CVE-2024-38077 PoC — Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

Source

https://github.com/BambiZombie/CVE-2024-38077-check

Associated Vulnerability

Title: Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability (CVE-2024-38077)
Description:Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

Description

基于135端口检测目标是否存在CVE-2024-38077漏洞

Readme

# CVE-2024-38077_check
基于135端口检测目标是否存在CVE-2024-38077漏洞，需要目标机器防火墙未对135进行限制，如果目标开启RDL服务，则受该漏洞影响，如果目标服务器更新了补丁，进行RPC尝试连接该服务会返回 nca_s_fault_access_denied 。

注：2008、2012 补丁没打成功，所以不确定是不是返回 access_denied，图中已更新漏洞补丁的是 2016 和 2019 。

![image](https://github.com/user-attachments/assets/c196e80f-a99e-4606-a6cb-3b80f5adc3dd)

![image](https://github.com/user-attachments/assets/5a4e5dc0-8fd0-4e3d-a212-82c8535b4f95)

![打了补丁的包](https://github.com/user-attachments/assets/3369da81-bb3c-4df4-9ef6-1272733ddf51)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →