Add RustdeskPlugin Support by Peter-The-Great · Pull Request #992 · fox-it/dissect.target

Peter-The-Great · 2025-01-16T10:31:19Z

This PR adds support to inspect Rustdesk logs on supported targets (#983). I have tested the Plugin on a both a Linux and Windows machine and they do appear to work. However, if there is any issue with the plugin, just let me know right away and I will try to look in to it.

Rustdesk doesn't support Mac as a server and the original android path was not supported as a relative path.

Peter-The-Great · 2025-01-21T08:06:16Z

IDK, what happened with the checks, but this is a complete disaster and i barely know what exactly went wrong. Although linting should make some sort of indication.

jd-gui · 2025-02-04T15:21:19Z

dissect/target/plugins/apps/remoteaccess/rustdesk.py

+
+
+    RemoteAccessLogRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
+        "remoteaccess/restdesk/log", GENERIC_LOG_RECORD_FIELDS


Typo here on the record descriptor, should be remoteaccess/rustdesk/log

jd-gui · 2025-02-04T16:28:08Z

@Peter-The-Great Should also use pep8 for formatting as the linter is expecting blank lines and some lines are too long. Have reformatted and attached the two code files here if you like
reformatted.zip

Peter-The-Great · 2025-02-04T21:28:47Z

Alright i have just added the PEP 8 code Style to the code and fixed the typo.

Horofic · 2025-02-11T11:47:39Z

dissect/target/plugins/apps/remoteaccess/rustdesk.py

@@ -0,0 +1,115 @@
+import logging


Suggested change

import logging

from __future__ import annotations

Horofic · 2025-02-11T11:48:04Z

dissect/target/plugins/apps/remoteaccess/rustdesk.py

+
+log = logging.getLogger(__name__)


Suggested change

log = logging.getLogger(__name__)

Horofic · 2025-02-11T11:48:20Z

dissect/target/plugins/apps/remoteaccess/rustdesk.py

+    SERVER_GLOBS = [
+        # Windows >= Windows 7
+        "sysvol/Windows/ServiceProfiles/LocalService/AppData/Roaming/RustDesk/log/server/*.log",
+


Suggested change

Horofic · 2025-02-11T11:48:38Z

dissect/target/plugins/apps/remoteaccess/rustdesk.py

+    USER_GLOBS = [
+        # Windows
+        "AppData/Roaming/Rustdesk/log/*.log",
+
+        # Linux
+        ".local/share/logs/RustDesk/server/*.log",
+
+        # Android
+        "storage/emulated/0/RustDesk/logs/*.log",
+
+        # Mac
+        "Library/Logs/RustDesk/*.log",


Suggested change

USER_GLOBS = [

# Windows

"AppData/Roaming/Rustdesk/log/*.log",

# Linux

".local/share/logs/RustDesk/server/*.log",

# Android

"storage/emulated/0/RustDesk/logs/*.log",

# Mac

"Library/Logs/RustDesk/*.log",

USER_GLOBS = [

# Windows

"AppData/Roaming/Rustdesk/log/*.log",

# Linux

".local/share/logs/RustDesk/server/*.log",

# Android

"storage/emulated/0/RustDesk/logs/*.log",

# Mac

"Library/Logs/RustDesk/*.log",

Horofic · 2025-02-11T11:59:48Z

tests/plugins/apps/remoteaccess/test_rustdesk.py

+
+    assert records[0].ts == datetime(2025, 1, 1, 13, 4, 8, 350802, tzinfo=timezone.utc)
+    assert records[0].message == "DEBUG src\\server\\connection.rs:983 #1362 Connection opened from REDACTED IP:6074."
+    assert records[0].source == "sysvol/Windows/ServiceProfiles/LocalService/AppData/Roaming/RustDesk/log/server/TestRustdesk.log"


Suggested change

assert records[0].source == "sysvol/Windows/ServiceProfiles/LocalService/AppData/Roaming/RustDesk/log/server/TestRustdesk.log"

assert (

records[0].source

== "sysvol/Windows/ServiceProfiles/LocalService/AppData/Roaming/RustDesk/log/server/TestRustdesk.log"

)

Horofic · 2025-02-11T12:03:48Z

dissect/target/plugins/apps/remoteaccess/rustdesk.py

+        user = None
+        for log_glob in self.SERVER_GLOBS:
+            for log_file in self.target.fs.path().glob(log_glob):
+                self.log_files.add((log_file, user))


Suggested change

user = None

for log_glob in self.SERVER_GLOBS:

for log_file in self.target.fs.path().glob(log_glob):

self.log_files.add((log_file, user))

for log_glob in self.SERVER_GLOBS:

for log_file in self.target.fs.path().glob(log_glob):

self.log_files.add((log_file, None))

Horofic · 2025-02-11T12:04:50Z

dissect/target/plugins/apps/remoteaccess/rustdesk.py

+    def __init__(self, target):
+        super().__init__(target)
+
+        self.log_files: set[tuple[TargetPath, UserDetails]] = set()


Suggested change

self.log_files: set[tuple[TargetPath, UserDetails]] = set()

self.log_files: set[tuple[TargetPath, UserDetails | None]] = set()

Horofic · 2025-02-11T12:24:43Z

tests/plugins/apps/remoteaccess/test_rustdesk.py

+
+def test_rustdesk_plugin_log(target_win_users: Target, fs_win: VirtualFilesystem) -> None:
+    fs_win.map_file(
+        "sysvol/Windows/ServiceProfiles/LocalService/AppData/Roaming/RustDesk/log/server/TestRustdesk.log",


Suggested change

"sysvol/Windows/ServiceProfiles/LocalService/AppData/Roaming/RustDesk/log/server/TestRustdesk.log",

"Windows/ServiceProfiles/LocalService/AppData/Roaming/RustDesk/log/server/TestRustdesk.log",

Horofic · 2025-02-11T13:05:38Z

dissect/target/plugins/apps/remoteaccess/rustdesk.py

+
+                    ts, level, source, message = match.groups()
+
+                    timestamp = datetime.fromisoformat(ts)


It looks like the ts parsed from the log file is not a valid ISO format timestamp because of the space between the timestamp and +01:00. This causes the tests to fail currently.

Horofic · 2025-02-11T13:10:19Z

dissect/target/plugins/apps/remoteaccess/rustdesk.py

+                line = line.strip()
+
+                try:
+                    # Still needs to be checked for Rustdesk implementation
+                    match = re.match(r"\[(.*?)\] (\w+) \[(.*?)\] (.*)", line)
+                    if not match:
+                        raise ValueError("Line does not match expected format")
+
+                    ts, level, source, message = match.groups()
+
+                    timestamp = datetime.fromisoformat(ts)
+                    message = re.sub(r"\s\s+", " ", f"{level} {source} {message}")
+
+                    yield self.RemoteAccessLogRecord(
+                        ts=timestamp,
+                        message=message,
+                        source=log_file,
+                        _target=self.target,
+                        _user=user,
+                    )
+
+                except ValueError as e:
+                    self.target.log.warning("Could not parse log line in file %s: '%s'", log_file, line)
+                    self.target.log.debug("", exc_info=e)


Suggested change

line = line.strip()

try:

# Still needs to be checked for Rustdesk implementation

match = re.match(r"\[(.*?)\] (\w+) \[(.*?)\] (.*)", line)

if not match:

raise ValueError("Line does not match expected format")

ts, level, source, message = match.groups()

timestamp = datetime.fromisoformat(ts)

message = re.sub(r"\s\s+", " ", f"{level} {source} {message}")

yield self.RemoteAccessLogRecord(

ts=timestamp,

message=message,

source=log_file,

_target=self.target,

_user=user,

)

except ValueError as e:

self.target.log.warning("Could not parse log line in file %s: '%s'", log_file, line)

self.target.log.debug("", exc_info=e)

if line := line.strip():

try:

# Still needs to be checked for Rustdesk implementation

match = re.match(r"\[(.*?)\] (\w+) \[(.*?)\] (.*)", line)

if not match:

raise ValueError("Line does not match expected format")

ts, level, source, message = match.groups()

timestamp = datetime.fromisoformat(ts)

message = re.sub(r"\s\s+", " ", f"{level} {source} {message}")

yield self.RemoteAccessLogRecord(

ts=timestamp,

message=message,

source=log_file,

_target=self.target,

_user=user,

)

except ValueError as e:

self.target.log.warning("Could not parse log line in file %s: '%s'", log_file, line)

self.target.log.debug("", exc_info=e)

Horofic · 2025-02-11T13:20:59Z

dissect/target/plugins/apps/remoteaccess/rustdesk.py

+
+    @export(record=RemoteAccessLogRecord)
+    def logs(self) -> Iterator[RemoteAccessLogRecord]:
+        """Parse Rustdesk log files.


Suggested change

"""Parse Rustdesk log files.

"""Parse RustDesk log files.

Horofic · 2025-02-11T13:21:10Z

dissect/target/plugins/apps/remoteaccess/rustdesk.py

+    def logs(self) -> Iterator[RemoteAccessLogRecord]:
+        """Parse Rustdesk log files.
+
+        Rustdesk is remote access software that allows users to connect to a remote computer.


Suggested change

Rustdesk is remote access software that allows users to connect to a remote computer.

RustDesk is a remote desktop application can be used by adversaries to get (persistent) access to a machine.

Horofic · 2025-02-11T13:25:27Z

dissect/target/plugins/apps/remoteaccess/rustdesk.py

+        The project is open source and can be found at: https://github.com/rustdesk/rustdesk/
+
+        The log files are stored in different locations, based on the Target OS and client type.
+        Unlike Anydesk, Rustdesk does have a carry a time zone designator (TZD).


Suggested change

Unlike Anydesk, Rustdesk does have a carry a time zone designator (TZD).

Unlike AnyDesk, RustDesk does carry a time zone designator (TZD).

Peter-The-Great · 2025-04-14T19:09:38Z

Looks cool guys, thanks for adding this to the main branch. Havent really been up to date with the pull request, but cool to see the progress being made on it.

Horofic · 2025-04-15T06:47:24Z

Looks cool guys, thanks for adding this to the main branch. Havent really been up to date with the pull request, but cool to see the progress being made on it.

@Peter-The-Great this PR is not merged into main yet. I have requested some changes for the code in this PR that can work into this PR. After everything is reviewed and approved, this PR will be merged into main.

lhaagsma · 2025-04-15T08:27:11Z

Created a new PR with these suggested changes: #1104

Peter-The-Great added 6 commits January 14, 2025 23:10

Add Rustdesk remote access plugin for log parsing. fox-it#983

b02c722

Removed Unnecassary Server_Glob paths (fox-it#983)

96847d3

Add tests for Rustdesk plugin log parsing (fox-it#983)

3a7fc5a

Merge branch 'fox-it:main' into add-rustdesk

3791cfa

Merge branch 'fox-it:main' into add-rustdesk

299d342

Removed Mac for servers and removed / from Android path. (fox-it#983)

d59df9f

Rustdesk doesn't support Mac as a server and the original android path was not supported as a relative path.

Peter-The-Great marked this pull request as ready for review January 20, 2025 11:59

EinatFox linked an issue Jan 20, 2025 that may be closed by this pull request

Create RustDesk plugin #983

Closed

jd-gui reviewed Feb 4, 2025

View reviewed changes

Peter-The-Great added 3 commits February 4, 2025 21:53

Merge branch 'fox-it:main' into add-rustdesk

59aa1e8

Update rustdesk.py to fix typo and use the PEP 8 style.

91f3564

Update test_rustdesk.py to use the PEP 8 code Style.

3bbbce0

Horofic requested changes Feb 11, 2025

View reviewed changes

Horofic self-assigned this Feb 11, 2025

Horofic added 2 commits February 11, 2025 21:13

Merge branch 'main' into add-rustdesk

d147a06

Merge branch 'main' into add-rustdesk

c05764c

lhaagsma mentioned this pull request Apr 15, 2025

Add rustdesk (resolved feedback on previous PR) #1104

Merged

Schamper closed this Apr 15, 2025



		RemoteAccessLogRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
		"remoteaccess/restdesk/log", GENERIC_LOG_RECORD_FIELDS

	self.log_files: set[tuple[TargetPath, UserDetails]] = set()
	self.log_files: set[tuple[TargetPath, UserDetails \| None]] = set()

	"sysvol/Windows/ServiceProfiles/LocalService/AppData/Roaming/RustDesk/log/server/TestRustdesk.log",
	"Windows/ServiceProfiles/LocalService/AppData/Roaming/RustDesk/log/server/TestRustdesk.log",


		ts, level, source, message = match.groups()

		timestamp = datetime.fromisoformat(ts)

	Rustdesk is remote access software that allows users to connect to a remote computer.
	RustDesk is a remote desktop application can be used by adversaries to get (persistent) access to a machine.

	Unlike Anydesk, Rustdesk does have a carry a time zone designator (TZD).
	Unlike AnyDesk, RustDesk does carry a time zone designator (TZD).

Conversation

Peter-The-Great commented Jan 16, 2025

Uh oh!

Peter-The-Great commented Jan 21, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jd-gui commented Feb 4, 2025

Uh oh!

Peter-The-Great commented Feb 4, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Horofic Feb 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Peter-The-Great commented Apr 14, 2025

Uh oh!

Horofic commented Apr 15, 2025

Uh oh!

lhaagsma commented Apr 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Horofic Feb 11, 2025 •

edited

Loading