BlueGate

PoC for the Remote Desktop Gateway vulnerability - CVE-2020-0609 & CVE-2020-0610. Thanks to ollypwn for pointing out my silly mistake!

Setup

I'm using a patched version of pydtls as the original repository wouldn't build properly.

cd pydtls
sudo python setup.py install

Denial of Service

A PoC for the DoS attack can be found in dos.py. This essentially crashes the Remote Desktop Gateway service. The initial PoC can be found in the commits or here.

Usage

python dos.py 192.168.8.133 3391

Result

Before:

After:

Scanner

A scanner that is able to determin whether the target is vulnerable or not. The script can be found in check.py. The timeout is set to 3 seconds by default but can be adjusted in the source code.

Usage

python check.py 192.168.8.134 3391

Result

It says either Vulnerable! or Not vulnerable!.