When one fine day the manager raises the question: "Why do some have remote access to the work computer without obtaining additional permissions to use it?",
the task arises to “close” the loophole.
There are plenty of remote management applications available: Chrome Remote Desktop, AmmyAdmin, LiteManager, TeamViewer, Anyplace Control, and others. While Chrome Remote Desktop has an official manual for combating access to the service, TeamViewer has licensing restrictions on time or network requests, and users often "grumble" while still "showing up" to the admins, the favorite for personal use — AnyDesk — still requires special attention, especially if the manager said "No!".
If you understand what packet blocking by its content means and you are okay with it, then the remaining material
is not intended for you.
Trying to approach it from the opposite side, it is said that what should be allowed for the program to work has been blocked, thus the DNS record *.net.anydesk.com . But AnyDesk is not simple; it has ways to bypass domain name blocking.Once, I solved the task of blocking "Anyplace Control" that came to us with some dubious software, and it was resolved by blocking just a few IP addresses (I supplemented this with antivirus precautions). The task with AnyDesk, after I manually collected over a dozen IP addresses,
inspired me to move away from routine manual work. It was also discovered that there are several configuration-related files in "C:\ProgramData\AnyDesk", and in the file
ad_svc.trace events about connections and failures are collected. 1. Observation
As already mentioned, blocking *.anydesk.com did not yield any results in the program's operation, so it was decided to analyze
the program’s behavior in stress situations. . TCPView from Sysinternals is in hand, and off we go!1.1. It can be seen that several processes of interest are "hanging", and only the one that connects to an outside address is of interest to us. The ports to which it connects vary, from what I've observed, these are: 80, 443, 6568. 🙂 Ports 80 and 443 definitely cannot be blocked.
1.2. After blocking the address via the router, another address is easily selected.
1.2. After blocking the address via the router, another address can be easily selected.
1.3. The Console is Everything! We identify the PID, and I got a bit lucky that AnyDesk was installed as a service, thus the desired PID is the only one.
1.4. Identifying the server's IP address by the process PID.
2. Preparation
Since the program for identifying IP addresses will likely work only on my PC, I have no restrictions on convenience and laziness, hence C#.
2.1. All methods for determining the desired IP address are already known; it's just a matter of implementation.
string pid1_; // get the PID of the AnyDesk service
using (var p = new Process())
{p.StartInfo.FileName = "cmd.exe";
p.StartInfo.Arguments = " /c "tasklist.exe /fi "imagename eq AnyDesk.exe" /NH /FO CsV | findstr "Services""";
p.StartInfo.UseShellExecute = false;
p.StartInfo.RedirectStandardOutput = true;
p.StartInfo.CreateNoWindow = true;
p.StartInfo.StandardOutputEncoding = Encoding.GetEncoding("CP866");
p.Start();
string output = p.StandardOutput.ReadToEnd();
string[] pid1 = output.Split(','); // convert response to an array
pid1_ = pid1[1].Replace(""", ""); // take the 2nd element without quotes
}Similarly, we find the service that established the connection; I will only show the main line.
p.StartInfo.Arguments = " /c " netstat -n -o | findstr /I " + pid1_ + " | findstr "ESTABLISHED""";The result will be:
From the line, similarly to the previous step, we extract the 3rd column and remove everything after ":". As a result, we have our desired IP.
2.2. Blocking IP in Windows. While Linux has Blackhole and iptables, the method for blocking an IP address in one line, without using a firewall, turned out to be unfamiliar in Windows.
But what tools were available...
route add our_found_IP_address mask 255.255.255.255 10.113.113.113 if 1 -pThe key parameter "if 1" sends the route to the Loopback (Available interfaces can be displayed by running route print). And IMPORTANT! The program now needs to be run with administrator rights, since changing the route requires elevated privileges.
2.3. Displaying and saving the identified IP addresses is a trivial task and does not require explanation. If you think about it, you can also process the file events about connections and failures are collected. of AnyDesk itself, but I didn't think about it right away + there may be restrictions on it.
2.4. The strange inconsistent behavior of the program is that when "taskkill" is issued for the service process in Windows 10, it automatically restarts, while in Windows 8 it terminates, leaving only the console process and without reconnecting; overall it is illogical and inaccurate.
Killing the connected server process allows you to "force" reconnection to the next address. This is implemented similarly to the previous commands, so I will only mention:
p.StartInfo.Arguments = "\/c taskkill \/PID " + pid1_ + " \/F";Additionally, we launch the AnyDesk program.
//запускаем программу которая расположена по пути path_pro
if (File.Exists(path_pro)){
Process p1 = Process.Start(path_pro);}2.5. We will check the status of AnyDesk once a minute (or more often?), and if it connects, i.e. the connection is ESTABLISHED — block this IP, and start all over again — wait for it to connect, block and wait.
3. Attack
Code was "dashed" to visualize the process, it was decided to "+" indicate the found and blocked IP, and "." — repeat the check without a successful connection from AnyDesk.
→
As a result…
The program operated on several computers with different Windows OS versions, with AnyDesk versions 5 and 6. About 80 addresses were collected over 500 iterations. Over 2500 — 87 and so on…
Over time, the number of blocked IPs reached 100+.
Link to the final text file with addresses: and
The job is done! The pool of IP addresses has been added to the rules of the main router via the script, and AnyDesk simply cannot create an external connection.
There is a strange moment, from the initial logs it is clear that the address boot-01.net.anydesk.com. We have, of course, blocked all hosts *.net.anydesk.com with a common rule, but the strangeness is not in that. Every time during a regular ping from different computers, this domain name gives a different IP. Checking in Linux:
host boot-01.net.anydesk.com
as well as DNSLookup only gives one IP address, but this address is variable. When analyzing connections with TCPView, we get PTR records of IP addresses like relay-*.net.anydesk.com.
Theoretically: since pings sometimes go through an unknown unblocked host boot-01.net.anydesk.com we can find these IPs and block them; this implementation can be done with a regular script on Linux, where it is not necessary to install AnyDesk. Analysis showed that these IPs often "intersect" with those found in our list. Perhaps this is exactly the host that the program connects to before it begins to "iterate" through known IPs. I may later add a second part to the article searching for hosts, although at the moment the program itself does not establish external connections at all.
I hope you did not see anything illegal in the above statement, and that the creators of AnyDesk will take my actions in a sporting manner.
Source: habr.com
