关联漏洞
标题：
Microsoft Remote Desktop Services 资源管理错误漏洞
(CVE-2019-0708)
描述：Microsoft Windows和Microsoft Windows Server都是美国微软（Microsoft）公司的产品。Microsoft Windows是一套个人设备使用的操作系统。Microsoft Windows Server是一套服务器操作系统。Remote Desktop Services是其中的一个远程桌面服务组件。 Microsoft Remote Desktop Services中存在资源管理错误漏洞。该漏洞源于网络系统或产品对系统资源（如内存、磁盘空间、文件等）的管理不当。以下
描述
CVE-2019-0708-Msf-验证
介绍
# CVE-2019-0708
Unauthenticated CVE-2019-0708 "BlueKeep" Scanner PoC by [@JaGoTu](https://twitter.com/JaGoTu) and [@zerosum0x0](https://twitter.com/zerosum0x0).
Technical details: https://zerosum0x0.blogspot.com/2019/05/avoiding-dos-how-bluekeep-scanners-work.html
### Metasploit Module
The Metasploit module has been pulled to rapid7:master.
`msf5> use auxiliary/scanner/rdp/cve_2019_0708_bluekeep`
https://github.com/rapid7/metasploit-framework/pull/11869
### RDPScan
If you're here for the C version of the scanner, check out ErrataRob's fork of this project which trims more fat and makes scanning a large range faster/easier.
https://github.com/robertdavidgraham/rdpscan
### In this repo
A scanner fork of rdesktop that can detect if a host is vulnerable to CVE-2019-0708 Microsoft Windows Remote Desktop Services Remote Code Execution vulnerability. It shouldn't cause denial-of-service, but there is never a 100% guarantee across all vulnerable versions of the RDP stack over the years. As it is unauthenticated, the scanner will not have reliable results for NLA hosts (which is a confirmed mitigation).
### Building and Running
There is a [pre-made rdesktop binary in the repo](https://github.com/zerosum0x0/CVE-2019-0708/blob/master/rdesktop-fork-bd6aa6acddf0ba640a49834807872f4cc0d0a773/rdesktop), but is a normal rdesktop build process:
```
git clone https://github.com/zerosum0x0/CVE-2019-0708.git
cd CVE-2019-0708/rdesktop-fork-bd6aa6acddf0ba640a49834807872f4cc0d0a773/
./bootstrap
./configure --disable-credssp --disable-smartcard
make
./rdesktop 192.168.1.7:3389
```
This fork of rdesktop is only well supported on an **X11 GUI Linux environment**. Results will vary for other platforms.
Please refer to the normal rdesktop compilation instructions or have a look at how the Docker image is built.
### Docker Instructions
You can also build from source using the Dockerfile and then run rdesktop using that image:
```
docker build . -t cve-2019-0708:latest
docker run cve-2019-0708:latest 192.168.1.7:3389
```
To scan a subnet or hosts indexed by Shodan, build the Docker image and run scan_with_docker.py:
```
./scan_with_docker.py 'asn:ASXXXX port:3389'
Not a valid subnet. Trying to use as Shodan search terms ...
Shodan search returned 498 hosts, press enter to start scan
Vulnerable hosts:
x.x.x.x
x.x.x.x
[...]
./scan_with_docker.py 192.168.1.0/24
Vulnerable hosts:
192.168.1.28
192.168.1.30
[...]
```
### Is this dangerous?
Small details of the vulnerability have already begun to reach mainstream. This tool does not grant attackers a free ride to a theoretical RCE.
Modifying this PoC to trigger the denial-of-service does lower the bar of entry but will also require some amount of effort. We did not originally offer an explanation of how this scanner works other than to tell the user it seems to be accurate in testing and follows a logical path.
System administrators need tools like this to discover vulnerable hosts. This tool is offered for legal purposes only and to forward the security community's understanding of this vulnerability. As this PoC actively exploits the vulnerability, do not use against targets without prior permission.
### Contributors
- [JaGoTu](https://twitter.com/jagotu)
- [zerosum0x0](https://twitter.com/zerosum0x0)
- [SUNET](https://github.com/SUNET)
### License
rdesktop fork is licensed as GPLv3.
Metasploit module is licensed as Apache 2.0.
文件快照
[4.0K] /data/pocs/f40795431433cb189d73dc1323d550d60ba51fcd
├── [ 23K] cve_2019_0708_bluekeep.rb
├── [4.0K] docker
│ ├── [ 328] entrypoint.sh
│ └── [1.1K] setup.sh
├── [ 500] Dockerfile
├── [ 11K] LICENSE
├── [4.0K] rdesktop-fork-bd6aa6acddf0ba640a49834807872f4cc0d0a773
│ ├── [2.0K] asn.c
│ ├── [ 17K] bitmap.c
│ ├── [ 46] bootstrap
│ ├── [ 10K] cache.c
│ ├── [4.9K] channels.c
│ ├── [4.9K] cliprdr.c
│ ├── [ 41K] config.guess
│ ├── [ 30K] config.sub
│ ├── [ 25K] configure.ac
│ ├── [ 16K] constants.h
│ ├── [ 34K] COPYING
│ ├── [ 22K] cssp.c
│ ├── [ 11K] ctrl.c
│ ├── [ 33K] disk.c
│ ├── [4.5K] disk.h
│ ├── [4.0K] doc
│ │ ├── [ 759] AUTHORS
│ │ ├── [7.8K] ChangeLog
│ │ ├── [1.3K] ctrl.txt
│ │ ├── [1.2K] HACKING
│ │ ├── [1.0K] ipv6.txt
│ │ ├── [3.1K] keymap-names.txt
│ │ ├── [7.6K] keymapping.txt
│ │ ├── [9.0K] keynums.png
│ │ ├── [2.9K] licensing.txt
│ │ ├── [ 934] lspci-channel.txt
│ │ ├── [ 505] makerelease.txt
│ │ ├── [9.1K] patches.txt
│ │ ├── [ 12K] rdesktop.1
│ │ ├── [5.4K] rdpsnd-rec.txt
│ │ ├── [8.8K] rdpsnd.txt
│ │ ├── [1.5K] redirection.txt
│ │ ├── [ 13K] seamlessrdp-channel.txt
│ │ └── [2.3K] TODO
│ ├── [ 15K] ewmhints.c
│ ├── [1.1K] genauthors
│ ├── [ 157] indent-all.sh
│ ├── [5.4K] install-sh
│ ├── [7.8K] iso.c
│ ├── [4.0K] keymaps
│ │ ├── [2.2K] ar
│ │ ├── [4.4K] common
│ │ ├── [1.8K] convert-map
│ │ ├── [3.0K] cs
│ │ ├── [2.5K] da
│ │ ├── [2.4K] de
│ │ ├── [2.5K] de-ch
│ │ ├── [2.9K] en-dv
│ │ ├── [2.5K] en-gb
│ │ ├── [ 609] en-us
│ │ ├── [1.9K] en-us-intl
│ │ ├── [2.2K] es
│ │ ├── [1.1K] et
│ │ ├── [2.6K] fi
│ │ ├── [ 907] fo
│ │ ├── [2.5K] fr
│ │ ├── [2.7K] fr-be
│ │ ├── [1.6K] fr-bepo
│ │ ├── [ 985] fr-ca
│ │ ├── [2.5K] fr-ch
│ │ ├── [1.4K] he
│ │ ├── [2.6K] hr
│ │ ├── [1.8K] hu
│ │ ├── [3.0K] is
│ │ ├── [2.4K] it
│ │ ├── [2.5K] ja
│ │ ├── [ 644] ko
│ │ ├── [1.1K] lt
│ │ ├── [2.8K] lv
│ │ ├── [2.3K] mk
│ │ ├── [ 321] modifiers
│ │ ├── [1.1K] nl
│ │ ├── [2.8K] nl-be
│ │ ├── [2.5K] no
│ │ ├── [2.6K] pl
│ │ ├── [2.4K] pt
│ │ ├── [1.3K] pt-br
│ │ ├── [2.5K] ru
│ │ ├── [3.1K] sk
│ │ ├── [2.2K] sl
│ │ ├── [ 987] sv
│ │ ├── [3.0K] th
│ │ └── [2.2K] tr
│ ├── [ 11K] licence.c
│ ├── [4.4K] lspci.c
│ ├── [5.0K] Makefile.in
│ ├── [7.5K] mcs.c
│ ├── [8.5K] mppc.c
│ ├── [1.7K] mst120.c
│ ├── [ 31K] orders.c
│ ├── [5.6K] orders.h
│ ├── [4.4K] parallel.c
│ ├── [3.7K] parse.h
│ ├── [4.2K] printer.c
│ ├── [7.1K] printercache.c
│ ├── [ 16K] proto.h
│ ├── [ 893] proto.head
│ ├── [ 74] proto.tail
│ ├── [5.2K] pstcache.c
│ ├── [1.3M] rdesktop
│ ├── [ 42K] rdesktop.c
│ ├── [4.7K] rdesktop.h
│ ├── [ 888] rdesktop.spec
│ ├── [2.9K] rdp5.c
│ ├── [ 41K] rdp.c
│ ├── [ 28K] rdpdr.c
│ ├── [ 11K] rdpsnd_alsa.c
│ ├── [ 22K] rdpsnd.c
│ ├── [ 10K] rdpsnd_dsp.c
│ ├── [1.3K] rdpsnd_dsp.h
│ ├── [1.9K] rdpsnd.h
│ ├── [4.8K] rdpsnd_libao.c
│ ├── [ 10K] rdpsnd_oss.c
│ ├── [7.3K] rdpsnd_sgi.c
│ ├── [9.7K] rdpsnd_sun.c
│ ├── [1.6K] README
│ ├── [9.4K] scancodes.h
│ ├── [ 66K] scard.c
│ ├── [5.9K] scard.h
│ ├── [ 10K] seamless.c
│ ├── [ 795] seamless.h
│ ├── [ 24K] secure.c
│ ├── [ 27K] serial.c
│ ├── [5.5K] ssl.c
│ ├── [2.6K] ssl.h
│ ├── [ 12K] tcp.c
│ ├── [4.0K] tests
│ │ ├── [5.2K] brushtest.c
│ │ ├── [ 244] brushtestMakefile
│ │ └── [ 310] notepadbehindwordpad.c
│ ├── [5.5K] types.h
│ ├── [4.0K] uiports
│ │ ├── [ 715] makefile_nanox
│ │ ├── [1.8K] makefile_qt
│ │ ├── [ 740] makefile_qte
│ │ ├── [1.4K] makefile_svga
│ │ ├── [ 401] makefile_xxx
│ │ ├── [ 251] nanoxreadme.txt
│ │ ├── [ 39K] nanoxwin.c
│ │ ├── [ 377] qtereadme.txt
│ │ ├── [ 68K] qtewin.cpp
│ │ ├── [2.2K] qtewin.h
│ │ ├── [ 365] qtreadme.txt
│ │ ├── [ 47K] qtwin.cpp
│ │ ├── [ 683] qtwin.h
│ │ ├── [ 511] readme.txt
│ │ ├── [ 994] svgareadme.txt
│ │ ├── [ 47K] svgawin.c
│ │ └── [9.8K] xxxwin.c
│ ├── [4.0K] utils.c
│ ├── [4.0K] vnc
│ │ ├── [ 29K] vnc.c
│ │ ├── [2.2K] vnc.h
│ │ ├── [ 43K] x11stubs.c
│ │ └── [ 879] x11stubs.h
│ ├── [ 36K] xclip.c
│ ├── [ 26K] xkeymap.c
│ ├── [ 928] xproto.h
│ └── [101K] xwin.c
├── [3.4K] README.md
├── [2.9K] scan_with_docker.py
└── [101K] screenshot.png
7 directories, 162 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。