Exploitation of Windows RDP Vulnerability CVE-2019-0708 (Blue Keep): Get RCE with System Privilege Using Refresh Rect PDU and RDPDR Client Name Request PDU
Summary: Unit 42 researchers detailed how combining Refresh Rect PDU and RDPDR Client Name Request PDU achieves remote code execution with system privilege on Windows RDP endpoints vulnerable to CVE-2019-0708, known as BlueKeep, which Microsoft patched out-of-band in May 2019. The exploit grooms 0x828-sized kernel pools from 0x86000000 to 0x8a000000, reclaims the freed MS_T120 channel object with a 0xc8-sized pool, and uses a 4-byte shellcode slipper with a theoretical 81.25% success rate before a final kernel shellcode inserts an APC into lsass.exe or spoolsv.exe.
Bottom line: The exploit's own authors put its success rate at 81.25%, and the technique was presented publicly at BlueHat Seattle 2019 - meaning any unpatched RDP endpoint exposed to the network is a realistic target for system-level compromise.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Endpoint & Network Security
- Mentions
- CVE-2019-0708
- Related
- CVE-2019-0708: Microsoft Remote Desktop Services Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021