CVE-2019-0708 PoC — Microsoft Remote Desktop Services 资源管理错误漏洞

Source

https://github.com/FrostsaberX/CVE-2019-0708

Associated Vulnerability

Title:Microsoft Remote Desktop Services 资源管理错误漏洞 (CVE-2019-0708)
Description:A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.

Description

CVE-2019-0708 With Metasploit-Framework Exploit

Readme

# CVE-2019-0708
## CVE-2019-0708 with Metasploit-Framework


#### CVE-2019-0708漏洞是通过检查用户的身份认证，导致可以绕过认证，不用任何的交互，直接通过rdp协议进行连接发送恶意代码执行命令到服务器中去。如果被攻击者利用，会导致服务器入侵，中病毒，像WannaCry 永恒之蓝漏洞一样大规模的感染。


### 2019年9月7日晚上凌晨1点左右，metaspolit更新了漏洞利用程序。

## Usage：
-------------------------------------
# 0x01 环境搭建

###  Terminal执行 
`` apt install metasploit-framework ``

`` cp rdp.rb /usr/share/metasploit-framework/lib/msf/core/exploit/ ``

`` cp rdp_scanner.rb /usr/share/metasploit-framework/modules/auxiliary/scanner/ ``

`` cp cve_2019_0708_bluekeep_rce.rb /usr/share/metasploit-framework/modules/exploits/windows/rdp/ ``

`` cp cve_2019_0708_bluekeep.rb /usr/share/metasploit-framework/modules/auxiliary/scanner/rdp/ ``

# 0x02 操作方法
### 1.用windwos/rdp/cve_2019_0708_bluekeep_rce模块

### 2.设置RHOSTS以及target（如果靶机使用vmare target设置为3）
##### ``   0   Automatic targeting via fingerprinting ``
##### ``   1   Windows 7 SP1 / 2008 R2 (6.1.7601 x64) ``
##### ``   2   Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - Virtualbox) ``
##### ``   3   Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - VMWare) ``
##### ``   4   Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - Hyper-V) ``




### 3. 运行exp

File Snapshot


 [4.0K]  /data/pocs/e10e266714b1bcc801145277a8e51ffbdc94ea51
├── [4.0K]  CVE-2019-0708
│   ├── [8.3K]  cve_2019_0708_bluekeep.rb
│   ├── [ 39K]  cve_2019_0708_bluekeep_rce.rb
│   ├── [ 46K]  rdp.rb
│   └── [3.0K]  rdp_scanner.rb
├── [ 11K]  LICENSE
└── [1.4K]  README.md

1 directory, 6 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!