Andy Dixon
50c0104d57
clients::rdp connects over any caller-dialled TCP stream (direct, proxy or SSH tunnel), upgrades to TLS and logs on with NLA (CredSSP/NTLM), optionally falling back to TLS-only logon for servers without NLA such as xrdp (credentials are passed so they log straight in). The server certificate is pinned through a caller check on its SHA256 fingerprint before any credentials are sent. The desktop decodes into the VNC client's RGBA framebuffer; input (IronRDP's scancode/Unicode/mouse operations), Display Control resizes and the deactivation-reactivation sequence run on the session thread. IronRDP's releases need three vendored patches (vendor/README.md): picky and sspi with their RustCrypto release-candidate pins relaxed so they share russh's stable versions (their own suites, 402 tests, pass against them), and ironrdp-session with two unreleased upstream bitmap fixes (#1486 stride, #1524 RDP6 orientation) without which xrdp desktops render sheared. Verified live against xrdp (scottyhardy/docker-remote-desktop): logon, full desktop rendering, keyboard and mouse input.
AADJoin
Purpose of this tool
This tool simulates new device joining to the Azure Active Directory and device certificates obtaining.
It can obtain three types of certificates:
- the device certificate;
- the client certificate for the P2P authorization
- the server certificate for the P2P authorization
All generated keys, CSRs, and certificates will be saved in appropriate files. You will see paths to them in logs.
How use it
AADJoin 1.0.0
Copyright (C) 2022 AADJoin
-j, --join-new-device Join new device to the Azure AD
-c, --client-p2p-cert Obtain P2P certificate for the client authorization
-s, --server-p2p-cert Obtain P2P certificate for the server authorization
-d, --domain Required. Azure AD domain
-u, --username Required. User Azure AD username in FQDN format
-p, --password Required. User password
-e, --existing-device Path to the PFX file with the device key + certificate
-f, --pfx-key-password PFX file password
--help Display this help screen.
--version Display version information.
Attention: To run this tool you need .Net 6.0.8 runtime
Example
Create and join a new device to the AzureAD:
AADJoin.exe --join-new-device --domain dataans.com --username s10@dataans.com --password wwwWWW222@@@
The comman above will create a three files:
<device id>.key- the device private key;<random guid>.csr- the certificate request that had been used for the device certificate generation;<device id>.cer- the device certificate;
My example:
03b8620d-12ff-48ee-b036-e1cf4c598609.key
007bfc57-2504-404c-99f4-6160d1bfe2cb.csr
03b8620d-12ff-48ee-b036-e1cf4c598609.cer
We can obtain the server P2P sertificate with the following command:
AADJoin.exe --existing-device 03b8620d-12ff-48ee-b036-e1cf4c598609.pfx --pfx-key-password 03b8620d-12ff-48ee-b036-e1cf4c598609 --domain dataans.com --username s10@dataans.com --password wwwWWW222@@@ --server-p2p-cert
The command above will create two files:
<device id>_server_auth_p2p.cer- the P2P certificate for the server authentication;<device id>_server_auth_p2p_ca.cer- the P2P CA certificate of the obtained certificate;
We can obtain the client P2P sertificate with the following command:
AADJoin.exe --existing-device 03b8620d-12ff-48ee-b036-e1cf4c598609.pfx --pfx-key-password 03b8620d-12ff-48ee-b036-e1cf4c598609 --domain dataans.com --username s10@dataans.com --password wwwWWW222@@@ --client-p2p-cert
The command above will create two files:
<device id>_client_auth_p2p.cer- the P2P certificate for the client authentication;<device id>_client_auth_p2p_ca.cer- the P2P CA certificate of the obtained certificate;
And here are files I had:
03b8620d-12ff-48ee-b036-e1cf4c598609_client_auth_p2p.cer
03b8620d-12ff-48ee-b036-e1cf4c598609_client_auth_p2p_ca.cer
03b8620d-12ff-48ee-b036-e1cf4c598609_server_auth_p2p.cer
03b8620d-12ff-48ee-b036-e1cf4c598609_server_auth_p2p_ca.cer