haishanzheng/cve-2019-0708-generate-hosts
This program uses nmap to scan the CIDR addresses listed in the 3389_cidrs file (one per line) and generates a 3389_hosts file containing IP addresses of machines that are likely Windows machines with RDP (3389) enabled. This can significantly reduce the number of IPs that need to be checked in subsequent scans.
python3, nmap
Write CIDR ranges into 3389_cidrs, then run ./generate.py. The generated 3389_hosts can be used to contact administrators or to continue scanning operations.
deep_generate.py is for cases where some users have changed the default 3389 port to a different port. It uses nmap fingerprint scanning to detect ms-wbt-server and then writes the results into 3389_hosts. Since each machine requires scanning ports 1-65535, this process is very slow.
On 20190522, 360 released the CVE-2019-0708: Windows RDP Remote Vulnerability Non-Destructive Detection Tool, which is now at version 2. It can only scan a single IP.
https://github.com/biggerwing/CVE-2019-0708-poc provides a batch detection tool that reads a list of IPs from a text file. Why they used Python instead of PowerShell or BAT is beyond me.
Sun Fulong from Dalian Neusoft improved it to accept CIDR address ranges directly.
Since there are many CIDR ranges, I wrote a small piece of code that uses nmap to scan for machines with open port 3389 within those CIDR ranges, then lists those IPs for detection. This reduces the number of IPs that need to be scanned.
It is recommended to download the detection tool from the official 360 source when doing batch checks, and replace the filename used in the GitHub repositories above.
Detection results are for reference only.
For vulnerabilities like CVE-2019-0708, you can stay safe in normal operations by just doing the following two things:
