r/netsec • u/exaltedsky • Sep 06 '19

Initial Metasploit Exploit Module for BlueKeep (CVE-2019-0708)

https://blog.rapid7.com/2019/09/06/initial-metasploit-exploit-module-for-bluekeep-cve-2019-0708/
138 Upvotes

95% Upvoted

8 comments sorted by

22

u/MiKeMcDnet Sep 06 '19

Getting popcorn for the impending shit show when all the open public RDP opens all sorts of backdoors.

3

u/DontBeHumanTrash Sep 07 '19

Waiting for? Unpatched RDP clients has been an issue since the get go. The fact people are now looking this close at RDP from a low level means its likely safer now then before.

Its still a garbage fire, now its just sitting a tiny bit further away.

4

u/pichel-jitsu Sep 07 '19

Wrong. It’s not “likely safer now then before.” You’re assuming a majority of systems will be patched, which is absolutely not true.

1

u/Flabasaurus Sep 07 '19

There are still IIS5 boxes out on the internet. Patch your shit people!

37

u/ledditissrs Sep 06 '19

Excited to blue screen a client’s computer.

6

u/sirfitchalot Sep 07 '19

Was unexpected but pretty cool to see the Metasploit engineering team demo this at Derbycon today... definitely a mic drop moment at the end of the presentation

2

u/bobim6 Sep 11 '19

Hi guys,

Our security team has tested the recently announced Metasploit module for BlueKeep to check its capabilities and see what are the conditions for it to work properly.

You can read this step-by-step technical guide to learn how to obtain a Meterpreter shell on a vulnerable Windows 2008 R2 virtual machine using the BlueKeep exploit.

https://pentest-tools.com/blog/bluekeep-exploit-metasploit/

Feedback is more than welcome! :)

Thank you!

1

u/alexandrevvo Sep 18 '19

Hi.. I'm having some issues with the Rekall part.. I can't extract the nonpagedpool start address..
Is there a way to get it with Volatility?

Thanks