Experts added a BlueKeep exploit module to MetaSploit
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-0708 | Unauthenticated RCE in Microsoft Remote Desktop Services (BlueKeep) CVE-2019-0708 is a use-after-free (CWE-416) vulnerability in Microsoft Remote Desktop Services, formerly Terminal Services, in which an unauthenticated attacker can connect to a target system over RDP and send specially crafted requests to trigger the flaw. Because the trigger requires no authentication, the flaw is wormable: a successful exploit grants remote code execution on the target host, potentially with elevated privileges, and could allow self-propagating attacks similar to WannaCry. Organizations running the affected Microsoft Remote Desktop Services, particularly legacy Windows releases still accepting inbound RDP connections, are in scope. Exploitation is confirmed in the wild: the flaw (nicknamed BlueKeep) is listed in CISA's KEV catalog (added 2021-11-03), CISA notes known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days. Do: Apply Microsoft's security updates for CVE-2019-0708 per vendor instructions, prioritizing legacy or end-of-support Windows systems exposed to inbound RDP. As mitigation, restrict RDP (TCP 3389) to trusted networks or VPN access, require Network Level Authentication (NLA), and audit perimeter firewalls and public scans for open RDP listeners. The vulnerability is in the CISA KEV catalog, so patching is treated as a required action for federal and high-risk environments. | 9.8 | 100% | KEV ransomware PoC ×4 |
| masson the order of millions of internet-exposed RDP endpoints and far more internal systems |
Full article454 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
September 07, 2019
Maintainers of the open-source Metasploit penetration testing framework have added a public exploit module for the BlueKeep Windows flaw.
There is a surprise for Metasploit users, maintainers of the open-source penetration testing framework have added a public exploit module for the BlueKeep Windows flaw.
The BlueKeep vulnerability, tracked as CVE-2019-0708, impacts the Windows Remote Desktop Services (RDS) and was addressed by Microsoft with May 2019 Patch Tuesday updates. BlueKeep is a wormable flaw that can be exploited by malware authors to create malicious code with WannaCry capabilities.
As explained by Microsoft, this vulnerability could be exploited by malware with wormable capabilities, it could be triggered without user interaction, making it possible for malware to spread in an uncontrolled way into the target networks.
The Metasploit BlueKeep exploit module is based on the proof-of-concept code from the security researchers zǝɹosum0x0 and Ryan Hanson. It has been developed to target only the 64-bit versions of Windows 7 and Windows 2008 R2.
“Today, Metasploit is releasing an initial public exploit module for CVE-2019-0708, also known as BlueKeep, as a pull request on Metasploit Framework. The initial PR of the exploit module targets 64-bit versions of Windows 7 and Windows 2008 R2.” explained Metasploit senior engineering manager Brent Cook. “The module builds on proof-of-concept code from Metasploit contributor @zerosum0x0, who also contributed Metasploit’s BlueKeep scanner module and the scanner and exploit modules for EternalBlue.”
Experts pointed out that the exploit does not currently support automatic targeting, this means that experts have to manually provide target details.
Unfortunately, the number of unpatched machines exposed online is very high, querying the BinaryEdge service it is possible to find more than 1,000,000 unpatched systems.
Recently, experts observed a significant increase in the number of attacks targeting RDP servers, below a graph shared by Rapid7.
The module leverages an improved general-purpose RDP protocol library, as well as enhanced RDP fingerprinting capabilities.
Experts warn of possible side effects associated with the use of this module with Metasploit payload detection tools.
“All that said, there’s one important caveat for Metasploit payload detection tools, such as those that alert on generic meterpreter payloads in network traffic: If an intrusion prevention system interrupts in-progress BlueKeep exploitation simply because it detects a payload signature against an unpatched target, breaking that network connection will likely crash the target as a side effect, since the exploit code is actually triggered by a network disconnect.” continues Cook.
Rapid7 suggests reading the previous analysis to have more info on profiles of attacker activity and detailed recommendations on defending against BlueKeep exploitation,
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – BlueKeep, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/90918/hacking/bluekeep-flaw-metasploit-module.html