06. Exploiting Windows CVE 2019 0708 RDP Vulnerability (BlueKeep)
Overview¶
BlueKeep, identified as CVE-2019-0708, is a critical vulnerability in the Windows Remote Desktop Protocol (RDP). The vulnerability can allow an unauthenticated attacker to remotely execute arbitrary code on a vulnerable Windows system.
Microsoft publicly disclosed the vulnerability in May 2019 and released security updates on May 14, 2019. At the time of disclosure, approximately one million systems were estimated to be vulnerable.
BlueKeep is particularly dangerous because exploitation can occur remotely without requiring valid credentials.
Affected Windows Versions¶
BlueKeep affects several older Windows versions, including:
-
Windows XP
-
Windows Vista
-
Windows 7
-
Windows Server 2008
-
Windows Server 2008 R2
The vulnerability is associated with the Windows RDP service, which normally operates on TCP port 3389.
How BlueKeep Works¶
BlueKeep is a vulnerability in the Windows RDP protocol. An attacker can send specially crafted requests to a vulnerable RDP service.
Successful exploitation can allow code execution at the system level without authentication. Because the vulnerability affects components operating at a low system level, exploitation can potentially result in system instability or crashes.
For this reason, BlueKeep exploitation should only be performed against systems that are intentionally provided for security testing, such as a controlled lab or CTF environment.
Checking for RDP¶
The first step is to determine whether the target exposes the RDP service.
Explanation¶
Scans TCP port 3389, the standard RDP port.
Represents the target system in the lab.
A result showing port 3389/tcp as open indicates that an RDP service is accessible. However, an open RDP port alone does not prove that the system is vulnerable to BlueKeep.
Checking for BlueKeep with Metasploit¶
Metasploit provides an auxiliary scanner specifically for CVE-2019-0708.
Start Metasploit:
Search for the BlueKeep modules:
The relevant modules include:
The auxiliary module is intended to check whether an RDP service appears vulnerable.
Example:
Explanation¶
Loads the BlueKeep detection module.
Specifies the lab target.
Runs the vulnerability check.
The scanner helps determine whether the target is potentially vulnerable without immediately attempting the full RCE exploit.
Metasploit BlueKeep Exploit Module¶
Metasploit also contains an exploit module for vulnerable systems:
This module is designed to exploit vulnerable BlueKeep systems and can potentially result in a privileged Meterpreter session.
Because BlueKeep exploitation targets low-level Windows memory and kernel-related components, incorrect exploitation parameters can cause the target system to crash.
For a controlled lab, the general workflow is:
msfconsole
search BlueKeep
use auxiliary/scanner/rdp/cve_2019_0708_bluekeep
set RHOSTS <LAB_TARGET>
run
After confirming that the intentionally vulnerable lab machine is susceptible, the corresponding exploit module can be studied within the isolated environment.
Important Consideration¶
BlueKeep exploitation can cause system crashes because it interacts with kernel-space memory. Exploitation should therefore be performed carefully and only against systems where you have explicit authorization.
Never test the BlueKeep exploit against systems that you do not own or have permission to assess.
Vulnerability Assessment Workflow¶
Target
|
v
Identify RDP
|
v
TCP 3389 Open
|
v
BlueKeep Scanner
|
v
Potentially Vulnerable
|
v
Controlled Lab Validation
Key Takeaways¶
-
CVE: CVE-2019-0708
-
Name: BlueKeep
-
Affected Service: Windows Remote Desktop Protocol
-
Default Port: TCP
3389 -
Authentication: Exploitation can occur without authentication
-
Impact: Potential remote code execution
-
Metasploit Scanner:
auxiliary/scanner/rdp/cve_2019_0708_bluekeep -
Metasploit Exploit:
exploit/windows/rdp/cve_2019_0708_bluekeep_rce -
Primary Mitigation: Apply Microsoft's security updates and disable RDP when it is not required