CVE-2026-30784-rustdesk-poc

CVE-2026-30784: RustDesk hbbs Traffic Amplification PoC & PCAP Analysis

Key Findings

Key Finding: Enforcing key-based authentication (-k _) does not prevent this amplification attack, because the amplification response is triggered during the unauthenticated initial handshake/ping phase.

PCAP File Location

The packet capture is stored at:

data/attack_only.pcap.gz

PCAP Capture Context & Details

⚠️ Important Note on the Packet Capture: > To prevent server from being further utilized as an active amplifier in a distributed botnet attack, the rustdesk-server (hbbs)+(hbbr) service was completely stopped before/during the packet capture.

Because the service was disabled to mitigate ongoing outbound amplification, the provided PCAP file (data/attack_only.pcap.gz) contains incoming traffic only. Even without the server's responses, the incoming vectors clearly demonstrate the malicious intent and structural footprint of the attack:

• Inbound Flooding Only: Since hbbs was down, there is no corresponding outbound amplified response traffic in this specific trace. This was a deliberate action to protect third-party victims.
• Distinct and Static Pattern: The incoming UDP packets hitting port 21116 exhibit a highly uniform and easily identifiable payload pattern (visible as a distinct Base64-like string beginning with specific markers such as szpontnet...).
• Evidence Preservation: This capture serves purely as forensic evidence of the unauthenticated scanning and flooding phase that triggers the amplification behavior when the service is active.