Understanding Guacamodel RDP connection could be important if it is being called from another tool. The connection file contains some parameters that will help make the connection from browser. Guac effectively becomes and RDP proxy when RDP is initiated from a Broswer.

An Apache Guacamole RDP connection looks like following. This is also called Guacamole remote desktop session launch payload. It is used in a web-based remote access system. {“url”:”example.invalid:8443/guacamole”,”token”:”","json":""}

Here’s a breakdown of its components:

1. URL

“url”: “example.invalid:8443/guacamole”

2. Token

“token”: “”

• A long, URL-encoded token used for authentication or session validation.
• It likely contains encrypted or signed data to validate the user and session.

3. JSON Configuration

{
  "username": "shahzad.ali-rec-1756137704000",
  "connections": {
    "ExampleWindowsRdpRecording": {
      "protocol": "rdp",
      "parameters": {
        "security": "nla",
        "username": "shahzad.ali-rec",
        "recording-name": "${GUAC_DATE}-${GUAC_TIME}-shahzad.ali@mailinator.com-shahzad.ali-rec-ExampleWindowsRdpRecording",
        "ignore-cert": "true",
        "port": "3389",
        "recording-path": "/home/guacd/recordings",
        "hostname": "10.0.1.190",
        "password": "password"
      }
    }
  },
  "expires": 1756137704000
}

• username : A unique session identifier with a timestamp.
• connections : Defines an RDP connection named ExampleWindowsRdpRecording.
• recording-name : Uses dynamic variables to name the session recording.
• hostname : Internal IP of the Windows machine being accessed.
• recording-path : Where session recordings are stored.
• expires : Epoch timestamp indicating when the token/session expires.

Summary

This payload is used to:

• Launch a remote desktop session to a Windows machine (10.0.1.190) via RDP.
• Authenticate the user (shahzad.ali-rec) using a token.
• Record the session for auditing or playback.
• Automatically expire the session after a certain time.