Published: 16/05/2019 Updated: 24/08/2020

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 1000

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

A vulnerability in the Remote Desktop Services component of Microsoft Windows could allow an unauthenticated, remote malicious user to execute arbitrary code on a targeted system. The vulnerability exists because the affected software improperly handles Remote Desktop Protocol (RDP) requests. An attacker could exploit the vulnerability by sending RDP connection requests that submit malicious input to the affected software. A successful exploit could allow the malicious user to execute arbitrary code and completely compromise the system. Microsoft confirmed the vulnerability and released software updates.

Vulnerable Product	Search on Vulmon	Subscribe to Product
microsoft windows 7 -
microsoft windows server 2003 -
microsoft windows server 2003 r2
microsoft windows server 2008 -
microsoft windows server 2008 r2
microsoft windows vista -
microsoft windows xp -

## # This module requires Metasploit: metasploitcom/download # Current source: githubcom/rapid7/metasploit-framework ## # Exploitation and Caveats from zerosum0x0: # # 1 Register with channel MS_T120 (and others such as RDPDR/RDPSND) nominally # 2 Perform a full RDP handshake, I like to wait for RDPDR handshake too (cod ...

# Exploit Title: Bluekeep Denial of Service (metasploit module) # Shodan Dork: port:3389 # Date: 07/14/2019 # Exploit Author: RAMELLA Sebastien (githubcom/mekhalleh/) # Vendor Homepage: microsoftcom # Version: all affected RDP services by cve-2019-0708 # Tested on: Windows XP (32-bits) / Windows 7 (64-bits) # CVE : 2019-0708 # I ...

import socket, sys, struct from OpenSSL import SSL from impacketstructure import Structure # I'm not responsible for what you use this to accomplish and should only be used for education purposes # Could clean these up since I don't even use them class TPKT(Structure): commonHdr = ( ('Version','B=3'), ('Reserved','B=0'), ('Length','>H= ...

#RDP Blue POC by k8gege #Local: Win7 (python) #Target: Win2003 & Win2008 (open 3389) import socket import sys import os import platform buf="" buf+="\x03\x00\x00\x13" # TPKT, Version 3, lenght 19 buf+="\x0e\xe0\x00\x00\x00\x00\x00\x01\x00\x08\x00\x00\x00\x00\x00" # ITU-T Rec X224 buf+="\x03\x00\x01\xd6" # TPKT, Version 3, lenght 470 buf+=" ...

# EDB Note: Download ~ githubcom/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47683zip import rdp import socket import binascii import time def pool_spray(s, crypter, payload): times = 10000 count = 0 while count < times: count += 1 #print('time through %d' % count) try: ...

The RDP termddsys driver improperly handles binds to internal-only channel MS_T120, allowing a malformed Disconnect Provider Indication message to cause a use-after-free With a controllable data/size remote nonpaged pool spray, an indirect call gadget of the freed channel is used to achieve arbitrary code execution ...

Microsoft Windows Remote Desktop BlueKeep denial of service exploit ...

The RDP termdd.sys driver improperly handles binds to internal-only channel MS_T120, allowing a malformed Disconnect Provider Indication message to cause use-after-free. With a controllable data/size remote nonpaged pool spray, an indirect call gadget of the freed channel is used to achieve arbitrary code execution.

msf > use exploit/windows/rdp/cve_2019_0708_bluekeep_rce
msf exploit(cve_2019_0708_bluekeep_rce) > show targets
    ...targets...
msf exploit(cve_2019_0708_bluekeep_rce) > set TARGET < target-id >
msf exploit(cve_2019_0708_bluekeep_rce) > show options
    ...show and set options...
msf exploit(cve_2019_0708_bluekeep_rce) > exploit

This module checks a range of hosts for the CVE-2019-0708 vulnerability by binding the MS_T120 channel outside of its normal slot and sending non-DoS packets which respond differently on patched and vulnerable hosts. It can optionally trigger the DoS vulnerability.

msf > use auxiliary/scanner/rdp/cve_2019_0708_bluekeep
msf auxiliary(cve_2019_0708_bluekeep) > show actions
    ...actions...
msf auxiliary(cve_2019_0708_bluekeep) > set ACTION < action-name >
msf auxiliary(cve_2019_0708_bluekeep) > show options
    ...show and set options...
msf auxiliary(cve_2019_0708_bluekeep) > run

CVE-2019-0708 远程代码执行漏洞批量检测

CVE-2019-0708-poc CVE-2019-0708 远程代码执行漏洞批量检测 3389_hosts为待检测IP地址清单，一行一个 pool = ThreadPool(10) 为自定义扫描线程注意 Windows python3环境使用编辑3389_hosts，将待检测的IP地址写入文件，一行一个命令行切换到代码所在的目录，运行python cve-2019-0708py

Python is love, Pentest Tool Framework

Pentest Tools Framework (exploits, Scanner, Password) Details NEWS Modules PTF UPDATE! PTF OPtions ------------------------------------------------------------------------------------- | Global Option |

CVE-2019-0708 review : wwwcvedetailscom/cve-detailsphp?t=1&cve_id=cve-2019-0708 this Vulnerability is ranked 100 although it still needs some modification to the "groomsize" and the "groombase" [sometimes] it may be stuck at some processes use the "help" file above and browse to the links to guide you the modification is ba

Python is love, Pentest Tool Framework

Collection of resources related to infosec

Infosec Resources Collection of resources related to infosec All files, articles or anything here were publicly available, and collected for personal use Tools available at github were forked for archiving Please always refer to the original repo when available Tools Vulnerability Scanners Windows Rdpscan - Scanner PoC for CVE-2019-0708 RDP RCE vuln - githubcom/cgo

Porting Suricata to Bro signatures

Brocata Porting Suricata to Bro signatures Update: The script has been completely automated from end-to-end which means, it doesn't need an argument anymore It downloads the blacklists, rules from the provided urls, giving appropriate error messages if the link is buggy In this example it is converting CVE 2019-0708 rule $ python brocatapy signature cve-2019-0708 {

CVE-2019-0708 - BlueKeep (RDP)

CVE-2019-0708 - BlueKeep (RDP) RDP Connection Sequence: docsmicrosoftcom/en-us/openspecs/windows_protocols/ms-rdpbcgr/023f1e69-cfe8-4ee6-9ee0-7e759fb4e4ee Analysis of RDP Service Vulnerability: wwwzerodayinitiativecom/blog/2019/5/27/cve-2019-0708-a-comprehensive-analysis-of-a-remote-desktop-services-vulnerability Please, check the above two link to understan

CVE-2019-0708批量检测

CVE-2019-0708 批量检测 0x01 前言 CVE-2019-0708 Windows RDP 远程命令执行漏洞 Windows系列服务器于2019年5月15号，被爆出高危漏洞，该漏洞影响范围较广，windows2003、windows2008、windows2008 R2、windows xp * 系统都会遭到攻击，该服务器漏洞利用方式是通过远程桌面端口3389，RDP协议进行攻击的。CVE-2019-0708�

CVE-2019-0708-Msf-验证

CVE-2019-0708 Unauthenticated CVE-2019-0708 "BlueKeep" Scanner PoC by @JaGoTu and @zerosum0x0 Technical details: zerosum0x0blogspotcom/2019/05/avoiding-dos-how-bluekeep-scanners-workhtml Metasploit Module The Metasploit module has been pulled to rapid7:master msf5> use auxiliary/scanner/rdp/cve_2019_0708_bluekeep githubcom/rapid7/metasplo

Check vuln CVE 2019-0708

CVE-2019-0708 Unauthenticated CVE-2019-0708 "BlueKeep" Scanner PoC by @JaGoTu and @zerosum0x0 Metasploit module PR: githubcom/rapid7/metasploit-framework/pull/11869 In this repo A scanner fork of rdesktop that can detect if a host is vulnerable to CVE-2019-0708 Microsoft Windows Remote Desktop Services Remote Code Execution vulnerability It shouldn't

Pentest Tools Framework is a database of exploits, Scanners and tools for penetration testing. Pentest is a powerful framework includes a lot of tools for beginners. You can explore kernel vulnerabilities, network vulnerabilities

CVE-2019-0708 BlueKeep漏洞批量扫描工具和POC，暂时只有蓝屏。

CVE-2019-0708 CVE-2019-0708 BlueKeep漏洞批量扫描工具和POC，暂时只有蓝屏。 0x01 扫描 - windows usage： rdpscanexe ip1-ip2 > \rdpscanexe 19216811-19216812 19216811 - VULNERABLE - CVE-2019-0708 19216812 - SAFE - CredSSP/NLA required rdpscanexe --file iptxt > \rdpscanexe --file iptxt 19216811 - VULNERABLE - CVE-2019-0708 192

BlueKeep Vulnerability DOS attack exploitation

BlueKeep BlueKeep Vulnerability DOS attack exploitation BlueKeep (CVE-2019–0708) Vulnerability exists within the Remote Desktop Protocol (RDP) used by the Microsoft Windows Operating Systems including both 32- and 64-bit versions, as well as all Service Pack versions: • Windows 2000 • Windows Vista • Windows XP • Windows 7 • Windows Server 2003 &b

Scanner PoC for CVE-2019-0708 RDP RCE vuln

FATT /fingerprintAllTheThings - a pyshark based script for extracting network metadata and fingerprints from pcap files and live network traffic

66 61 74 74 2e fingerprint all the things! More info about the fingerprinting methods, sample use-cases and research results will be added to the repo soon Stay tuned! A script for extracting network metadata and fingerprints such as JA3 and HASSH from packet capture files (pcap) or live network traffic The main use-case is for monitoring honeypots, but you can also use it

Report fraud

CVE-2019-0708 The following websites are all cheaters, mainly to cheat Bitcoin, so that you can download a fake website Then tell you to transfer Bitcoin and automatically send you the decompression password After you transfer Bitcoin, he will not give you any reply You must not be deceived Some deceptive information about cheaters: Website: cve-2019-0708com Email:

POC CVE-2019-0708 with python script!

cve-2019-0708 POC CVE-2019-0708 with python script! Video POC: wwwyoutubecom/watch?v=XVmCtUMELdU

Using CVE-2019-0708 to Locally Promote Privileges in Windows 10 System

CVE-2019-0708-Exploit Using CVE-2019-0708 to Locally Promote Privileges in Windows 10 System

CVE-2019-0708 POC RCE 远程代码执行getshell教程

CVE-2019-0708-RCE 复现环境 Win7环境： ed2k://|file|cn_windows_7_ultimate_with_sp1_x64_dvd_u_677408iso|3420557312|B58548681854236C7939003B583A8078|/ 安装Win7 Ultimate（默认配置，内核数量、处理器数量都别修改）环境设置开启3389 关闭防火墙 kali MSF5环境安装更新 curl rawgithubusercontentcom/rapid7/metasploit-omnibus

Metasploit module for CVE-2019-0708 (BlueKeep) - https://github.com/rapid7/metasploit-framework/tree/5a0119b04309c8e61b44763ac08811cd3ecbbf8d/modules/exploits/windows/rdp

CVE-2019-0708 (Bluekeep) Metasploit module for CVE-2019-0708 (BlueKeep) Pulled from githubcom/rapid7/metasploit-framework/tree/5a0119b04309c8e61b44763ac08811cd3ecbbf8d/modules/exploits/windows/rdp and fixed File copy instructions Make a folder named 'rdp' in /usr/share/metasploit-framework/modules/exploits/windows/ Copy the files 'cve_2019_0708_bluekeep

rdpscan for CVE-2019-0708 bluekeep vuln This is a quick-and-dirty scanner for the CVE-2019-0708 vulnerability in Microsoft Remote Desktop Right now, there are about 900,000 machines on the public Internet vulnerable to this vulnerability, so many are to expect a worm soon like WannaCry and notPetya Therefore, scan your networks and patch (or at least, enable NLA) on vulnerabl

Proof of concept exploit for CVE-2019-0708

CVE-2019-0708 Proof of concept exploit for CVE-2019-0708 Coming soon areusecurese?CVE-2019-0708

Daily random CVE

CVE-A-Day A Python bot that posts a random CVE on Twitter with a description Dependencies Use pip to install Tweepy: pip install tweepy Create a crontab to run CVE-A-Day and update the CVE list regularly 0 * * * * /usr/bin/python tweet_cvepy && echo "$(date +%Y%m%d_%H%M%S) tweet_cvepy was executed by crontab" >> historylogtxt 0 8 *

Docker version

Bluekeep scanner (CVE-2019-0708) Esta es una implementación de docker del escaneador creado por zerosum0x0 Todo crédito hacia esta persona, solo subí el contenedor a Dockerhub para su rápido uso Ver su github original en: zerosum0x0/CVE-2019-0708 Uso docker run --rm mdiazcl/scanner-bluekeep <direccion_ip> Ejemplos:

CVE-2019-0708 PoC Shellcode only tested on x86 versions of Windows thus far Be responsible and only use this with good intentions

An Attempt to Port BlueKeep PoC from @Ekultek to actual exploits

Badges bluekeep_CVE-2019-0708_poc_to_exploit Porting BlueKeep PoC from @Ekultek & @umarfarook882 to actual exploits Script kiddies are not welcomed here as at anywhere else Please read the through theissues (both closed and open beofre posting stuff like "It doesn't work", "Nothing happened after I ran the script", or "Error (without

ispy ispy : Eternalblue(ms17-010)/Bluekeep(CVE-2019-0708) Scanner and exploiter ( Metasploit automation ) How to install : git clone githubcom/Cyb0r9/ispygit cd ispy chmod +x setupsh /setupsh Screenshots : Tested On : Parrot OS Kali linux Youtube Channel ( Cyborg ) youtubecom/c/Cyborg_TN Tutorial ( How to use ispy ) wwwyoutubecom/watch

CVE-2019-0708-BlueKeep 复现利用参考 qiitacom/shimizukawasaki/items/024b296a4c9ae7c33961?from=groupmessage 1 目标机需要开启3389服务 2 需要利用本页面exp到msf中替换原来的exp 3 windows7利用成功尝试次数多直接重启，windows2008需要修改注册表容易蓝屏，慎用！！！

PoC exploit for BlueKeep (CVE-2019-0708)

CVE-2019-0708 PoC exploit for BlueKeep (CVE-2019-0708) Usage: /PoCpy [TARGET IP] [PORT](defaults to 3389)

CVE-2019-0708批量蓝屏恶搞

CVE-2019-0708 CVE-2019-0708批量蓝屏恶搞测试环境：win7 、win2008、win2008r2 用法： python blue_keeppy -u /你的文件txt -b 64(电脑系统位数）

cve-2019-0708 crash poc

蓝屏poc

CVE-2019-0708 蓝屏poc Windows 7 64位已经测试〜命令：python crashpocpy ip 64 githubcom/n1xbyte/CVE-2019-0708/ Leaving for a wedding tomorrow, if I can't find anything then someone else take the reins Going to drop the crash PoC here Friday if there isnt one public already Maybe the following week, depending on if the vulnerable numbers drop consi

rdpscan for CVE-2019-0708 bluekeep vuln This is a quick-and-dirty scanner for the CVE-2019-0708 vulnerability in Microsoft Remote Desktop Right now, there are about 700,000 machines on the public Internet vulnerable to this vulnerability, compared to about 2,000,000 machines that have Remote Desktop exposed, but are patched/safe from exploitation Many expect that in the next

cve-2019-0708-exp Exp from Korea I think you'll like itXP is coming Win7 is coming too Will Linux be far away?

exploit CVE-2019-0708 RDS

RDS_CVE-2019-0708

bluekeep Public work for CVE-2019-0708 2019-11-17 Update Added Windows 7 32bit exploit POC code Using the address within the POC exploit code I had ~80% success rate against my test VM It could likely be modfied to increase Usage Replace the buf variable with your shellcode Update the host variable to your target python3 win7_32_pocpy Requirements Python3 Legal Disclaim

3389远程桌面代码执行漏洞CVE-2019-0708批量检测工具(Rdpscan Bluekeep Check)

微软3389远程漏洞CVE-2019-0708批量检测工具 0x001 Win下检测 githubcom/robertdavidgraham/rdpscan C:\Users\K8team\Desktop\rdpscan-master\vs10\Release 的目录 2019/06/02 02:11 <DIR> 2019/06/02 02:11 <DIR> 2019/06/02 01:55 2,582,016 libcrypto-1_1dll 2019/06/02 01:57 619,520 libs

Windows RPD Exploit

CVE-2019-0708-PoC Windows RPD Exploit Psych

CVE-2019-0708-exp

CVE-2019-0708 C#验证漏洞

CVE-2019-0708-test CVE-2019-0708 C#验证漏洞编程语言：C# 编程软件：Visual Studio 2012 编程环境：Net Framework 45 C# 写的一个验证编号CVE-2019-0708漏洞的软件调用360公司的360Vulcan Team发布的0708detectorexe

Exploit In Progress

CVE-2019-0708 Exploit In Progress It hits the Vulnerable Function

Totally legitimate

CVE-2019-0708 Totally legitimate 100% legitimate PoCs for CVE-2019-0708

A social experiment

CVE-2019-0708-Tool Sharing the exploit publicly Contact

proof of concept exploit for Microsoft Windows 7 and Server 2008 RDP vulnerability

CVE-2019-0708 Big shout out to the Dox King Krebs and also the thief of inventions and all-purpose fraud, Kevin wwwyoutubecom/watch?v=dQw4w9WgXcQ

Research Regarding CVE-2019-0708.

CVE-2019-0708 aka Bluekeep Scanner A simple scanner to determine system vulnerability to CVE-2019-0708 This is a Python port of the original metasploit module scanner by JaGoTu and zerosum0x0, available on Github here Proof of Concept Proof of concept RCE via exploitation of the Bluekeep vulnerability Related 0xeb-bp Github: bluekeep Pointed out by zerosum0x0, has code for

Python script to detect bluekeep vulnerability (CVE-2019-0708) with TLS/SSL and x509 support

detect_bluekeeppy Python script to detect bluekeep vulnerability - CVE-2019-0708 - with TLS/SSL support Work derived from the Metasploit module written by @zerosum0x0 githubcom/zerosum0x0/CVE-2019-0708 RC4 taken from githubcom/DavidBuchanan314/rc4 Prerequisites detect_bluekeeppy requires pyasn1 and cryptography python modules Install them either via pip ins

CVE-2019-0708 Exploit using Python

CVE-2019-0708 [BlueKeep] Exploit CVE-2019-0708 RCE and Crash Exploit using Python Crash Exploit [Published] Usage: python3 crashexploitpy 127001 64 RCE Exploit [Not Published] Usage: python3 exploitrcepy 127001 payload

CVE-2019-0708 (BlueKeep)

CVE-2019-0708 (BlueKeep) Currently, I public only the exploitation note for Windows 7 x64 only See NOTEmd Note: Windows 2008 R2 with default configuration (fDisableCam=1) can be exploited Reliability is same as Windows 7 Update (July 2020) Add info for Windows Server 2008 to NOTEmd Add PoCs for filling target kernel unpaged pool Add script for detecting target info Add Po

Proof of concept for CVE-2019-0708

Bluekeep PoC This repo contains research concerning CVE-2019-0708 Bluekeep or CVE-2019-0708 is an RCE exploit that effects the following versions of Windows systems: Windows 2003 Windows XP Windows Vista Windows 7 Windows Server 2008 Windows Server 2008 R2 The vulnerability occurs during pre-authorization and has the potential to run arbitrary malicious code in the NT Author

Search an exploit in the local exploitdb database by its CVE

cve_searchsploit version 16 Search an exploit in the local exploitdb database by its CVE Here you can get a free cve to exploit-db mapping in json format Install from PyPI $ pip3 install cve_searchsploit from GitHub $ git clone githubcom/andreafioraldi/cve_searchsploit $ cd cve_searchsploit $ python3 setuppy install Requirements python3 requests progressbar2 g

A quick scanner for the CVE-2019-0708 "BlueKeep" vulnerability.

rdpscan for CVE-2019-0708 bluekeep vuln This is a quick-and-dirty scanner for the CVE-2019-0708 vulnerability in Microsoft Remote Desktop Right now, there are about 900,000 machines on the public Internet vulnerable to this vulnerability, so many are expect a worm soon like WannaCry and notPetya Therefore, scan your networks and patch (or at least, enable NLA) on vulnerable s

CVE-2019-0708-POC 受影响版本 Windows 7 Windows Server 2008 R2 Windows Server 2008 Windows Server 2003 Windows XP 需开启: 远程桌面(3389端口), 关闭防火墙本POC以及Scan工具来源于网络, 侵权请联系删除 Affected system version Windows 7 Windows Server 2008 R2 Windows Server 2008 Windows Server 2003 Windows XP Need to open: Remote Desktop (Port 3389

CVE-2019-0708

BlueKeepScan Simple wrapper over PoC from @zerosum0x0 for checking CVE-2019-0708 in large network in multithreading Prepare First of all you shouldn download and install original: git clone githubcom/zerosum0x0/CVE-2019-0708git cd CVE-2019-0708/rdesktop-fork-bd6aa6acddf0ba640a49834807872f4cc0d0a773/ /bootstrap /configure --disable-credssp --disable-smartcard make

EXPloit-poc: https://pan.baidu.com/s/184gN1tJVIOYqOjaezM_VsA 提取码:e2k8

CVE-2019-0708-EXPloit-3389 远程桌面(RDP)服务远程代码执行漏洞CVE-2019-0708

A Win7 RDP exploit

CVE-2019-0708 CVE-2019-0708 - A Win7 RDP exploit Sidenote: why?

initial exploit for CVE-2019-0708, BlueKeep CVE-2019-0708 BlueKeep RDP Remote Windows Kernel Use After Free The RDP termdd.sys driver improperly handles binds to internal-only channel MS_T120, allowing a malformed Disconnect Provider Indication message to cause use-after-free. With a controllable data/size remote nonpaged pool spray, an indirect…

CVE-2019-0708 initial exploit for CVE-2019-0708, BlueKeep CVE-2019-0708 BlueKeep RDP Remote Windows Kernel Use After Free The RDP termddsys driver improperly handles binds to internal-only channel MS_T120, allowing a malformed Disconnect Provider Indication message to cause use-after-free With a controllable data/size remote nonpaged pool spray, an indirect call gadget of th

Only Hitting PoC [Tested on Windows Server 2008 r2]

CVE-2019-0708 The Crashing Part [BSOD] has been removed intentionally! A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests This vulnerability is pre-authentication and requires no user int

CVE-2019-0708 This module checks a range of hosts for the CVE-2019-0708 vulnerability by binding the MS_T120 channel outside of its normal slot and sending DoS packets I just modified the initial metasploit module for this vuln to produce a denial of service attack

CVE-2019-0708-generate-hosts 本程序使用nmap扫描3389_cidrs文件里面所列的CIDR地址（每行一个），生成3389_hosts文件，里面是可能的Windows开了3389远程桌面的机器IP地址，可以极大减少接下来的检测IP量。依赖 python3、nmap 运行将CIDR写入3389_cidrs，运行/generatepy。生成的3389_hosts可用来联系管理员或者�

这篇文章将分享Windows远程桌面服务漏洞（CVE-2019-0708），并详细讲解该漏洞及防御措施。作者作为网络安全的小白，分享一些自学基础教程给大家，主要是关于安全工具和实践操作的在线笔记，希望您们喜欢。同时，更希望您能与我一起操作和进步，后续将深入学习网络安全和系统安全知识并分享相关实验。总之，希望该系列文章对博友有所帮助，写文不易，大神们不喜勿喷，谢谢！

CVE-2019-0708-Windows 这篇文章将分享Windows远程桌面服务漏洞（CVE-2019-0708），并详细讲解该漏洞及防御措施。作者作为网络安全的小白，分享一些自学基础教程给大家，主要是关于安全工具和实践操作的在线笔记，希望您们喜欢。同时，更希望您能与我一起操作和进步，后续将深入学习网络�

改写某大佬写的0708蓝屏脚本改为网段批量蓝屏

CVE-2019-0708-Batch-Blue-Screen 改写某大佬写的0708蓝屏脚本改为网段批量蓝屏使用方法： python3 pocpy 19216820 64 对 19216820 网段内的的所有主机 1-255 批量攻击蓝屏根据自己所在网段相应的修改即可

Python nmap scripts

Python nmap Scripts are example of use of python nmap and possibility to integrate it with other python module like Metasploit or ServiceNow Alone it can provide clear report, without needed to parser or formatting it after scan finished Script also improve speed and reliability by scan phases and some other additional functions List of scripts: cisco_SIE_Scanpy - Discover

cve-2019-0708-scan iptxt保存网段： 19216810 12716820

ispy ispy : Eternalblue(ms17-010)/Bluekeep(CVE-2019-0708) Scanner and exploiter ( Metasploit automation ) How to install : git clone githubcom/The-Mario/MarioBgit cd ispy chmod +x setupsh /setupsh Screenshots : Disclaimer : usage of ispy for attacking targets without prior mutual consent is illegal ispy is for security testing purposes only

If you have any good suggestions or comments during the search process, please feedback some index experience in issues. Thank you for your participation.查阅过程中，如果有什么好的意见或建议，请在Issues反馈，感谢您的参与。

项目简介根据中华人民共和国《网络安全法》相关政策规定，本文章只做学习研究，不被允许通过本文章内容进行非法行为，使用技术的风险由使用者自行承担。(The author does not assume any legal responsibility) 整个 Red Team 攻击的生命周期包括但不限于：信息收集、攻击尝试获

A quick scanner for the CVE-2019-0708 "BlueKeep" vulnerability.

Wh1teZe 的个人博客 - 记录精彩的程序人生

Wh1teZe 的个人博客记录精彩的程序人生最新 BuuCTF刷题之旅之WarmUp 基于SQLMap的tamper模块bypass姿态学习 CVE-2019-0708远程桌面代码执行漏洞复现 Web页面解析及HTTP协议简单总结 SQL注入相关语句归类总结数据库系统表相关学习关系型数据库VS非关系型数据库 Mysql基本操作 LEMP环境搭建及安全

基于360公开的无损检测工具的可直接在windows上运行的批量检测程序

title:CVE-2019-0708批量检测这个批量检测是基于360公开的无损检测工具（0708detectorexe），有以下功能：单个检测批量检测双击0708detector-全自动批量版exe即可使用！批量检测支持自定义要检测的ip列表，自定义存在漏洞的ip集的储存位置。批量检测有个缺点就是线程是1，在目标ip数目特

SwitHak' Security Place for my Opinions and Work

SwitHak Who am i ? Hello, I am a french #security professionnal interested in #cybersecurity issues and other content related to the previous theme! Spoken languages: EN, FR My motto No system is truly secure, if the attacker has time and ressources, he can compromises your information system! Social You can find me on Twitter: @SwitHak My Work 5G, new telecommunication

基于360公开的无损检测工具的可直接在windows上运行的批量检测程序

CVE-2019-0708

MS_T120 CVE-2019-0708 make the poc step by step, day by day docsmicrosoftcom/en-us/openspecs/windows_protocols/ms-rdpbcgr/5073f4ed-1e93-45e1-b039-6e30c385867c

PoC about CVE-2019-0708 (RDP; Windows 7, Windows Server 2003, Windows Server 2008)

CVE-2019-0708 Introduction Microsoft has released its monthly security update for May Included in this month's Patch Tuesday release is CVE-2019-0708, a critical remote code execution vulnerability that could allow an unauthenticated remote attacker to execute remote code on a vulnerable target running Remote Desktop Protocol (RDP) Technical analysis The vulnerability ex

CVE-2019-0708 先创建一个等大佬来我在更新

Testing my new bot out

cve-2019-0708-2 this is just a drill! do not worry

CVE-2019-0708 RDP Remote Code Execute Exploit

CVE-2019-0708 Our website:buyexploitcom CVE-2019-0708 RDP Remote Code Execute Exploit Support:WINXP/WIN7/WIN2K3/WIN2K8/WIN2K8R2 Mail To :buyexploit@protonmailcom website:buyexploitcom Buy the Exploit please visit website:wwwbuyexploitcom video:youtube/vxgB5qZ_OEs

RDP honeypot

rdppot RDP based Honeypot What does this actually do Listens on 3389, on a new connection it'll create a session & assign a virtual machine from a pool to that session After 300 seconds (default) of the session being opened or 30 second (default) of no activity the connection will be closed and the session will be terminated We'll store a copy of the disk &a

CVE-2019-0708

CVE-2019-0708 CVE-2019-0708 Sorry Everyone This is our team's testing program, not click bait If you think we have others purpose, reconsider yourself If you want to busfame, I don't care Thanks @testanull, sorry for my English I don't understand what people want in this repo?

CVE-2019-0708

CVE-2019-0708 CVE-2019-0708

CVE-2019-0708-EXP-Windows版单文件exe版,运行后直接在当前控制台反弹System权限Shell

CVE-2019-0708-EXP-Windows-Version 申明作者poc仅供研究目的,如果读者利用本poc从事其他行为,与本人无关目录 [toc] 介绍 CVE-2019-0708-EXP-Windows版单文件exe运行,无需linux,python,ruby等,运行后直接在当前控制台反弹System权限Shell 编译采用全静态库模式内联所有dll,集成netcat和openssl,支持进度条显示,shell回�

CVE-2019-0708 exp

CVE-2019-0708 Have fun

CVE-2019-0708 bluekeep 漏洞检测

Metasploit module for massive Denial of Service using #Bluekeep vector.

vulnerabilidad CVE-2019-0708 testing y explotacion

bLuEkEeP-GUI vulnerabilidad CVE-2019-0708 testing y explotacion No me hago responsable del mal uso del software todo es con fines educativos bleukee-GUI sirve tanto para testear máquinas con la vulneravilidad CVE-2019-0708 como se puede de igual manera hakear por eso dejo montado el codigo totalmente funcional pero sin instalador asi como con la demo de la vulnerabili

CVE-2019-0708漏洞MSF批量巡检插件

Announces fraud

This man is a liar Be careful You won't be paid any password when you receive the money Information of a liar The original deceptive information: Website: cve-2019-0708com Email: cve20190708@gmailcom Skype: live: cve20190708 Now deceptive information: Website: rdpcvenet ICQ chat: rdpcve Email: rdpcve@gmailcom

Exploit CVE-2019-0708 BlueKeep vulnerability for windows 7

CVEs <--> Metasploit-Framework modules

go-msfdb This is a tool for searching CVEs in Metasploit-Framework modules from msfdb-list Metasploit modules are inserted at sqlite database(go-msfdb) can be searched by command line interface In server mode, a simple Web API can be used Docker Deployment There's a Docker image available docker pull vuls/go-msfdb When using the container, it takes the same arguments

An awesome list of resources on deception-based security with honeypots and honeytokens

Awesome Deception An awesome list of resources on deception-based security with honeypots and honeytokens Contents Articles Communities Guides Related Lists Research Podcasts Presentations Videos Articles Ensnare Attack Detection Tool Hopes to Frustrate Hackers, Too Honeypots: Good servers in dark alleys can be an enterprise asset Extending a Thinkst Canary to become an int

Public work for CVE-2019-0708

CVE-2019-0708漏洞MSF批量巡检插件

Scanner CVE-2019-0708

Scanner-CVE-2019-0708 This Scanner BlueKeep CVE-2019-0708 Install and Running #git clone githubcom/JSec1337/Scanner-CVE-2019-0708 cd Scanner-CVE-2019-0708 pip3 install pyasn1 pyasn1_modules cryptography==27 chmod +x scan_bluekeeppy /scan_bluekeeppy 19216817 Or /scan_bluekeeppy 19216811/24 Code Status SAFE - Not Vulnerable VULNERABLE - Vunerable to CVE

CVE-2019-0708

Microsoft Patch Tuesday – May 2019

Symantec Threat Intelligence Blog • Ratheesh PM • 15 May 2021

This month the vendor has patched 79 vulnerabilities, 22 of which are rated Critical.

Posted: 15 May, 201924 Min ReadThreat Intelligence SubscribeFollowtwitterfacebooklinkedinMicrosoft Patch Tuesday – May 2019This month the vendor has patched 79 vulnerabilities, 22 of which are rated Critical.As always, customers are advised to follow these security best practices:

Install vendor patches as soon as they are available.
Run all software with the least privileges required while still maintai...

Threatpost • Lindsey O'Donnell • 03 Nov 2020

A previously known threat group, called UNC1945, has been compromising telecommunications companies and targeting financial and professional consulting industries, by exploiting a security flaw in Oracle’s Solaris operating system.
Researchers said that the group was exploiting the bug when it was a zero-day, long before a patch arrived.
The bug, CVE-2020-14871, was recently addressed in Oracle’s October 2020 Critical Patch Update. The vulnerability exists in the Oracle Solaris ...

Fireeye Threat Research • by Justin Moore, Wojciech Ledzion, Luis Rocha, Adrian Pisarczyk, Daniel Caban, Sara Rincon, Daniel Susin, Antonio Monaca • 02 Nov 2020

Through Mandiant investigation of intrusions, the FLARE Advanced Practices team observed a group we track as UNC1945 compromise managed service providers and operate against a tailored set of targets within the financial and professional consulting industries by leveraging access to third-party networks (see this blog post for an in-depth description of “UNC” groups).
UNC1945 targeted Oracle Solaris operating systems, utilized several tools and utilities against Windows and Linux opera...

Threatpost • Tara Seals • 21 Oct 2020

Chinese state-sponsored cyberattackers are actively compromising U.S. targets using a raft of known security vulnerabilities – with a Pulse VPN flaw claiming the dubious title of “most-favored bug” for these groups.
That’s according to the National Security Agency (NSA), which released a “top 25” list of the exploits that are used the most by China-linked advanced persistent threats (APT), which include the likes of Cactus Pete, TA413, Vicious Panda and Winniti.
The Feds...

Threatpost • Lindsey O'Donnell • 13 Oct 2020

Researchers are warning of a recent dramatic uptick in the activity of the Lemon Duck cryptocurrency-mining botnet, which targets victims’ computer resources to mine the Monero virtual currency.
Researchers warn that Lemon Duck is “one of the more complex” mining botnets, with several interesting tricks up its sleeve. While the botnet has been active since at least the end of December 2018, researchers observed an increase in DNS requests connected with its command-and-control (C2) a...

Threatpost • Lindsey O'Donnell • 18 Jun 2020

The InvisiMole threat group has resurfaced in a new campaign, revealing a new toolset and a strategic collaboration with the high-profile Gamaredon advanced persistent threat (APT) group.
InvisiMole was first uncovered by ESET in 2018, with cyberespionage activity dating back to 2013 in operations in Ukraine and Russia. More recently, from late 2019 until at least this month, researchers have spotted the group attacking a few high-profile organizations in the military sector and diplomatic...

BleepingComputer • Ionut Ilascu • 18 Jun 2020

Security researchers have demystified the attack chain of the elusive InvisiMole cyberespionage group, revealing a complicated multi-stage format that relies on vulnerable legitimate tools, target-specific encryption of payloads, and stealthy communication.
InvisiMole gets access to the target network through
, a threat actor linked to Russia that runs reconnaissance operations and identifies valuable systems.
Both attack groups have been operational for at least seven years ...

Threatpost • Lindsey O'Donnell • 19 Feb 2020

While Microsoft issued patches for the infamous BlueKeep vulnerability almost a year ago, researchers warn that almost half of connected medical devices in hospitals run on outdated Windows versions that are still vulnerable to the remote desktop protocol (RDP) flaw.
Researchers said they found that 22 percent of a typical hospital’s Windows devices were vulnerable to BlueKeep. Even worse, the number of connected medical devices running Windows that are vulnerable to BlueKeep is consider...

BleepingComputer • Ionut Ilascu • 18 Dec 2019

A new scanning tool is now available for checking if your computer is vulnerable to the BlueKeep security issue in Windows Remote Desktop Services.
Despite Microsoft rolling out a patch in mid-May, there are tens of thousands of devices exposing a Remote Desktop Protocol (RDP) service to the public internet.
(CVE-2019-0708) is a vulnerability that leads to remote code execution and could be leveraged to spread malware across connected systems without any interaction from the user.<...

welivesecurity • Aryeh Goretsky • 17 Dec 2019

While the BlueKeep (CVE-2019-0708) vulnerability has not, to date, caused widespread havoc, and we will be looking at the reasons why in this post, it is still very early in its exploitation life cycle. The fact remains that many systems are still not patched, and a thoroughly wormable version of the exploit might still be found. Because of these factors, ESET has created a free utility to check if a system is vulnerable.
Sometimes, you have to say something about things that “go without...

Securelist • Victor Chebyshev Fedor Sinitsyn Denis Parinov Boris Larin Oleg Kupreev Evgeny Lopatin • 29 Nov 2019

These statistics are based on detection verdicts of Kaspersky products received from users who consented to provide statistical data.
According to Kaspersky Security Network:
In Q3 2019, we discovered an extremely unpleasant incident with the popular CamScanner app on Google Play. The new version of the app contained an ad library inside with the Trojan dropper Necro built in. Judging by the reviews on Google Play, the dropper’s task was to activate paid subscriptions, although it ...

BleepingComputer • Sergiu Gatlan • 13 Nov 2019

Windows 10, version 1803, also known as the April 2018 Update, has now reached end of service for Home, Pro, Pro Education, and Pro for Workstations editions, and will no longer receive any future quality and security updates.
As Microsoft said in October when it
before end of support, customers who want to continue receiving quality updates should update to the latest version of Windows.
Redmond also
that an automatic feature update to May 2019 Update will be ini...

The Register • Shaun Nichols in San Francisco • 11 Nov 2019

Admins snoozing on patching despite reports of active attacks

The flurry of reports in recent weeks of in-the-wild exploits for the Windows RDP 'BlueKeep' security flaw had little impact among those responsible for patching, it seems.
This according to researchers with the SANS Institute, who have been tracking the rate of patching for the high-profile vulnerability over the last several months and, via Shodan, monitoring the number of internet-facing machines that have the remote desktop flaw exposed.
First disclosed in May of this year, BlueK...

welivesecurity • Amer Owaida • 11 Nov 2019

Ever since it was discovered six months ago, the BlueKeep vulnerability has had (not only) the cybersecurity community concerned about impending WannaCryptor-style attacks. Earlier in November, Microsoft together with security researchers Kevin Beaumont and Marcus Hutchins shed light on the first malicious campaign that was aimed at exploiting the critical remote code execution (RCE) flaw. The attacks targeted unpatched vulnerable Windows systems to install cryptocurrency mining software, but we...

BleepingComputer • Sergiu Gatlan • 07 Nov 2019

The Microsoft Defender ATP Research Team says that the
are connected with a coin mining campaign from September that used the same command-and-control (C2) infrastructure.
BlueKeep is an unauthenticated remote code execution vulnerability affecting Remote Desktop Services on Windows 7, Windows Server 2008, and Windows Server 2008 R2, and
.
The Microsoft Defender ATP Research Team that unearthed this new info urges users to immediately patch Windows systems vulnerabl...

BleepingComputer • Ionut Ilascu • 02 Nov 2019

The BlueKeep remote code execution vulnerability in the Windows Remote Desktop Services is currently exploited in the wild. Vulnerable machines exposed to the web are apparently compromised for cryptocurrency mining purposes.
The attempts have been recorded by honeypots that expose only port 3389, specific for remote assistance connections via the Remote Desktop Protocol (RDP).
Security researcher Kevin Beaumont noticed on Saturday that multiple honeypots in his EternalPot RDP honeyp...

BleepingComputer • Ionut Ilascu • 02 Nov 2019

BleepingComputer • Lawrence Abrams • 11 Oct 2019

Windows 10 version 1703, otherwise known as the Creators Update, has now reached end of service and will no longer receive any future security or quality updates.
When a Windows version becomes out of service, Microsoft will no longer fix any bugs found in that version or release security updates that fix new vulnerabilities that are discovered.
As of October 8th, 2019, users running consumer, enterprise, and education versions of Windows 10 1703 are required to upgrade to Windows...

Threatpost • Tara Seals • 10 Sep 2019

Two elevation-of-privilege vulnerabilities that have been exploited in the wild as zero-days are at the heart of September’s Patch Tuesday update from Microsoft.
The two EoP vulnerabilities under active attack consist of CVE-2019-1214, which exists in the Windows Common Log File System (CLFS) Driver; and CVE-2019-1215, which impacts the Winsock IFS Driver (ws2ifsl.sys).
“Both flaws exist due to improper handling of objects in memory by the respective drivers,” said Satnam Naran...

Threatpost • Tom Spring • 03 Sep 2019

Patch management is a thankless job. Data shows, despite best efforts, that 80 percent of enterprise applications have at least one unpatched vulnerability in them, according research by Veracode.
It is not for lack of trying that vulnerabilities persist. Last year 16,500 vulnerabilities were reported, making patching each one nearly an impossible task for any one company. Perhaps it shouldn’t be a surprise that Windows patching times appear to be moving in the wrong direction. According...

Securelist • Victor Chebyshev Fedor Sinitsyn Denis Parinov Boris Larin Oleg Kupreev Evgeny Lopatin • 19 Aug 2019

These statistics are based on detection verdicts of Kaspersky products received from users who consented to provide statistical data.
According to Kaspersky Security Network,
Q2 2019 will be remembered for several events.
First, we uncovered a large-scale financial threat by the name of Riltok, which targeted clients of not only major Russian banks, but some foreign ones too.
Second, we detected the new Trojan.AndroidOS.MobOk malware, tasked with stealing money from mobil...

APT trends report Q2 2019

Securelist • GReAT • 01 Aug 2019

For two years, the Global Research and Analysis Team (GReAT) at Kaspersky has been publishing quarterly summaries of advanced persistent threat (APT) activity. The summaries are based on our threat intelligence research and provide a representative snapshot of what we have published and discussed in greater detail in our private APT reports. They aim to highlight the significant events and findings that we feel people should be aware of.
This is our latest installment, focusing on activiti...

Threatpost • Tara Seals • 29 Jul 2019

The nightmare vision of a “mega-worm” global BlueKeep infection could be closer to becoming reality as working exploits are now becoming available to the public, and there’s evidence that adversaries are actively scanning for the vulnerability.
Researchers weighed in with Threatpost about how enterprises can thwart the critical Windows remote code-execution (RCE) vulnerability, even if immediate patching is too large an ask.
By way of background, the BlueKeep vulnerability (CVE...

The Register • Shaun Nichols in San Francisco • 24 Jul 2019

Someone just revealed the tricky kernel heap spray part

Vital clues on how to exploit the notorious Windows RDP bug, aka CVE-2019-0708 aka BlueKeep, and hijack vulnerable boxes, emerged online this week.
The growing number of hints can be used by folks to develop working code that attacks Microsoft's Remote Desktop Services software, on Windows XP through to Server 2008, and gains kernel-level code execution without any authentication or user interaction. You just need to be able to reach a vulnerable RDP server across the network or internet.<...

welivesecurity • Tomáš Foltýn • 17 Jul 2019

As of early July, more than 805,000 internet-facing systems remained susceptible to the BlueKeep security vulnerability, the news of which spooked the internet two months ago and prompted a flurry of alerts urging users and organizations to patch the critical flaw post-haste.
The tally, released today by cybersecurity ratings company BitSight, also shows that the number of vulnerable public-facing machines fell by 17 percent between May 31st and July 2nd, after the firm’s previous estima...

Threatpost • Tara Seals • 17 Jul 2019

For the past two months, security researchers have been sounding the alarm about BlueKeep, a critical remote code-execution vulnerability in Microsoft Windows that researchers said could lead to a “mega-worm” global infection. As of July 2, approximately 805,665 systems remain online that are vulnerable to BlueKeep, according to a status update.
The number of susceptible systems represents a decrease of 17.18 percent (167,164 systems) compared to May 31, including 92,082 systems which ...

BleepingComputer • Ionut Ilascu • 21 Jun 2019

The multiple warnings about patching Windows systems against the BlueKeep vulnerability (CVE-2019-0708) have not gone unheeded. Administrators of enterprise networks listened and updated most of the machines affected by the issue.
BlueKeep exists in the Remote Desktop Protocol (RDP) on older Windows releases that are still supported (Windows 7, Windows Server 2008 R2, and Windows Server 2008) as well as on OS versions that reached end-of-life status (Windows XP, Windows Server 2003).
...

Threatpost • Lindsey O'Donnell • 18 Jun 2019

The Department of Homeland Security has confirmed it has developed a working exploit for the “wormable” BlueKeep vulnerability. The agency issued an alert on Monday urging Windows users to update their machines as soon as possible.
The alert heightens concerns that malicious actors could soon also develop their own exploits of the BlueKeep flaw. The critical remote code execution vulnerability (CVE-2019-0708), though fixed during Microsoft’s May Patch Tuesday Security Bulletin, cont...

Threatpost • Tara Seals • 07 Jun 2019

While everyone’s talking about the BlueKeep Mega-Worm, this is not the main monster to fear, according to recent web attack activity. Rather, a researcher is warning that the GoldBrute botnet poses the greatest threat to Windows systems right now.
In the past few days, GoldBrute (named after the Java class it uses) has attempted to brute-force Remote Desktop Protocol (RDP) connections for 1.5 million Windows systems and counting, according to Morphus Labs chief research officer Renato Ma...

welivesecurity • Tomáš Foltýn • 06 Jun 2019

The United States’ National Security Agency (NSA) has issued a rare alert urging Windows users and administrators to waste no time in patching the critical ‘BlueKeep’ security flaw in older Windows systems.
“This is the type of vulnerability that malicious cyber actors frequently exploit through the use of software code that specifically targets the vulnerability,” reads the NSA’s advisory.
It also specifically highlights BlueKeep’s ‘wormable’ nature and draws paral...

Threatpost • Tara Seals • 05 Jun 2019

A researcher has created a proof-of-concept Metasploit module for the critical BlueKeep vulnerability, which successfully demonstrates how to achieve complete takeover of a target Windows machine.
Reverse engineer Zǝɹosum0x0 tweeted about his success on Tuesday, noting that he plans to keep the module private given the danger that a working exploit could pose to the vast swathe of unpatched systems out there. He also released a video showing a remote code-execution (RCE) exploit working ...

BleepingComputer • Ionut Ilascu • 05 Jun 2019

A researcher has created a module for the Metasploit penetration testing framework that exploits the critical BlueKeep vulnerability on vulnerable Windows XP, 7, and Server 2008 machines to achieve remote code execution.
BlueKeep is a critical flaw in Remote Desktop Services that affects Windows 7 and Server 2008, as well as the unsupported Windows XP and Server 2003.
It is tracked as CVE-2019-0708 and
for it on May 14. A
, too, for systems that cannot take a break to...

BleepingComputer • Ionut Ilascu • 04 Jun 2019

A new zero-day vulnerability has been disclosed that could allow attackers to hijack existing Remote Desktop Services sessions in order to gain access to a computer.
The flaw can be exploited to bypass the lock screen of a Windows machine, even when two-factor authentication (2FA) mechanisms such as Duo Security MFA are used. Other login banners an organization may set up are also bypassed.
The issue is now tracked as CVE-2019-9510 and is described as an authentication bypass using a...

The Register • Shaun Nichols in San Francisco • 28 May 2019

If you haven't patched CVE-2019-0708 aka BlueKeep, then, well, now would be a good time

The critical Windows Remote Desktop flaw that emerged this month may have set the stage for the worst malware attack in years.
The vulnerability, designated CVE-2019-0708 and dubbed BlueKeep, can be exploited by miscreants to execute malicious code and install malware on vulnerable machines without the need for any user authentication: a hacker simply has to be able to reach the box across the internet or network in order to commandeer it.
It is said to be a "wormable" security hole ...

Threatpost • Lindsey O'Donnell • 28 May 2019

One million devices are still vulnerable to BlueKeep, a critical Microsoft bug with “wormable” capabilities, almost two weeks after a patch was released.
The flaw (CVE-2019-0708) was fixed during Microsoft’s May Patch Tuesday Security Bulletin earlier this month. System administrators were urged to immediately deploy fixes as the flaw could pave the way for a similar rapidly-propogating attack on the scale of WannaCry.
Despite that, researchers on Tuesday warned that one milli...

BleepingComputer • Sergiu Gatlan • 24 May 2019

The 0patch platform issued a fix for the Remote Desktop Services RCE vulnerability known as BlueKeep, in the form of a 22 instructions micropatch which can be used to protect always-on servers against exploitation attempts.
The critical software flaw tracked as
and present in both in-support (Windows Server 2008 and Window 7) and out-of-support (Windows 2003 and Window XP) was already patched by Microsoft on May 14, after the vulnerability was disclosed.
However, unlike Mi...

welivesecurity • Ondrej Kubovič • 22 May 2019

Remember the panic that hit organizations around the world on May 12th, 2017 when machine after machine displayed the WannaCryptor ransom screen? Well, we might have a similar incident on our hands in the coming days, weeks or months if companies don’t update or otherwise protect their older Windows systems right away. The reason is BlueKeep, a ‘wormable’ critical Remote Code Execution (RCE) vulnerability in Remote Desktop Services that could soon become the new go-to vector for spreading ...

BleepingComputer • Sergiu Gatlan • 22 May 2019

A proof-of-concept remote code execution (RCE) exploit for the wormable BlueKeep vulnerability tracked as CVE-2019-0708 has been demoed by security researchers from McAfee Labs.
on May 14 to patch the critical vulnerability on both out-of-support and in-support Windows version,
the bug as capable to allow malware to self-propagate between vulnerable Windows machines, just "as the WannaCry malware spread across the globe in 2017."
The McAfee Labs research team publishe...

The Register • Gareth Corfield • 20 May 2019

Yes, the one with the critical security fixes

Brit security software slinger Sophos has advised its customers to uninstall Microsoft's most recent Patch Tuesday run – the same patches that protect servers against the latest Intel cockups.
In an advisory note published over the weekend, Sophos admitted the latest batch of Windows updates are causing the machines of some people using its AV wares to hang on boot, getting stuck while displaying the line "Configuring 30%".
"We have currently only identified the issue on some custo...

BleepingComputer • Ionut Ilascu • 20 May 2019

Using information from their research and from public scripts, security professionals at NCC Group have created a network detection rule for CVE-2019-0708. After testing with Suricata IDS/IPS, NCC Group made it
.
Security researchers have created exploits for the remote code execution vulnerability in Microsoft's Remote Desktop Services, tracked as CVE-2019-0708 and dubbed BlueKeep, and hackers may not be far behind.
While the vulnerability inspired some playful users to cr...

The Register • Iain Thomson in San Francisco • 15 May 2019

Plus plenty of other fixes from Redmond and Adobe – and special guest star Citrix

Patch Tuesday It’s that time of the month again, and Microsoft has released a bumper bundle of security fixes for Patch Tuesday, including one for out-of-support operating systems Windows XP and Server 2003.
Usually support for such aging operating systems costs an arm and a leg, though Redmond has released a freebie because of the serious nature of the critical flaw, assigned CVE-2019-0708, in Remote Desktop Services, or Terminal Services as it was. The vulnerability allows remote code ...

Threatpost • Tom Spring • 14 May 2019

Microsoft has released a patch for an elevation-of-privileges vulnerability rated important, which is being exploited in the wild.
The bug fix is part of Microsoft’s May Patch Tuesday Security Bulletin. It’s tied to the Windows Error Reporting feature and is being abused by attackers who have gained local access to affected PCs. They are able to trigger arbitrary code-execution in kernel mode — resulting in a complete system compromise.
“They would need to first gain access t...

BleepingComputer • Sergiu Gatlan • 14 May 2019

Microsoft patched today a critical
found in the Remote Desktop Services (RDS) platform which can allow malicious actors to create malware designed to propagate between computers running vulnerable RDS installations.
According to Microsoft's Windows IT Pro Center, "Remote Desktop Services (RDS) is the platform of choice for building virtualization solutions for every end customer need, including delivering individual virtualized applications, providing secure mobile and remote d...

CVE-2019-0708

Vulnerability Summary

Vulnerability Trend

Exploits

Mailing Lists

Metasploit Modules

Github Repositories

Recent Articles

References