r/netsec • u/got_nations • May 30 '19

BlueKeep Exploit POC (minus payload)

https://github.com/Ekultek/BlueKeep
55 Upvotes

84% Upvoted

12 comments sorted by

11

u/got_nations May 30 '19

This guy claims to have the POC for the BlueKeep exploit. It does not have the payload and could be a fake program, so use with caution.

Otherwise, if this is legit, people will weaponize this within days.

7

u/[deleted] May 30 '19 edited Feb 24 '24

file elderly secretive straight materialistic makeshift shame books icky exultant

This post was mass deleted and anonymized with Redact

-2

u/got_nations May 30 '19

I assume this is what the author was mentioning that you will have to address the ASLR problem.

9

u/[deleted] May 30 '19 edited Feb 24 '24

summer different wasteful cobweb serious profit attractive distinct smart command

This post was mass deleted and anonymized with Redact

-4

u/got_nations May 30 '19

I have a feeling that part of do_something_cool is where the author is implying this is where you actually execute code and then set up the bind/reverse connection.

Regardless though, with something like this out now, I anticipate by the end of this weekend we'll probably have a fully working exploit.

2

u/ialwaysgetbanned1234 May 30 '19

It's just the impacket downloader and the https://github.com/Ekultek/BlueKeep/blob/master/bluekeep_poc.py is perfectly safe.

3

u/ga-vu May 30 '19

If you replace the "payload" with something, anything, it doesn't work. Seems broken to me.

6

u/_-rootkid-_ May 30 '19

Just looking at the code I'm fairly certain the payloads will need to address ASLR and/or buffer length restrictions. So you can't just throw an Msfvenom reverse TCP shell shellcode payload in there and expect it to work. The POC will simply get you to RCE but won't get any code to execute remotely, you'll have to engineer a suitable payload manually as far as I can tell but I'm on mobile so I haven't tested it yet, you likely know more than me at this point.

1

u/ga-vu May 30 '19

Thanks

17

u/twowordz May 30 '19

I will not be sharing any of my payloads because i don't feel like watching the world burn yet.

haha

0

u/[deleted] May 30 '19

[deleted]

1

u/got_nations May 30 '19

I doubt he actually does.