk/*.log",

Horofic · 2025-02-11T11:59:48Z

tests/plugins/apps/remoteaccess/test_rustdesk.py

+
+    assert records[0].ts == datetime(2025, 1, 1, 13, 4, 8, 350802, tzinfo=timezone.utc)
+    assert records[0].message == "DEBUG src\\server\\connection.rs:983 #1362 Connection opened from REDACTED IP:6074."
+    assert records[0].source == "sysvol/Windows/ServiceProfiles/LocalService/AppData/Roaming/RustDesk/log/server/TestRustdesk.log"


Suggested change

assert records[0].source == "sysvol/Windows/ServiceProfiles/LocalService/AppData/Roaming/RustDesk/log/server/TestRustdesk.log"

assert (

records[0].source

== "sysvol/Windows/ServiceProfiles/LocalService/AppData/Roaming/RustDesk/log/server/TestRustdesk.log"

)

Horofic · 2025-02-11T12:03:48Z

dissect/target/plugins/apps/remoteaccess/rustdesk.py

+        user = None
+        for log_glob in self.SERVER_GLOBS:
+            for log_file in self.target.fs.path().glob(log_glob):
+                self.log_files.add((log_file, user))


Suggested change

user = None

for log_glob in self.SERVER_GLOBS:

for log_file in self.target.fs.path().glob(log_glob):

self.log_files.add((log_file, user))

for log_glob in self.SERVER_GLOBS:

for log_file in self.target.fs.path().glob(log_glob):

self.log_files.add((log_file, None))

Horofic · 2025-02-11T12:04:50Z

dissect/target/plugins/apps/remoteaccess/rustdesk.py

+    def __init__(self, target):
+        super().__init__(target)
+
+        self.log_files: set[tuple[TargetPath, UserDetails]] = set()


Suggested change

self.log_files: set[tuple[TargetPath, UserDetails]] = set()

self.log_files: set[tuple[TargetPath, UserDetails | None]] = set()

Horofic · 2025-02-11T12:24:43Z

tests/plugins/apps/remoteaccess/test_rustdesk.py

+
+def test_rustdesk_plugin_log(target_win_users: Target, fs_win: VirtualFilesystem) -> None:
+    fs_win.map_file(
+        "sysvol/Windows/ServiceProfiles/LocalService/AppData/Roaming/RustDesk/log/server/TestRustdesk.log",


Suggested change

"sysvol/Windows/ServiceProfiles/LocalService/AppData/Roaming/RustDesk/log/server/TestRustdesk.log",

"Windows/ServiceProfiles/LocalService/AppData/Roaming/RustDesk/log/server/TestRustdesk.log",

Horofic · 2025-02-11T13:05:38Z

dissect/target/plugins/apps/remoteaccess/rustdesk.py

+
+                    ts, level, source, message = match.groups()
+
+                    timestamp = datetime.fromisoformat(ts)


It looks like the ts parsed from the log file is not a valid ISO format timestamp because of the space between the timestamp and +01:00. This causes the tests to fail currently.

Horofic · 2025-02-11T13:10:19Z

dissect/target/plugins/apps/remoteaccess/rustdesk.py

+                line = line.strip()
+
+                try:
+                    # Still needs to be checked for Rustdesk implementation
+                    match = re.match(r"\[(.*?)\] (\w+) \[(.*?)\] (.*)", line)
+                    if not match:
+                        raise ValueError("Line does not match expected format")
+
+                    ts, level, source, message = match.groups()
+
+                    timestamp = datetime.fromisoformat(ts)
+                    message = re.sub(r"\s\s+", " ", f"{level} {source} {message}")
+
+                    yield self.RemoteAccessLogRecord(
+                        ts=timestamp,
+                        message=message,
+                        source=log_file,
+                        _target=self.target,
+                        _user=user,
+                    )
+
+                except ValueError as e:
+                    self.target.log.warning("Could not parse log line in file %s: '%s'", log_file, line)
+                    self.target.log.debug("", exc_info=e)


Suggested change

line = line.strip()

try:

# Still needs to be checked for Rustdesk implementation

match = re.match(r"\[(.*?)\] (\w+) \[(.*?)\] (.*)", line)

if not match:

raise ValueError("Line does not match expected format")

ts, level, source, message = match.groups()

timestamp = datetime.fromisoformat(ts)

message = re.sub(r"\s\s+", " ", f"{level} {source} {message}")

yield self.RemoteAccessLogRecord(

ts=timestamp,

message=message,

source=log_file,

_target=self.target,

_user=user,

)

except ValueError as e:

self.target.log.warning("Could not parse log line in file %s: '%s'", log_file, line)

self.target.log.debug("", exc_info=e)

if line := line.strip():

try:

# Still needs to be checked for Rustdesk implementation

match = re.match(r"\[(.*?)\] (\w+) \[(.*?)\] (.*)", line)

if not match:

raise ValueError("Line does not match expected format")

ts, level, source, message = match.groups()

timestamp = datetime.fromisoformat(ts)

message = re.sub(r"\s\s+", " ", f"{level} {source} {message}")

yield self.RemoteAccessLogRecord(

ts=timestamp,

message=message,

source=log_file,

_target=self.target,

_user=user,

)

except ValueError as e:

self.target.log.warning("Could not parse log line in file %s: '%s'", log_file, line)

self.target.log.debug("", exc_info=e)

Horofic · 2025-02-11T13:20:59Z

dissect/target/plugins/apps/remoteaccess/rustdesk.py

+
+    @export(record=RemoteAccessLogRecord)
+    def logs(self) -> Iterator[RemoteAccessLogRecord]:
+        """Parse Rustdesk log files.


Suggested change

"""Parse Rustdesk log files.

"""Parse RustDesk log files.

Horofic · 2025-02-11T13:21:10Z

dissect/target/plugins/apps/remoteaccess/rustdesk.py

+    def logs(self) -> Iterator[RemoteAccessLogRecord]:
+        """Parse Rustdesk log files.
+
+        Rustdesk is remote access software that allows users to connect to a remote computer.


Suggested change

Rustdesk is remote access software that allows users to connect to a remote computer.

RustDesk is a remote desktop application can be used by adversaries to get (persistent) access to a machine.

Horofic · 2025-02-11T13:25:27Z

dissect/target/plugins/apps/remoteaccess/rustdesk.py

+        The project is open source and can be found at: https://github.com/rustdesk/rustdesk/
+
+        The log files are stored in different locations, based on the Target OS and client type.
+        Unlike Anydesk, Rustdesk does have a carry a time zone designator (TZD).


Suggested change

Unlike Anydesk, Rustdesk does have a carry a time zone designator (TZD).

Unlike AnyDesk, RustDesk does carry a time zone designator (TZD).

Peter-The-Great added 6 commits January 14, 2025 23:10

Add Rustdesk remote access plugin for log parsing. fox-it#983

b02c722

Removed Unnecassary Server_Glob paths (fox-it#983)

96847d3

Add tests for Rustdesk plugin log parsing (fox-it#983)

3a7fc5a

Merge branch 'fox-it:main' into add-rustdesk

3791cfa

Merge branch 'fox-it:main' into add-rustdesk

299d342

Removed Mac for servers and removed / from Android path. (fox-it#983)

d59df9f

Rustdesk doesn't support Mac as a server and the original android path was not supported as a relative path.

Peter-The-Great marked this pull request as ready for review January 20, 2025 11:59

EinatFox linked an issue Jan 20, 2025 that may be closed by this pull request

Create RustDesk plugin #983

Open

jd-gui reviewed Feb 4, 2025

View reviewed changes

Peter-The-Great added 3 commits February 4, 2025 21:53

Merge branch 'fox-it:main' into add-rustdesk

59aa1e8

Update rustdesk.py to fix typo and use the PEP 8 style.

91f3564

Update test_rustdesk.py to use the PEP 8 code Style.

3bbbce0

Horofic requested changes Feb 11, 2025

View reviewed changes

Horofic self-assigned this Feb 11, 2025

Merge branch 'main' into add-rustdesk

d147a06

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add RustdeskPlugin Support #992

Add RustdeskPlugin Support #992

Peter-The-Great commented Jan 16, 2025

Peter-The-Great commented Jan 21, 2025

jd-gui Feb 4, 2025

jd-gui commented Feb 4, 2025

Peter-The-Great commented Feb 4, 2025

Horofic Feb 11, 2025

Horofic Feb 11, 2025

Horofic Feb 11, 2025

Horofic Feb 11, 2025

Horofic Feb 11, 2025

Horofic Feb 11, 2025

Horofic Feb 11, 2025

Horofic Feb 11, 2025

Horofic Feb 11, 2025

Horofic Feb 11, 2025

Horofic Feb 11, 2025

Horofic Feb 11, 2025 •

edited

Loading

Horofic Feb 11, 2025



		RemoteAccessLogRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
		"remoteaccess/restdesk/log", GENERIC_LOG_RECORD_FIELDS

	self.log_files: set[tuple[TargetPath, UserDetails]] = set()
	self.log_files: set[tuple[TargetPath, UserDetails \| None]] = set()

	"sysvol/Windows/ServiceProfiles/LocalService/AppData/Roaming/RustDesk/log/server/TestRustdesk.log",
	"Windows/ServiceProfiles/LocalService/AppData/Roaming/RustDesk/log/server/TestRustdesk.log",


		ts, level, source, message = match.groups()

		timestamp = datetime.fromisoformat(ts)

	Rustdesk is remote access software that allows users to connect to a remote computer.
	RustDesk is a remote desktop application can be used by adversaries to get (persistent) access to a machine.

	Unlike Anydesk, Rustdesk does have a carry a time zone designator (TZD).
	Unlike AnyDesk, RustDesk does carry a time zone designator (TZD).

Add RustdeskPlugin Support #992

Are you sure you want to change the base?

Add RustdeskPlugin Support #992

Conversation

Peter-The-Great commented Jan 16, 2025

Peter-The-Great commented Jan 21, 2025

Choose a reason for hiding this comment

jd-gui commented Feb 4, 2025

Peter-The-Great commented Feb 4, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Horofic Feb 11, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Horofic Feb 11, 2025 •

edited

Loading