Merge pull request #108 from cudeso/master

Add logging for rdphoneypot

README.md

@@ -236,7 +236,7 @@ class MyRDPFactory(rdp.ServerFactory):
                 @summary: Event call on mouse event
                 @param x: x position
                 @param y: y position
-                @param button: 1, 2 or 3 button
+                @param button: 1, 2, 3, 4 or 5 button
                 @param isPressed: True if mouse button is pressed
                 @see: rdp.RDPServerObserver.onPointerEvent
                 """

bin/rdpy-rdphoneypot.py

@@ -22,7 +22,7 @@
 RDP Honey pot use Rss scenario file to simulate RDP server
 """
 
-import sys, os, getopt, time
+import sys, os, getopt, time, datetime
 
 from rdpy.core import log, error, rss
 from rdpy.protocol.rdp import rdp
@@ -54,17 +54,12 @@ class HoneyPotServer(rdp.RDPServerObserver):
             width, height = self._controller.getScreen()
             size = width * height
             rssFilePath = sorted(self._rssFileSizeList, key = lambda x: abs(x[0][0] * x[0][1] - size))[0][1]
-            log.info("select file (%s, %s) -> %s"%(width, height, rssFilePath))
+            log.info("%s --- select file (%s, %s) -> %s"%(datetime.datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%S.%fZ'),width, height, rssFilePath))
             self._rssFile = rss.createReader(rssFilePath)
         
         domain, username, password = self._controller.getCredentials()
         hostname = self._controller.getHostname()
-        log.info("""Credentials:
-        \tdomain : %s
-        \tusername : %s
-        \tpassword : %s
-        \thostname : %s
-        """%(domain, username, password, hostname));
+        log.info("""%s --- Credentials: domain: %s username: %s password: %s hostname: %s"""%(datetime.datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%S.%fZ'), domain, username, password, hostname));
         self.start()
         
     def onClose(self):
@@ -125,7 +120,7 @@ class HoneyPotServerFactory(rdp.ServerFactory):
         @param addr: destination address
         @see: rdp.ServerFactory.buildObserver
         """
-        log.info("Connection from %s:%s"%(addr.host, addr.port))
+        log.info("%s --- Connection from %s:%s"%(datetime.datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%S.%fZ'), addr.host, addr.port))
         return HoneyPotServer(controller, self._rssFileSizeList)
     
 def readSize(filePath):
@@ -146,10 +141,12 @@ def help():
     @summary: Print help in console
     """
     print """
-    Usage:  rdpy-rdphoneypot.py rss_filepath(1..n)
+    Usage:  rdpy-rdphoneypot.py 
+            [-L logfile]
             [-l listen_port default 3389] 
             [-k private_key_file_path (mandatory for SSL)] 
             [-c certificate_file_path (mandatory for SSL)] 
+            rss_filepath(1..n)
     """
     
 if __name__ == '__main__':
@@ -159,13 +156,15 @@ if __name__ == '__main__':
     rssFileSizeList = []
     
     try:
-        opts, args = getopt.getopt(sys.argv[1:], "hl:k:c:")
+        opts, args = getopt.getopt(sys.argv[1:], "hl:k:c:L:")
     except getopt.GetoptError:
         help()
     for opt, arg in opts:
         if opt == "-h":
             help()
             sys.exit()
+        elif opt == "-L":
+            log._LOG_FILE = arg 
         elif opt == "-l":
             listen = arg
         elif opt == "-k":
@@ -174,11 +173,12 @@ if __name__ == '__main__':
             certificateFilePath = arg
     
     #build size map
-    log.info("Build size map")
+    log.info("%s --- Start rdphoneypot"%datetime.datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%S.%fZ'))
+    log.info("%s --- Build size map"%datetime.datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%S.%fZ'))
     for arg in args:
         size = readSize(arg)
         rssFileSizeList.append((size, arg))
-        log.info("(%s, %s) -> %s"%(size[0], size[1], arg))
+        log.info("%s --- (%s, %s) -> %s"%(datetime.datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%S.%fZ'), size[0], size[1], arg))
     
     reactor.listenTCP(int(listen), HoneyPotServerFactory(rssFileSizeList, privateKeyFilePath, certificateFilePath))
-    reactor.run()
+    reactor.run()

bin/rdpy-rdpmitm.py

@@ -29,7 +29,10 @@ Client RDP -> | ProxyServer | ProxyClient | -> Server RDP
                    -----------------
 """
 
-import sys, os, getopt, time
+import sys
+import os
+import argparse
+import time
 
 from rdpy.core import log, error, rss
 from rdpy.protocol.rdp import rdp
@@ -37,10 +40,12 @@ from twisted.internet import reactor
 
 log._LOG_LEVEL = log.Level.INFO
 
+
 class ProxyServer(rdp.RDPServerObserver):
     """
     @summary: Server side of proxy
     """
+
     def __init__(self, controller, target, clientSecurityLevel, rssRecorder):
         """
         @param controller: {RDPServerController}
@@ -52,14 +57,14 @@ class ProxyServer(rdp.RDPServerObserver):
         self._client = None
         self._rss = rssRecorder
         self._clientSecurityLevel = clientSecurityLevel
-    
+
     def setClient(self, client):
         """
         @summary: Event throw by client when it's ready
         @param client: {ProxyClient}
         """
         self._client = client
-        
+
     def onReady(self):
         """
         @summary:  Event use to inform state of server stack
@@ -69,29 +74,30 @@ class ProxyServer(rdp.RDPServerObserver):
         @see: rdp.RDPServerObserver.onReady
         """
         if self._client is None:
-            #try a connection
+            # try a connection
             domain, username, password = self._controller.getCredentials()
-            self._rss.credentials(username, password, domain, self._controller.getHostname())
-            
+            self._rss.credentials(username, password,
+                                  domain, self._controller.getHostname())
+
             width, height = self._controller.getScreen()
             self._rss.screen(width, height, self._controller.getColorDepth())
-            
-            reactor.connectTCP(self._target[0], int(self._target[1]), ProxyClientFactory(self, width, height, 
-                                                            domain, username, password,self._clientSecurityLevel))
-            
+
+            reactor.connectTCP(self._target[0], int(self._target[1]), ProxyClientFactory(self, width, height,
+                                                                                         domain, username, password, self._clientSecurityLevel))
+
     def onClose(self):
         """
         @summary: Call when human client close connection
         @see: rdp.RDPServerObserver.onClose
         """
-        #end scenario
+        # end scenario
         self._rss.close()
-        
-        #close network stack
+
+        # close network stack
         if self._client is None:
             return
         self._client._controller.close()
-        
+
     def onKeyEventScancode(self, code, isPressed, isExtended):
         """
         @summary: Event call when a keyboard event is catch in scan code format
@@ -102,9 +108,10 @@ class ProxyServer(rdp.RDPServerObserver):
         """
         if self._client is None:
             return
-        self._client._controller.sendKeyEventScancode(code, isPressed, isExtended)
+        self._client._controller.sendKeyEventScancode(
+            code, isPressed, isExtended)
         self._rss.keyScancode(code, isPressed)
-    
+
     def onKeyEventUnicode(self, code, isPressed):
         """
         @summary: Event call when a keyboard event is catch in unicode format
@@ -116,24 +123,26 @@ class ProxyServer(rdp.RDPServerObserver):
             return
         self._client._controller.sendKeyEventUnicode(code, isPressed)
         self._rss.keyUnicode(code, isPressed)
-        
+
     def onPointerEvent(self, x, y, button, isPressed):
         """
         @summary: Event call on mouse event
         @param x: {int} x position
         @param y: {int} y position
-        @param button: {int} 1, 2 or 3 button
+        @param button: {int} 1, 2, 3, 4 or 5 button
         @param isPressed: {bool} True if mouse button is pressed
         @see: rdp.RDPServerObserver.onPointerEvent
         """
         if self._client is None:
             return
         self._client._controller.sendPointerEvent(x, y, button, isPressed)
-        
+
+
 class ProxyServerFactory(rdp.ServerFactory):
     """
     @summary: Factory on listening events
     """
+
     def __init__(self, target, ouputDir, privateKeyFilePath, certificateFilePath, clientSecurity):
         """
         @param target: {tuple(ip, prt)}
@@ -141,13 +150,14 @@ class ProxyServerFactory(rdp.ServerFactory):
         @param certificateFilePath: {str} file contain server certificate (if none -> back to standard RDP security)
         @param clientSecurity: {str(ssl|rdp)} security layer use in client connection side
         """
-        rdp.ServerFactory.__init__(self, 16, privateKeyFilePath, certificateFilePath)
+        rdp.ServerFactory.__init__(
+            self, 16, privateKeyFilePath, certificateFilePath)
         self._target = target
         self._ouputDir = ouputDir
         self._clientSecurity = clientSecurity
-        #use produce unique file by connection
+        # use produce unique file by connection
         self._uniqueId = 0
-        
+
     def buildObserver(self, controller, addr):
         """
         @param controller: {rdp.RDPServerController}
@@ -155,12 +165,14 @@ class ProxyServerFactory(rdp.ServerFactory):
         @see: rdp.ServerFactory.buildObserver
         """
         self._uniqueId += 1
-        return ProxyServer(controller, self._target, self._clientSecurity, rss.createRecorder(os.path.join(self._ouputDir, "%s_%s_%s.rss"%(time.strftime('%Y%m%d%H%M%S'), addr.host, self._uniqueId))))
-    
+        return ProxyServer(controller, self._target, self._clientSecurity, rss.createRecorder(os.path.join(self._ouputDir, "%s_%s_%s.rss" % (time.strftime('%Y%m%d%H%M%S'), addr.host, self._uniqueId))))
+
+
 class ProxyClient(rdp.RDPClientObserver):
     """
     @summary: Client side of proxy
     """
+
     def __init__(self, controller, server):
         """
         @param controller: {rdp.RDPClientController}
@@ -168,7 +180,7 @@ class ProxyClient(rdp.RDPClientObserver):
         """
         rdp.RDPClientObserver.__init__(self, controller)
         self._server = server
-        
+
     def onReady(self):
         """
         @summary:  Event use to signal that RDP stack is ready
@@ -176,25 +188,26 @@ class ProxyClient(rdp.RDPClientObserver):
         @see: rdp.RDPClientObserver.onReady
         """
         self._server.setClient(self)
-        #maybe color depth change
-        self._server._controller.setColorDepth(self._controller.getColorDepth())
-        
+        # maybe color depth change
+        self._server._controller.setColorDepth(
+            self._controller.getColorDepth())
+
     def onSessionReady(self):
         """
         @summary: Windows session is ready
         @see: rdp.RDPClientObserver.onSessionReady
         """
         pass
-        
+
     def onClose(self):
         """
         @summary: Event inform that stack is close
         @see: rdp.RDPClientObserver.onClose
         """
-        #end scenario
+        # end scenario
         self._server._rss.close()
         self._server._controller.close()
-        
+
     def onUpdate(self, destLeft, destTop, destRight, destBottom, width, height, bitsPerPixel, isCompress, data):
         """
         @summary: Event use to inform bitmap update
@@ -209,13 +222,17 @@ class ProxyClient(rdp.RDPClientObserver):
         @param data: {str} bitmap data
         @see: rdp.RDPClientObserver.onUpdate
         """
-        self._server._rss.update(destLeft, destTop, destRight, destBottom, width, height, bitsPerPixel, rss.UpdateFormat.BMP if isCompress else rss.UpdateFormat.RAW, data)
-        self._server._controller.sendUpdate(destLeft, destTop, destRight, destBottom, width, height, bitsPerPixel, isCompress, data)
+        self._server._rss.update(destLeft, destTop, destRight, destBottom, width, height,
+                                 bitsPerPixel, rss.UpdateFormat.BMP if isCompress else rss.UpdateFormat.RAW, data)
+        self._server._controller.sendUpdate(
+            destLeft, destTop, destRight, destBottom, width, height, bitsPerPixel, isCompress, data)
+
 
 class ProxyClientFactory(rdp.ClientFactory):
     """
     @summary: Factory for proxy client
     """
+
     def __init__(self, server, width, height, domain, username, password, security):
         """
         @param server: {ProxyServer}
@@ -233,7 +250,7 @@ class ProxyClientFactory(rdp.ClientFactory):
         self._username = username
         self._password = password
         self._security = security
-        
+
     def buildObserver(self, controller, addr):
         """
         @summary: Build observer
@@ -242,69 +259,65 @@ class ProxyClientFactory(rdp.ClientFactory):
         @see: rdp.ClientFactory.buildObserver
         @return: ProxyClient
         """
-        #set screen resolution
+        # set screen resolution
         controller.setScreen(self._width, self._height)
-        #set credential
+        # set credential
         controller.setDomain(self._domain)
         controller.setUsername(self._username)
         controller.setPassword(self._password)
         controller.setSecurityLevel(self._security)
         controller.setPerformanceSession()
         return ProxyClient(controller, self._server)
-    
-def help():
-    """
-    @summary: Print help in console
-    """
-    print """
-    Usage:  rdpy-rdpmitm.py -o output_directory target
-            [-l listen_port default 3389] 
-            [-k private_key_file_path (mandatory for SSL)] 
-            [-c certificate_file_path (mandatory for SSL)] 
-            [-o output directory for recoded files] 
-            [-r RDP standard security (XP or server 2003 client or older)] 
-            [-n For NLA Client authentication (need to provide credentials)] 
-    """
 
-def parseIpPort(interface, defaultPort = "3389"):
+
+def parseIpPort(interface, defaultPort="3389"):
     if ':' in interface:
-        return interface.split(':')
+        s = interface.split(':')
+        return s[0], int(s[1])
     else:
-        return interface, defaultPort
+        return interface, int(defaultPort)
+
+
+def isDirectory(outputDirectory):
+    if outputDirectory is None or not os.path.dirname(outputDirectory):
+        log.error("{} is an invalid output directory or directory doesn't exist".format(
+                  outputDirectory))
+    return outputDirectory
+
+
+def mapSecurityLayer(layer):
+    return {
+        "rdp": rdp.SecurityLevel.RDP_LEVEL_RDP,
+        "tls": rdp.SecurityLevel.RDP_LEVEL_SSL,
+        "nla": rdp.SecurityLevel.RDP_LEVEL_NLA
+    }[layer]
+
 
 if __name__ == '__main__':
-    listen = "3389"
-    privateKeyFilePath = None
-    certificateFilePath = None
-    ouputDirectory = None
-    #for anonymous authentication
-    clientSecurity = rdp.SecurityLevel.RDP_LEVEL_SSL
-    
-    try:
-        opts, args = getopt.getopt(sys.argv[1:], "hl:k:c:o:rn")
-    except getopt.GetoptError:
-        help()
-    for opt, arg in opts:
-        if opt == "-h":
-            help()
-            sys.exit()
-        elif opt == "-l":
-            listen = arg
-        elif opt == "-k":
-            privateKeyFilePath = arg
-        elif opt == "-c":
-            certificateFilePath = arg
-        elif opt == "-o":
-            ouputDirectory = arg
-        elif opt == "-r":
-            clientSecurity = rdp.SecurityLevel.RDP_LEVEL_RDP
-        elif opt == "-n":
-            clientSecurity = rdp.SecurityLevel.RDP_LEVEL_NLA
-            
-    if ouputDirectory is None or not os.path.dirname(ouputDirectory):
-        log.error("%s is an invalid output directory"%ouputDirectory)
-        help()
-        sys.exit()
-        
-    reactor.listenTCP(int(listen), ProxyServerFactory(parseIpPort(args[0]), ouputDirectory, privateKeyFilePath, certificateFilePath, clientSecurity))
-    reactor.run()
+    p = argparse.ArgumentParser(
+        formatter_class=argparse.ArgumentDefaultsHelpFormatter)
+
+    p.add_argument('-l', '--listen', type=parseIpPort, default="0.0.0.0:3389",
+                   help="<addr>[:<port>] to bind the server")
+    p.add_argument('-t', '--target', type=parseIpPort, required=True,
+                   help="<addr>[:<port>] of the target you want to connect to via proxy")
+    p.add_argument('-o', '--output', type=isDirectory,
+                   help="output directory", required=True)
+    p.add_argument('-s', '--sec', choices=["rdp", "tls", "nla"],
+                   default="rdp", help="set protocol security layer")
+    ssl = p.add_argument_group()
+    ssl.add_argument('-c', '--certificate', help="certificate for TLS connections")
+    ssl.add_argument('-k', '--key', help="private key of the given certificate for TLS connections")
+
+    args = p.parse_args()
+
+    if args.certificate and args.key and not args.sec == "nla":
+        args.sec = "tls"
+
+    log.info("running server on {addr}, using {sec} security layer, proxying to {target}".format(
+             addr=args.listen, sec=args.sec.upper(), target=args.target))
+    reactor.listenTCP(args.listen[1], ProxyServerFactory(
+        args.target, args.output, args.key, args.certificate, mapSecurityLayer(args.sec)),
+        interface=args.listen[0])
+
+    reactor.run()

bin/rdpy-rdpscreenshot.py

@@ -23,7 +23,9 @@ example of use rdpy
 take screenshot of login page
 """
 
-import sys, os, getopt
+import getopt
+import os
+import sys
 
 from PyQt4 import QtCore, QtGui
 from rdpy.protocol.rdp import rdp
@@ -32,15 +34,17 @@ import rdpy.core.log as log
 from rdpy.core.error import RDPSecurityNegoFail
 from twisted.internet import task
 
-#set log level
+# set log level
 log._LOG_LEVEL = log.Level.INFO
 
+
 class RDPScreenShotFactory(rdp.ClientFactory):
     """
     @summary: Factory for screenshot exemple
     """
     __INSTANCE__ = 0
     __STATE__ = []
+
     def __init__(self, reactor, app, width, height, path, timeout):
         """
         @param reactor: twisted reactor
@@ -58,7 +62,7 @@ class RDPScreenShotFactory(rdp.ClientFactory):
         self._timeout = timeout
         #NLA server can't be screenshooting
         self._security = rdp.SecurityLevel.RDP_LEVEL_SSL
-        
+
     def clientConnectionLost(self, connector, reason):
         """
         @summary: Connection lost event
@@ -70,14 +74,14 @@ class RDPScreenShotFactory(rdp.ClientFactory):
             self._security = rdp.SecurityLevel.RDP_LEVEL_RDP
             connector.connect()
             return
-        
-        log.info("connection lost : %s"%reason)
+
+        log.info("connection lost : %s" % reason)
         RDPScreenShotFactory.__STATE__.append((connector.host, connector.port, reason))
         RDPScreenShotFactory.__INSTANCE__ -= 1
         if(RDPScreenShotFactory.__INSTANCE__ == 0):
             self._reactor.stop()
             self._app.exit()
-        
+
     def clientConnectionFailed(self, connector, reason):
         """
         @summary: Connection failed event
@@ -90,8 +94,7 @@ class RDPScreenShotFactory(rdp.ClientFactory):
         if(RDPScreenShotFactory.__INSTANCE__ == 0):
             self._reactor.stop()
             self._app.exit()
-        
-        
+
     def buildObserver(self, controller, addr):
         """
         @summary: build ScreenShot observer
@@ -117,46 +120,46 @@ class RDPScreenShotFactory(rdp.ClientFactory):
                 self._timeout = timeout
                 self._startTimeout = False
                 self._reactor = reactor
-                
+
             def onUpdate(self, destLeft, destTop, destRight, destBottom, width, height, bitsPerPixel, isCompress, data):
                 """
                 @summary: callback use when bitmap is received 
                 """
                 image = RDPBitmapToQtImage(width, height, bitsPerPixel, isCompress, data);
                 with QtGui.QPainter(self._buffer) as qp:
-                #draw image
+                # draw image
                     qp.drawImage(destLeft, destTop, image, 0, 0, destRight - destLeft + 1, destBottom - destTop + 1)
                 if not self._startTimeout:
                     self._startTimeout = False
                     self._reactor.callLater(self._timeout, self.checkUpdate)
-                   
+
             def onReady(self):
                 """
                 @summary: callback use when RDP stack is connected (just before received bitmap)
                 """
-                log.info("connected %s"%addr)
-            
+                log.info("connected %s" % addr)
+
             def onSessionReady(self):
                 """
                 @summary: Windows session is ready
                 @see: rdp.RDPClientObserver.onSessionReady
                 """
                 pass
-            
+
             def onClose(self):
                 """
                 @summary: callback use when RDP stack is closed
                 """
-                log.info("save screenshot into %s"%self._path)
+                log.info("save screenshot into %s" % self._path)
                 self._buffer.save(self._path)
-                
+
             def checkUpdate(self):
                 self._controller.close();
-                
-        controller.setScreen(width, height);
+
+        controller.setScreen(self._width, self._height);
         controller.setSecurityLevel(self._security)
         return ScreenShotObserver(controller, self._width, self._height, self._path, self._timeout, self._reactor)
-    
+
 def main(width, height, path, timeout, hosts):
     """
     @summary: main algorithm
@@ -168,39 +171,40 @@ def main(width, height, path, timeout, hosts):
     """
     #create application
     app = QtGui.QApplication(sys.argv)
-    
+
     #add qt4 reactor
     import qt4reactor
     qt4reactor.install()
-    
+
     from twisted.internet import reactor
-        
+
     for host in hosts:      
         if ':' in host:
             ip, port = host.split(':')
         else:
             ip, port = host, "3389"
-            
-        reactor.connectTCP(ip, int(port), RDPScreenShotFactory(reactor, app, width, height, path + "%s.jpg"%ip, timeout))
-        
+
+        reactor.connectTCP(ip, int(port), RDPScreenShotFactory(reactor, app, width, height, path + "%s.jpg" % ip, timeout))
+
     reactor.runReturn()
     app.exec_()
     return RDPScreenShotFactory.__STATE__
-        
+
+
 def help():
     print "Usage: rdpy-rdpscreenshot [options] ip[:port]"
     print "\t-w: width of screen default value is 1024"
     print "\t-l: height of screen default value is 800"
     print "\t-o: file path of screenshot default(/tmp/rdpy-rdpscreenshot.jpg)"
     print "\t-t: timeout of connection without any updating order (default is 2s)"
-        
+
 if __name__ == '__main__':
-    #default script argument
+    # default script argument
     width = 1024
     height = 800
     path = "/tmp/"
     timeout = 5.0
-    
+
     try:
         opts, args = getopt.getopt(sys.argv[1:], "hw:l:o:t:")
     except getopt.GetoptError:
@@ -217,5 +221,5 @@ if __name__ == '__main__':
             path = arg
         elif opt == "-t":
             timeout = float(arg)
-    
-    main(width, height, path, timeout, args)
+
+    main(width, height, path, timeout, args)

rdpy/core/log.py

@@ -33,12 +33,17 @@ class Level(object):
     NONE = 4
     
 _LOG_LEVEL = Level.DEBUG
+_LOG_FILE = False 
 
 def log(message):
     """
     @summary: Main log function
     @param message: string to print
     """
+    if _LOG_FILE:
+        f = open(_LOG_FILE, "a+")
+        f.write("%s\n"%message)
+        f.close()
     print "[*] %s"%message
 
 def error(message):
@@ -75,4 +80,4 @@ def debug(message):
     """
     if _LOG_LEVEL > Level.DEBUG:
         return
-    log("DEBUG:\t%s"%message)
+    log("DEBUG:\t%s"%message)

rdpy/protocol/rdp/pdu/data.py

@@ -160,7 +160,16 @@ class PointerFlag(object):
     PTRFLAGS_BUTTON1 = 0x1000
     PTRFLAGS_BUTTON2 = 0x2000
     PTRFLAGS_BUTTON3 = 0x4000
-    
+
+class PointerExFlag(object):
+    """
+    @summary: Use in Pointer event
+    @see: https://msdn.microsoft.com/en-us/library/cc240587.aspx
+    """
+    PTRXFLAGS_DOWN    = 0x8000
+    PTRXFLAGS_BUTTON1 = 0x0001
+    PTRXFLAGS_BUTTON2 = 0x0002
+
 class KeyboardFlag(object):
     """
     @summary: Use in scan code key event
@@ -919,7 +928,7 @@ class SlowPathInputEvent(CompositeType):
         self.messageType = UInt16Le(lambda:self.slowPathInputData.__class__._INPUT_MESSAGE_TYPE_)
         
         def SlowPathInputDataFactory():
-            for c in [PointerEvent, ScancodeKeyEvent, UnicodeKeyEvent, SynchronizeEvent]:
+            for c in [PointerEvent, PointerExEvent, ScancodeKeyEvent, UnicodeKeyEvent, SynchronizeEvent]:
                 if self.messageType.value == c._INPUT_MESSAGE_TYPE_:
                     return c()
             raise InvalidExpectedDataException("unknown slow path input : %s"%hex(self.messageType.value))
@@ -956,6 +965,19 @@ class PointerEvent(CompositeType):
         self.xPos = UInt16Le()
         self.yPos = UInt16Le()
         
+class PointerExEvent(CompositeType):
+    """
+    @summary: Event use to communicate mouse position
+    @see: http://msdn.microsoft.com/en-us/library/cc240587.aspx
+    """
+    _INPUT_MESSAGE_TYPE_ = InputMessageType.INPUT_EVENT_MOUSEX
+    
+    def __init__(self):
+        CompositeType.__init__(self)
+        self.pointerFlags = UInt16Le()
+        self.xPos = UInt16Le()
+        self.yPos = UInt16Le()
+
 class ScancodeKeyEvent(CompositeType):
     """
     @summary: Event use to communicate keyboard informations

rdpy/protocol/rdp/rdp.py

@@ -228,24 +228,35 @@ class RDPClientController(pdu.layer.PDUClientListener):
             return
 
         try:
-            event = pdu.data.PointerEvent()
-            if isPressed:
-                event.pointerFlags.value |= pdu.data.PointerFlag.PTRFLAGS_DOWN
-            
-            if button == 1:
-                event.pointerFlags.value |= pdu.data.PointerFlag.PTRFLAGS_BUTTON1
-            elif button == 2:
-                event.pointerFlags.value |= pdu.data.PointerFlag.PTRFLAGS_BUTTON2
-            elif button == 3:
-                event.pointerFlags.value |= pdu.data.PointerFlag.PTRFLAGS_BUTTON3
+            if button == 4 or button == 5:
+                event = pdu.data.PointerExEvent()
+                if isPressed:
+                    event.pointerFlags.value |= pdu.data.PointerExFlag.PTRXFLAGS_DOWN
+
+                if button == 4:
+                    event.pointerFlags.value |= pdu.data.PointerExFlag.PTRXFLAGS_BUTTON1
+                elif button == 5:
+                    event.pointerFlags.value |= pdu.data.PointerExFlag.PTRXFLAGS_BUTTON2
+
             else:
-                event.pointerFlags.value |= pdu.data.PointerFlag.PTRFLAGS_MOVE
+                event = pdu.data.PointerEvent()
+                if isPressed:
+                    event.pointerFlags.value |= pdu.data.PointerFlag.PTRFLAGS_DOWN
+                
+                if button == 1:
+                    event.pointerFlags.value |= pdu.data.PointerFlag.PTRFLAGS_BUTTON1
+                elif button == 2:
+                    event.pointerFlags.value |= pdu.data.PointerFlag.PTRFLAGS_BUTTON2
+                elif button == 3:
+                    event.pointerFlags.value |= pdu.data.PointerFlag.PTRFLAGS_BUTTON3
+                else:
+                    event.pointerFlags.value |= pdu.data.PointerFlag.PTRFLAGS_MOVE
             
-            #position
+            # position
             event.xPos.value = x
             event.yPos.value = y
             
-            #send proper event
+            # send proper event
             self._pduLayer.sendInputEvents([event])
             
         except InvalidValue:
@@ -500,7 +511,7 @@ class RDPServerController(pdu.layer.PDUServerListener):
                 #unicode
                 elif event.messageType.value == pdu.data.InputMessageType.INPUT_EVENT_UNICODE:
                     observer.onKeyEventUnicode(event.slowPathInputData.unicode.value, not (event.slowPathInputData.keyboardFlags.value & pdu.data.KeyboardFlag.KBDFLAGS_RELEASE))
-                #mouse event    
+                #mouse events
                 elif event.messageType.value == pdu.data.InputMessageType.INPUT_EVENT_MOUSE:
                     isPressed = event.slowPathInputData.pointerFlags.value & pdu.data.PointerFlag.PTRFLAGS_DOWN
                     button = 0
@@ -511,6 +522,15 @@ class RDPServerController(pdu.layer.PDUServerListener):
                     elif event.slowPathInputData.pointerFlags.value & pdu.data.PointerFlag.PTRFLAGS_BUTTON3:
                         button = 3
                     observer.onPointerEvent(event.slowPathInputData.xPos.value, event.slowPathInputData.yPos.value, button, isPressed)
+                elif event.messageType.value == pdu.data.InputMessageType.INPUT_EVENT_MOUSEX:
+                    isPressed = event.slowPathInputData.pointerFlags.value & pdu.data.PointerExFlag.PTRXFLAGS_DOWN
+                    button = 0
+                    if event.slowPathInputData.pointerFlags.value & pdu.data.PointerExFlag.PTRXFLAGS_BUTTON1:
+                        button = 4
+                    elif event.slowPathInputData.pointerFlags.value & pdu.data.PointerExFlag.PTRXFLAGS_BUTTON2:
+                        button = 5
+                    observer.onPointerEvent(event.slowPathInputData.xPos.value, event.slowPathInputData.yPos.value, button, isPressed)
+
     
     def sendUpdate(self, destLeft, destTop, destRight, destBottom, width, height, bitsPerPixel, isCompress, data):
         """
@@ -698,7 +718,7 @@ class RDPServerObserver(object):
         @summary: Event call on mouse event
         @param x: x position
         @param y: y position
-        @param button: 1, 2 or 3 button
+        @param button: 1, 2, 3, 4 or 5 button
         @param isPressed: True if mouse button is pressed
         """
         raise CallPureVirtualFuntion("%s:%s defined by interface %s"%(self.__class__, "onPointerEvent", "RDPServerObserver"))

rdpy/protocol/rdp/sec.py

@@ -24,7 +24,7 @@ RDP Standard security layer
 import sha, md5
 import lic, tpkt
 from t125 import gcc, mcs
-from rdpy.core.type import CompositeType, CallableValue, Stream, UInt32Le, UInt16Le, String, sizeof
+from rdpy.core.type import CompositeType, CallableValue, Stream, UInt32Le, UInt16Le, String, sizeof, UInt8
 from rdpy.core.layer import LayerAutomata, IStreamSender
 from rdpy.core.error import InvalidExpectedDataException
 from rdpy.core import log
@@ -56,7 +56,6 @@ class SecurityFlag(object):
 class InfoFlag(object):
     """
     Client capabilities informations
-    @see: https://msdn.microsoft.com/en-us/library/cc240475.aspx
     """
     INFO_MOUSE = 0x00000001
     INFO_DISABLECTRLALTDEL = 0x00000002
@@ -81,7 +80,6 @@ class InfoFlag(object):
 class PerfFlag(object):
     """
     Network performances flag
-    @see: https://msdn.microsoft.com/en-us/library/cc240476.aspx
     """
     PERF_DISABLE_WALLPAPER = 0x00000001
     PERF_DISABLE_FULLWINDOWDRAG = 0x00000002

rdpy/protocol/rdp/t125/mcs.py

@@ -27,6 +27,7 @@ It exist channel for file system order, audio channel, clipboard etc...
 from rdpy.core.layer import LayerAutomata, IStreamSender, Layer
 from rdpy.core.type import sizeof, Stream, UInt8, UInt16Le, String
 from rdpy.core.error import InvalidExpectedDataException, InvalidValue, InvalidSize, CallPureVirtualFuntion
+from ber import writeLength
 import rdpy.core.log as log
 
 import ber, gcc, per
@@ -254,7 +255,7 @@ class MCSLayer(LayerAutomata):
         domainParam = (ber.writeInteger(maxChannels), ber.writeInteger(maxUsers), ber.writeInteger(maxTokens),
                        ber.writeInteger(1), ber.writeInteger(0), ber.writeInteger(1),
                        ber.writeInteger(maxPduSize), ber.writeInteger(2))
-        return (ber.writeUniversalTag(ber.Tag.BER_TAG_SEQUENCE, True), ber.writeLength(sizeof(domainParam)), domainParam)
+        return (ber.writeUniversalTag(ber.Tag.BER_TAG_SEQUENCE, True), writeLength(sizeof(domainParam)), domainParam)
     
     def writeMCSPDUHeader(self, mcsPdu, options = 0):
         """

setup.py

@@ -42,6 +42,6 @@ setup(name='rdpy',
           	'service_identity',
           	'qt4reactor',
           	'rsa',
-          	'pyasn1',
+          	'pyasn1'
 	  	],
 )