关联漏洞
标题：
Microsoft Remote Desktop Services 资源管理错误漏洞
(CVE-2019-0708)
描述：Microsoft Windows和Microsoft Windows Server都是美国微软（Microsoft）公司的产品。Microsoft Windows是一套个人设备使用的操作系统。Microsoft Windows Server是一套服务器操作系统。Remote Desktop Services是其中的一个远程桌面服务组件。 Microsoft Remote Desktop Services中存在资源管理错误漏洞。该漏洞源于网络系统或产品对系统资源（如内存、磁盘空间、文件等）的管理不当。以下
描述
Proof of concept for CVE-2019-0708
介绍
# Bluekeep PoC
This repo contains research concerning CVE-2019-0708.
Bluekeep or CVE-2019-0708 is an RCE exploit that effects the following versions of Windows systems:
- Windows 2003
- Windows XP
- Windows Vista
- Windows 7
- Windows Server 2008
- Windows Server 2008 R2
The vulnerability occurs during pre-authorization and has the potential to run arbitrary malicious code in the NT Authority\system
user security context.
# How it works
By sending a specially crafted packet an attacker is able to set the value for the Channel ID to something the RDP service isn't expecting, this causes a memory corruption bug that will create the conditions for Remote Code Execution to occur. Should the attacker choose to follow up with packets designed to take advantage of this flaw remote code execution can be achieved with System user privileges.
# Setup
```
sudo apt install python python-dev python-setuptools python-pip openssl openssl-dev git
git clone https://github.com/ekultek/bluekeep
cd bluekeep
pip install -r requirements.txt
```
That should do what you need done and fix any issue you have.
### Credits
Research by [Ekultek](https://github.com/Ekultek) and (VectorSEC)/[NullArray](https://github.com/NullArray)
Development & Testing by [Ekultek](https://github.com/Ekultek)
**Follow us on Twitter**
- [Ekultek](https://twitter.com/saltythegod)
- [VectorSEC](https://twitter.com/Real__Vector)
### In Closing
You can see some of our research, along with a list of potentially vulnerable targets under the research directory. We started with very little and decided that we weren't going to stop until we had a working exploit. I have been able to execute commands on Windows XP with this PoC personally.
**Note**
There are no payloads. This is just a PoC. _HOWEVER_ it is easily ported to an exploit since you can easily add payloads to this.
文件快照
[4.0K] /data/pocs/d98c32baf476d7ca50a33ef02e37cf0cc9954bd5
├── [ 17K] bluekeep_dos.py
├── [ 19K] bluekeep_poc.py
├── [1.8K] README.md
├── [ 74] requirements.txt
└── [4.0K] research
├── [ 13M] [MS-RDPBCGR].pdf
├── [1.1K] notes.txt
├── [4.0K] rdp_packets
│ ├── [2.2M] rdpmacclear.pcap
│ ├── [3.0M] rdpmac.pcap
│ └── [224K] rdp.pcap
└── [ 772] vulnerable_targets.txt
2 directories, 10 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。