With more hints dropped online on how to exploit BlueKeep, you’ve patched that Windows RDP flaw, right?

Vital clues on how to exploit the notorious Windows RDP bug, aka CVE-2019-0708 aka BlueKeep, and hijack vulnerable boxes, emerged online this week.

The growing number of hints can be used by folks to develop working code that attacks Microsoft’s Remote Desktop Services software, on Windows XP through to Server 2008, and gains kernel-level code execution without any authentication or user interaction. You just need to be able to reach a vulnerable RDP server across the network or internet.

Such an intrusion would give an attacker full control of a machine. So far, publicly available proof-of-concept exploit code mostly crashes vulnerable systems, rather than commandeer boxes. It’s feared that publicly shared, working, and reliable remote code-execution exploits, built from the aforementioned hints and tips, will be used to create a worm that can move from machine to machine, infecting them via BlueKeep as it goes, while stealing information or rolling out ransomware.

Microsoft issued free patches for BlueKeep in May, though not everyone has installed them.

New details

Earlier this week, a researcher using the handle 0xeb_bp created a GitHub repository including a written in-depth analysis of the flaw, and incomplete proof-of-concept Python code that targets Windows XP.

BlueKeep is a use-after-free() vulnerability in Remote Desktop Services’s kernel driver termdd.sys. There are more technical details here, by the Zero Day Initiative, however the summary is: it is possible to open a connection to a vulnerable RDP server, open a channel called MS_T120\x00 through this connection, send a payload of malicious code, and then terminate the connection. That will trigger the bug, and with the right voodoo, cause the smuggled code to execute.

In order to do this, you need to pull off something rather tricky: spraying the Windows kernel’s heap memory pool with data just right to achieve code execution. While the concept of heap spraying is understood by exploit developers and security engineers, it hasn’t been publicly explained within the context of CVE-2019-0708 – until now.

0xeb_bp’s PDF write-up in their GitHub repo details these vital steps, and how to overwrite the pool successfully. Although industry folks are aware of heap spraying, particularly in the context of browser exploitation, using the technique against the Windows kernel’s nonpaged pool of memory is non-trivial. For CVE-2019-0708, though, a walk-through on how to do just that is now public, and a video of it all working can be found here.

You may be relieved to hear the PDF deliberately omits certain details, such as the essential shellcode needed to commandeer a box. Also, it focuses on Windows XP, and the technique may not work on later editions of the operating system. However, along with exploitation tips detailed in a Chinese-language slide deck that appeared online two days ago, the difficult parts of a viable working exploit are now public, paving the way for someone to finish off the work and share it.

“The information here is already available within the Chinese hacker community,” 0xeb_bp pointed out.

WannaCry breaker and noted security researcher Marcus Hutchins, who is awaiting sentencing in the US for his role in developing banking malware, said this extra info will make it easier for white and black hats to exploit BlueKeep. “They provided the code to actually do the actual pool spray,” the Brit said, adding we’re probably now a week away from someone completing a working public exploit.

This should give admins who have yet to install Microsoft’s patches that last bit of motivation they need to get the bug walled off once and for all. ®

Sponsored: Balancing consumerization and corporate control

READ MORE HERE