Re:NSA Cybersecurity Advisory: Patch Remote Desktop Services...
by userbinator on Wednesday June 05, 2019 @08:14AM
(#20103569)
NAT traversal is possible if you happen to be in control of the machines behind the NAT --- that's not very relevant here, since it requires running a special server on the machine you want to exploit (and if you can already do that, i.e. run code on the machine, then there's no point in exploiting RDP...)
The scenario I'm referring to, and the one the article describes, is a remote attacker trying to connect to port 3389 of a machine behind a NAT --- without being able to already access the machine in the first place. In other words: you have a public IP X; there's a machine with private IP Y (which you don't know but may be able to guess easily) behind its NAT. No ports are forwarded. You have no access to the machine. How do you establish a connection to port 3389 (or for that matter, any other listening port) on it?
The scenario I'm referring to, and the one the article describes, is a remote attacker trying to connect to port 3389 of a machine behind a NAT --- without being able to already access the machine in the first place. In other words: you have a public IP X; there's a machine with private IP Y (which you don't know but may be able to guess easily) behind its NAT. No ports are forwarded. You have no access to the machine. How do you establish a connection to port 3389 (or for that matter, any other listening port) on it?