Scanner PoC for CVE-2019-0708 RDP RCE vuln# CVE-2019-0708
CVE-2019-0708 Scanner PoC by [@JaGoTu](https://twitter.com/JaGoTu) and [@zerosum0x0](https://twitter.com/zerosum0x0).
### In this repo
A scanner fork of rdesktop that can detect if a host is vulnerable to CVE-2019-0708 Microsoft Windows Remote Desktop Services Remote Code Execution vulnerability.
It shouldn't cause denial-of-service, but there is no 100% guarantee across all vulnerable versions of the RDP stack over the years.
There is also a Metasploit module, which is a current work in progress (MSF does not have an RDP library).
### Building
There is a pre-made binary, but the steps to building from source are as follows:
```
git clone https://github.com/zerosum0x0/CVE-2019-0708.git
cd CVE-2019-0708/rdesktop-fork-bd6aa6acddf0ba640a49834807872f4cc0d0a773/
./bootstrap
./configure --disable-credssp --disable-smartcard
make
```
Please refer to the normal rdesktop compilation instructions.
### Is this dangerous?
Small details of the vulnerability have already begun to reach mainstream. This tool in no way enables attackers to achieve a theoretical RCE.
Modifying this PoC to trigger the denial-of-service does lower the bar but will also require some amount of effort. We offer no explanation of how this scanner works other than to tell the user it seems to be accurate in testing and follows a logical path.
System administrators need tools like this to discover vulnerable hosts. This tool is offered for legal purposes only and to forward the security community's understanding of this vulnerability.
### License
rdesktop fork is licensed as GPLv3.
Metasploit module is licensed as Apache 2.0.
[4.0K] /data/pocs/57d7598de52ff3dc5c32776753026104f51451c5
├── [ 19K] cve_2019_0708.rb
├── [ 11K] LICENSE
├── [4.0K] rdesktop-fork-bd6aa6acddf0ba640a49834807872f4cc0d0a773
│ ├── [2.0K] asn.c
│ ├── [ 17K] bitmap.c
│ ├── [ 46] bootstrap
│ ├── [ 10K] cache.c
│ ├── [4.9K] channels.c
│ ├── [4.9K] cliprdr.c
│ ├── [ 41K] config.guess
│ ├── [ 30K] config.sub
│ ├── [ 25K] configure.ac
│ ├── [ 16K] constants.h
│ ├── [ 34K] COPYING
│ ├── [ 22K] cssp.c
│ ├── [ 11K] ctrl.c
│ ├── [ 33K] disk.c
│ ├── [4.5K] disk.h
│ ├── [4.0K] doc
│ │ ├── [ 759] AUTHORS
│ │ ├── [7.8K] ChangeLog
│ │ ├── [1.3K] ctrl.txt
│ │ ├── [1.2K] HACKING
│ │ ├── [1.0K] ipv6.txt
│ │ ├── [3.1K] keymap-names.txt
│ │ ├── [7.6K] keymapping.txt
│ │ ├── [9.0K] keynums.png
│ │ ├── [2.9K] licensing.txt
│ │ ├── [ 934] lspci-channel.txt
│ │ ├── [ 505] makerelease.txt
│ │ ├── [9.1K] patches.txt
│ │ ├── [ 12K] rdesktop.1
│ │ ├── [5.4K] rdpsnd-rec.txt
│ │ ├── [8.8K] rdpsnd.txt
│ │ ├── [1.5K] redirection.txt
│ │ ├── [ 13K] seamlessrdp-channel.txt
│ │ └── [2.3K] TODO
│ ├── [ 15K] ewmhints.c
│ ├── [1.1K] genauthors
│ ├── [ 157] indent-all.sh
│ ├── [5.4K] install-sh
│ ├── [7.8K] iso.c
│ ├── [4.0K] keymaps
│ │ ├── [2.2K] ar
│ │ ├── [4.4K] common
│ │ ├── [1.8K] convert-map
│ │ ├── [3.0K] cs
│ │ ├── [2.5K] da
│ │ ├── [2.4K] de
│ │ ├── [2.5K] de-ch
│ │ ├── [2.9K] en-dv
│ │ ├── [2.5K] en-gb
│ │ ├── [ 609] en-us
│ │ ├── [1.9K] en-us-intl
│ │ ├── [2.2K] es
│ │ ├── [1.1K] et
│ │ ├── [2.6K] fi
│ │ ├── [ 907] fo
│ │ ├── [2.5K] fr
│ │ ├── [2.7K] fr-be
│ │ ├── [1.6K] fr-bepo
│ │ ├── [ 985] fr-ca
│ │ ├── [2.5K] fr-ch
│ │ ├── [1.4K] he
│ │ ├── [2.6K] hr
│ │ ├── [1.8K] hu
│ │ ├── [3.0K] is
│ │ ├── [2.4K] it
│ │ ├── [2.5K] ja
│ │ ├── [ 644] ko
│ │ ├── [1.1K] lt
│ │ ├── [2.8K] lv
│ │ ├── [2.3K] mk
│ │ ├── [ 321] modifiers
│ │ ├── [1.1K] nl
│ │ ├── [2.8K] nl-be
│ │ ├── [2.5K] no
│ │ ├── [2.6K] pl
│ │ ├── [2.4K] pt
│ │ ├── [1.3K] pt-br
│ │ ├── [2.5K] ru
│ │ ├── [3.1K] sk
│ │ ├── [2.2K] sl
│ │ ├── [ 987] sv
│ │ ├── [3.0K] th
│ │ └── [2.2K] tr
│ ├── [ 11K] licence.c
│ ├── [4.4K] lspci.c
│ ├── [5.0K] Makefile.in
│ ├── [7.5K] mcs.c
│ ├── [8.5K] mppc.c
│ ├── [1.7K] mst120.c
│ ├── [ 31K] orders.c
│ ├── [5.6K] orders.h
│ ├── [4.4K] parallel.c
│ ├── [3.7K] parse.h
│ ├── [4.2K] printer.c
│ ├── [7.1K] printercache.c
│ ├── [ 16K] proto.h
│ ├── [ 893] proto.head
│ ├── [ 74] proto.tail
│ ├── [5.2K] pstcache.c
│ ├── [ 42K] rdesktop.c
│ ├── [4.7K] rdesktop.h
│ ├── [ 888] rdesktop.spec
│ ├── [2.9K] rdp5.c
│ ├── [ 41K] rdp.c
│ ├── [ 28K] rdpdr.c
│ ├── [ 11K] rdpsnd_alsa.c
│ ├── [ 22K] rdpsnd.c
│ ├── [ 10K] rdpsnd_dsp.c
│ ├── [1.3K] rdpsnd_dsp.h
│ ├── [1.9K] rdpsnd.h
│ ├── [4.8K] rdpsnd_libao.c
│ ├── [ 10K] rdpsnd_oss.c
│ ├── [7.3K] rdpsnd_sgi.c
│ ├── [9.7K] rdpsnd_sun.c
│ ├── [1.6K] README
│ ├── [9.4K] scancodes.h
│ ├── [ 66K] scard.c
│ ├── [5.9K] scard.h
│ ├── [ 10K] seamless.c
│ ├── [ 795] seamless.h
│ ├── [ 24K] secure.c
│ ├── [ 27K] serial.c
│ ├── [5.5K] ssl.c
│ ├── [2.6K] ssl.h
│ ├── [ 12K] tcp.c
│ ├── [4.0K] tests
│ │ ├── [5.2K] brushtest.c
│ │ ├── [ 244] brushtestMakefile
│ │ └── [ 310] notepadbehindwordpad.c
│ ├── [5.5K] types.h
│ ├── [4.0K] uiports
│ │ ├── [ 715] makefile_nanox
│ │ ├── [1.8K] makefile_qt
│ │ ├── [ 740] makefile_qte
│ │ ├── [1.4K] makefile_svga
│ │ ├── [ 401] makefile_xxx
│ │ ├── [ 251] nanoxreadme.txt
│ │ ├── [ 39K] nanoxwin.c
│ │ ├── [ 377] qtereadme.txt
│ │ ├── [ 68K] qtewin.cpp
│ │ ├── [2.2K] qtewin.h
│ │ ├── [ 365] qtreadme.txt
│ │ ├── [ 47K] qtwin.cpp
│ │ ├── [ 683] qtwin.h
│ │ ├── [ 511] readme.txt
│ │ ├── [ 994] svgareadme.txt
│ │ ├── [ 47K] svgawin.c
│ │ └── [9.8K] xxxwin.c
│ ├── [4.0K] utils.c
│ ├── [4.0K] vnc
│ │ ├── [ 29K] vnc.c
│ │ ├── [2.2K] vnc.h
│ │ ├── [ 43K] x11stubs.c
│ │ └── [ 879] x11stubs.h
│ ├── [ 36K] xclip.c
│ ├── [ 26K] xkeymap.c
│ ├── [ 928] xproto.h
│ └── [101K] xwin.c
├── [1.6K] README.md
└── [101K] screenshot.png
6 directories, 157 files