关联漏洞
标题：
Microsoft Remote Desktop Services 资源管理错误漏洞
(CVE-2019-0708)
描述：Microsoft Windows和Microsoft Windows Server都是美国微软（Microsoft）公司的产品。Microsoft Windows是一套个人设备使用的操作系统。Microsoft Windows Server是一套服务器操作系统。Remote Desktop Services是其中的一个远程桌面服务组件。 Microsoft Remote Desktop Services中存在资源管理错误漏洞。该漏洞源于网络系统或产品对系统资源（如内存、磁盘空间、文件等）的管理不当。以下
描述
PoC about CVE-2019-0708 (RDP; Windows 7, Windows Server 2003, Windows Server 2008)
介绍
# CVE-2019-0708
# Introduction
Microsoft has released its monthly security update for May. Included in this month's Patch Tuesday release is CVE-2019-0708, a critical remote code execution vulnerability that could allow an unauthenticated remote attacker to execute remote code on a vulnerable target running Remote Desktop Protocol (RDP).
# Technical analysis
The vulnerability exists in the way that the RDP service handles incoming requests. An attacker can send a malicious request to the RDP service and, due to improperly sanitized request handling, the target will execute the malicious code injected into the request. CVE-2019-0708 is a pre-authentication vulnerability that requires no user interaction. The Windows versions affected are Windows XP, Windows 7, Windows Server 2003 and Windows Server 2008.
You can see below the number of RDP servers exposed to the Internet:
<p align="left">
<img src="https://github.com/syriusbughunt/CVE-2019-0708/blob/master/img/shodan1.jpg?raw=true" width="800" title="hover text">
</p>
Wow, almost 4 millions RDP exposed to the Internet that are publicly available for any 0day RCE or bruteforce attacks. Now how many of them are running Windows 7 that is currently vulnerable to CVE-2019-0708? According to Shodan, there would be potentially 12,508 RDPs identified as running Windows 7. We would think that no one is stupid enough to run a RDP server exposed to the Internet with Windows XP? Wrong. More then 2,403 RDPs have been identified by Shodan running Windows XP... RIP.
I almost forgot, this critical bug has been an 0day for a year, it has been sold on the darknet for 500k. Details available on the following link:
https://habr.com/en/company/jetinfosystems/blog/451852/
# PoC
The famous part where probably every visit on that repo are hoping so much to find a PoC. Well, all I can give you for now is this:
<p align="left">
<img src="https://github.com/syriusbughunt/CVE-2019-0708/blob/master/img/PoC_CVE-2019-0708-RDP_RCE.jpg?raw=true" width="600" title="hover text">
</p>
Keep on searching for technical analysis and you might find the details you need to build your own PoC. And please, we don't need a second WannaCry worm, get on the bug bounties and be useful of making the cyber space more secure.
# Solution
If you are running one of the OS affected by this CVE, you should be applying the full May 2019 Security Update from Microsoft. You can find below the updates that will patch this CVE:
https://www.catalog.update.microsoft.com/Search.aspx?q=KB4499175
文件快照
[4.0K] /data/pocs/d3cb193cf21d3a9a744e892cd27b03eb2cc8b707
├── [4.0K] img
│ ├── [155K] PoC_CVE-2019-0708-RDP_RCE.jpg
│ └── [142K] shodan1.jpg
└── [2.5K] README.md
1 directory, 3 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。