Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
RDGScanner — A proof-of-concept scanner to check an RDG Gateway Server for vulnerabilities CVE-2020-0609 & CVE-2020-0610. | Kitploit
Tools/GitHubGitHub/malwaretech/rdgscanner
Vulnerability ScannersExploitationWeb SecurityNetwork SecurityPenetration Testing
GitHubmalwaretech/rdgscanner

RDGScanner

A proof-of-concept scanner to check an RDG Gateway Server for vulnerabilities CVE-2020-0609 & CVE-2020-0610.

View Repository
68306 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Scanner for CVE-2020-0609 & CVE-2020-0610

A proof-of-concept scanner to check an RDP Gateway Server for vulnerabilities CVE-2020-0609 & CVE-2020-0610.

Tested on:

  • Windows Server 2012 x64
  • Windows Server 2016 x64
  • Windows Server 2019 x64

Disclaimer

Scanning for memory corruption vulnerabilities is dangerous and can potentially crash systems. Whilst this tool has been designed to avoid causing a crash, stability can't be 100% guaranteed. Use at your own risk and only scan systems you have permission to test.

Usage

python3 RDGScanner.py <ip> <port>

How it works

To understand the vulnerabilities, you can read my writeup here: https://www.kryptoslogic.com/blog/2020/01/rdp-to-rce-when-fragmentation-goes-wrong/

The CONNECT_PKT_FRAGMENT message allows a connect message to be fragmented across multiple packets. Each packet has a field specifying the position of the packet in the sequence (fragment_id) and the total number of packets in the sequence (num_fragments).

CVE-2020-0610 is an OOB write vulnerability which occurs when fragment_id is greater than 64. To mitigate the vulnerability, checks have been added to fail if either fragment_id or num_packets is greater than 64.

By setting num_fragments (but not fragment_id) to a value greater than 64, we fail the security check without risking exploiting the bug. On a patched system we will be disconnected with an error code of 0x8000ffff, whereas on an unpatched system nothing will happen.

Download Tool