CVE-2019-0708 Mass Detection

0x01 Preface

CVE-2019-0708 Windows RDP Remote Code Execution Vulnerability

On May 15, 2019, a high-risk vulnerability was disclosed for Windows series servers. This vulnerability affects a wide range of systems, including Windows 2003, Windows 2008, Windows 2008 R2, Windows XP*, all of which are susceptible to attack. The exploitation method for this server vulnerability involves the remote desktop port 3389 and the RDP protocol. The CVE-2019-0708 vulnerability bypasses user authentication checks, allowing an attacker to connect directly via the RDP protocol without any interaction, sending malicious code and executing commands on the server. This is the most severe vulnerability of the year in terms of damage potential. In other words, this vulnerability is "wormable," meaning any malware exploiting it could propagate from an affected computer to other affected computers, similar to how the WannaCry malware spread globally in 2017. It is comparable to previous ransomware and EternalBlue viruses.

0x02 Mass Detection

Since there are many servers running Windows systems, mass detection is needed. Although blocking TCP port 3389 at the border firewall can protect servers from external attacks, for internal lateral attacks, measures such as applying patches and other methods are still necessary to ensure server security.

1> 360 RDP Vulnerability Non-Destructive Scanner

0708detector.exe is a detection tool for the Windows Remote Desktop Protocol vulnerability CVE-2019-0708, released by 360Vulcan Team of 360 Company. In principle, this scanner will not cause a blue screen on the target system. Please test before use.

Program checksum MD5 (to prevent bundled backdoors/Trojans): febc027cee2782dba25b628ce3a893d6 *0708detector.exe

For usage and result interpretation, please refer to readme.txt.

2> Batch script based on the 360 non-destructive scanner

Environment

python3.6
win10

Usage

> python cve-2019-0708_v1.py -h
usage: cve-2019-0708_v1.py [-h] [-p PORT] [-t TARGET | -f FILE]

Example: python cve-2019-0708_v1.py -t 192.168.1.0/24 -p 3389

optional arguments:
  -h, --help            show this help message and exit
  -p PORT, --port PORT  Default port 3389
  -t TARGET, --target TARGET
                        Can be a single IP address or CIDR format, e.g. 192.168.1.0/24. Note: In CIDR format,
                        the first part must be the network address of the IP range.
  -f FILE, --file FILE  Input IP address file

The process first checks if port 3389 is open via telnet, then uses multi-threading to call the 360 non-destructive scanner for scanning.

Error Handling

Solution for error 'ValueError: IP('1.1.1.1/24') has invalid prefix length (24)'

This is caused by the CIDR format of the IP address. According to the IPy library specification, the first part must be the network address of the IP range. Correct examples are as follows:

1.1.1.0/24 : 1.1.1.0~1.1.1.255

1.1.1.128/25 : 1.1.1.128~1.1.1.255

1.1.1.64/26 : 1.1.1.64~1.1.1.127

1.1.1.32/27 : 1.1.1.32~1.1.1.63

1.1.1.16/28 : 1.1.1.16~1.1.1.31

3> msf auxiliary/scanner/rdp/cve_2019_0708_bluekeep Module

0x03 Fix Recommendations

1. Download and install the corresponding security patch from Microsoft's official website.
2. If not needed, disable the Remote Desktop service.
3. Enable Network Level Authentication (NLA) on supported systems running Windows 7, Windows Server 2008, and Windows Server 2008 R2. Since NLA requires authentication before the vulnerability trigger point, affected systems can use NLA to defend against "worm" malware or advanced malware threats exploiting this vulnerability. However, if an attacker has valid credentials that can be used for successful authentication, the affected system remains vulnerable to remote code execution (RCE).
4. Block TCP port 3389 at the enterprise border firewall.
5. Avoid exposing Remote Desktop Services (RDP, default port 3389) to the public network. (If necessary for remote administration, access should only be possible after logging in via VPN.)