upload about CVE-2019-0708

ablacknut · Aug 31, 2019 · 1df4cfd · 1df4cfd
1 parent 16236ec
commit 1df4cfd
Show file tree

Hide file tree

Showing 11 changed files with 919 additions and 0 deletions.
diff --git a/BlueKeep/README.md b/BlueKeep/README.md
@@ -0,0 +1,48 @@
+# Bluekeep PoC
+
+This repo contains research concerning CVE-2019-0708.  
+
+Bluekeep or CVE-2019-0708 is an RCE exploit that effects the following versions of Windows systems:
+
+   - Windows 2003
+   - Windows XP
+   - Windows Vista
+   - Windows 7
+   - Windows Server 2008
+   - Windows Server 2008 R2
+
+The vulnerability occurs during pre-authorization and has the potential to run arbitrary malicious code in the NT Authority\system 
+user security context.
+
+# How it works
+
+By sending a specially crafted packet an attacker is able to set the value for the Channel ID to something the RDP service isn't expecting, this causes a memory corruption bug that will create the conditions for Remote Code Execution to occur. Should the attacker choose to follow up with packets designed to take advantage of this flaw remote code execution can be achieved with System user privileges.
+
+# Setup
+
+```
+git clone https://github.com/ekultek/bluekeep 
+cd bluekeep
+bash setup.sh
+```
+
+That should do what you need done and fix any issue you have.
+
+### Credits
+
+Research by [Ekultek](https://github.com/Ekultek) and (VectorSEC)/[NullArray](https://github.com/NullArray)
+
+Development & Testing by [Ekultek](https://github.com/Ekultek)
+
+**Follow us on Twitter**
+
+ - [Ekultek](https://twitter.com/saltythegod)
+ - [VectorSEC](https://twitter.com/Real__Vector)
+
+### In Closing
+
+You can see some of our research, along with a list of potentially vulnerable targets under the research directory. We started with very little and decided that we weren't going to stop until we had a working exploit. I have been able to execute commands on Windows XP with this PoC personally.
+
+**Note**
+
+There are no payloads. This is just a PoC. _HOWEVER_ it is easily ported to an exploit since you can easily add payloads to this.
diff --git a/BlueKeep/bluekeep_poc.py b/BlueKeep/bluekeep_poc.py
diff --git a/BlueKeep/bluekeep_weaponized_dos.py b/BlueKeep/bluekeep_weaponized_dos.py
diff --git a/BlueKeep/requirements.txt b/BlueKeep/requirements.txt
@@ -0,0 +1 @@
+pyopenssl==19.0
diff --git a/BlueKeep/research/[MS-RDPBCGR].pdf b/BlueKeep/research/[MS-RDPBCGR].pdf
diff --git a/BlueKeep/research/notes.txt b/BlueKeep/research/notes.txt
@@ -0,0 +1,13 @@
+https://t.co/amKnSU7lOz
+parameter to change icaBindChannel
+https://github.com/citronneur/rdpy/tree/master/rdpy/protocol/rdp/t125
+http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.331.339&rep=rep1&type=pdf
+https://waitfordebug.wordpress.com/2012/05/08/scapy-rdp-class/
+https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/db6713ee-1c0e-4064-a3b3-0fac30b4037b
+https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/04c60697-0d9a-4afd-a0cd-2cc133151a9c
+https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/f5d6a541-9b36-4100-b78f-18710f39f247
+https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/db6713ee-1c0e-4064-a3b3-0fac30b4037b
+https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/772d618e-b7d6-4cd0-b735-fa08af558f9d
+https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/4c3c2710-0bf0-4c54-8e69-aff40ffcde66
+https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/2d122191-af10-4e36-a781-381e91c182b7
+https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/9cde84cd-5055-475a-ac8b-704db419b66f
diff --git a/BlueKeep/research/rdp_packets/rdp.pcap b/BlueKeep/research/rdp_packets/rdp.pcap
diff --git a/BlueKeep/research/rdp_packets/rdpmac.pcap b/BlueKeep/research/rdp_packets/rdpmac.pcap
diff --git a/BlueKeep/research/rdp_packets/rdpmacclear.pcap b/BlueKeep/research/rdp_packets/rdpmacclear.pcap
diff --git a/BlueKeep/research/vulnerable_targets.txt b/BlueKeep/research/vulnerable_targets.txt
@@ -0,0 +1,54 @@
+64.79.123.141
+207.38.107.127
+104.223.234.10
+64.156.14.167
+213.246.110.235
+66.55.149.200
+50.192.50.9
+65.152.209.66
+129.146.108.2
+185.228.45.160
+45.66.9.96
+107.148.147.205
+82.208.39.117
+114.116.68.150
+95.143.206.99
+185.141.200.135
+196.46.20.92
+196.50.7.21
+196.195.239.64
+196.195.239.70
+196.62.118.103
+196.195.239.68
+196.41.52.35
+196.195.239.67
+196.195.239.66
+196.31.63.210
+196.195.239.71
+196.50.21.45
+196.92.6.160
+196.195.239.69
+200.129.35.34
+85.214.130.17
+122.15.192.3
+186.202.37.24
+191.252.59.176
+121.204.183.210
+187.87.134.247
+191.252.59.233
+191.252.56.248
+177.124.104.23
+179.188.1.142
+186.202.137.211
+179.188.38.227
+177.153.8.171
+186.202.69.224
+89.152.250.233
+173.249.53.169
+196.46.184.181
+43.240.14.25
+197.45.45.16
+88.172.204.90
+197.45.45.18
+177.36.242.52
+191.252.3.153
diff --git a/BlueKeep/setup.sh b/BlueKeep/setup.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+
+git clone https://github.com/SecureAuthCorp/impacket.git
+touch ./impacket/__init__.py