Windows RDP remote code execution (BlueKeep)

What it does

A use-after-free in the RDP protocol handling of the MS_T120 virtual channel allows an unauthenticated attacker to execute code in kernel context by sending crafted packets to port 3389.

Microsoft rated the flaw wormable and issued out-of-band patches for end-of-life Windows XP and Server 2003. Public exploits followed and the first in-the-wild campaign delivered cryptominers.

Scanning for exposed RDP on legacy Windows remains constant. Most hits against SecureBlock honeypots are automated and originate from previously compromised hosts.

Remediation

1. Apply the May 2019 security update (KB4499175 and related) or retire the affected operating systems.
2. Enable Network Level Authentication (NLA), which requires authentication before the vulnerable code path is reached.
3. Do not expose RDP directly to the internet; place it behind a VPN or gateway.

Enumeration

Detection templates and scanners you can run to find exposed instances on your own attack surface.

$ msfconsole -q -x "use auxiliary/scanner/rdp/cve_2019_0708_bluekeep; show options"

$ nuclei -id CVE-2019-0708 -u https://TARGET

Exploitation

Working exploit modules and public PoCs. Use only against systems you own or are authorized to test.

$ msfconsole -q -x "use exploit/windows/rdp/cve_2019_0708_bluekeep_rce; show options"

References

• Microsoft security update guidemsrc.microsoft.com
• NVD recordnvd.nist.gov
• CISA alert AA19-168Awww.cisa.gov