关联漏洞
标题：
Microsoft Remote Desktop Services 资源管理错误漏洞
(CVE-2019-0708)
描述：Microsoft Windows和Microsoft Windows Server都是美国微软（Microsoft）公司的产品。Microsoft Windows是一套个人设备使用的操作系统。Microsoft Windows Server是一套服务器操作系统。Remote Desktop Services是其中的一个远程桌面服务组件。 Microsoft Remote Desktop Services中存在资源管理错误漏洞。该漏洞源于网络系统或产品对系统资源（如内存、磁盘空间、文件等）的管理不当。以下
描述
CVE-2019-0708-PoC It is a semi-functional exploit capable of remotely accessing a Windows computer by exploiting the aforementioned vulnerability, this repository also contains notes on how to complete the attack.
介绍
# CVE-2019-0708-PoC
CVE-2019-0708-PoC It is a semi-functional exploit capable of remotely accessing a Windows computer by exploiting the aforementioned vulnerability, this repository also contains notes on how to complete the attack.
CVE-2019-0708-PoC:
We are working for a fully functional exploit,
here there are pseudocodes and notes.
"\x03\x00\x00\x0c\x02\xf0\x808\x00\x06MS_T120\x00\x00\x00\x00AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
adding payloads isn’t very hard. You have to make the payload though, mine won’t be shared.
All you have to do is find the correct spot.
'tls.sendall(“payloadhex”)'.
First code is "\x03\x00\x00\x0c\x02\xf0\x808\x00\x06" i think it's "0300000c02f080380006",
as in "dep": "0300000c02f080380006",
next is MS_T120 - it's "4d535f5431323000000000",
so the first part must be "030000c02f0803800064d535f5431323000000000$YourShell",
find the correct spot in the heap memory pool.
It's not insanely difficult, if you've exploited buffer overflows
then just do the same thing here, (sort of).
Run a debugger on the RDP machine to watch the memory pool.
Setting the value of ECX to a actual memory address instead of "AAAAAAAAAAA",
will allow you to control the space of EAX,
where the shellcode needs to land,
achieved by heap spraying.
文件快照
[4.0K] /data/pocs/db52faad9a1398e8705411e2fa875f8a0f555e0b
├── [ 17K] exp.py
├── [ 20K] poc.py
├── [1.2K] README.md
└── [ 163] setup.sh
0 directories, 4 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。