Well-known penetration testing framework Metasploit exploit module has been added for a high-risk vulnerability BlueKeep in its arsenal.
BlueKeep number CVE-2019-0708, which is high-risk vulnerabilities were discovered in May this year , the vulnerability is a worm, you can use Windows Remote Desktop Services (RDS) to spread malicious programs, similar to the way in 2017 with the eternal blue and wreak havoc the WannaCry ransomware. An attacker could exploit this vulnerability to execute arbitrary code, and send a special request by the Remote Desktop Protocol (the RDP), to the control computer without the need for user interaction.
Before the existence BlueKeep reports that nearly 1 million high-risk vulnerabilities security risk devices, and now according to the scanning BinaryEdge, there are still risks 700 000 equipment , and most of them come from China!
This is a very terrible vulnerability, security personnel the industry had only released a few simple PoC (proof of concept) script, but they are not mature enough, on the other side we are also afraid of the terrible consequences caused as the year WannaCry attack, so even though it was We have developed a BlueKeep exploits, but refused to release the code.
Now the strongest penetration testing framework Metasploit released its BlueKeep exploit code, use the code module that is, ordinary people can also be done using the BlueKeep attack vulnerability.
Metasploit module and dozens of BlueKeep BlueKeep PoC previously circulated different, this Metasploit module can achieve code execution. But it is not so easy to use, because currently only supports user interaction in order to perform correctly, users need to enter such attacks environment, set parameters and other operations.
Currently BlueKeep Metasploit module applies only to 64-bit Windows 7 and Windows 2008 R2, the limited scope of use. The next developer's improvement plan include:
- 检测更多操作系统细节，获取内存泄漏以确定 Windows NPP 起始地址
- 编写 XP/2003 部分以处理 MS_T120 问题
- 添加检测 RDPSND 基于通道的处理是否有效
- 处理除 RDPSND/MS_T120 之外的通道
详情查看 Metasploit 说明：