CVE-2024-38077: Windows Remote Desktop Licensing Service Remote Code Execution ("MadLicense")

I. Vulnerability Overview

• CVE ID: CVE-2024-38077
• Alias: MadLicense
• CVSS Score: 9.8 (Critical)
• Type: Heap-Based Buffer Overflow (CWE-122)
• Discovered by: Ver, Lewis Lee, Zhiniang Peng
• Description: A pre-authentication, zero-click remote code execution vulnerability in the Windows Remote Desktop Licensing (RDL) service. An unauthenticated attacker can send a crafted RPC packet to the RPC over TCP endpoint exposed by mstlsap.dll / tlslicense.dll, triggering a heap buffer overflow that leads to arbitrary code execution in the context of SYSTEM.

II. Technical Details

The Remote Desktop Licensing Service listens on RPC dynamic endpoints (typically ports 49664–49681) reachable via TCP port 135 (RPC Endpoint Mapper). The vulnerability resides in the LicensingSendResponse or related RPC interface handler within the licensing service's heap memory management. By sending a specially crafted licensing protocol request with an oversized or malformed LicensingBinary structure, the service performs an insecure memcpy into a heap buffer of insufficient size, corrupting adjacent heap metadata and enabling code execution.

Key aspects:

• Pre-auth: No valid credentials or RDP session required.
• 0-click: No user interaction on the target.
• Network vector: Exploited remotely over the network.
• Impact: Full SYSTEM-level compromise of the target Windows Server.

III. Affected Versions

Earlier versions (Windows 2000 Server, Server 2003, Server 2008) may also be affected if the RDL service is enabled.

IV. Environment Setup

1. Install a supported Windows Server version (2008–2025) in a virtual machine.
2. Ensure the Remote Desktop Licensing role is installed via Server Manager:
   • Add Roles and Features → Remote Desktop Services → Remote Desktop Licensing
3. Start/verify the service:
   • net start "Remote Desktop Licensing"
4. Confirm the service is listening:
   • netstat -an | findstr LISTENING
   • The RDL service registers dynamic RPC endpoints. Query port 135 with an RPC endpoint mapper tool.
5. Isolate the target VM from production networks — the PoC will trigger a crash by default.

V. Reproduction Steps

1. Run the PoC script against a target Windows Server with the RDL service exposed:
   root@kitploit:~

   python exploit.py --target <TARGET_IP>
   

2. On the target, monitor for a crash of the tlslicense.dll service or a system crash (BSOD depending on heap corruption severity).
3. To verify the overflow, attach a debugger (WinDbg) to the svchost.exe hosting the RDL service before triggering the exploit and observe the access violation.

VI. PoC Code

The accompanying script exploit.py in this directory contains a reproduction of the MadLicense attack. It connects to the target RDL service via RPC over TCP, constructs a malformed licensing request with an oversized binary blob, and triggers the heap buffer overflow.

VII. Mitigation

• Patch: Install the official security update from Microsoft's July 2024 Patch Tuesday (KB5040426 / KB5040430 / KB5040434 / KB5040437 depending on Windows version).
• Workaround:
  • Disable the Remote Desktop Licensing service if not required:
    root@kitploit:~

    sc stop "Remote Desktop Licensing"
    sc config "Remote Desktop Licensing" start= disabled
    

  • Block inbound RPC dynamic ports (TCP 49152–65535 / 49664–49681) at the firewall while allowing only necessary RPC traffic.
  • Restrict access to TCP/135 and RPC dynamic ports via network segmentation.

VIII. References

• Microsoft Security Response Center: CVE-2024-38077
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38077
• https://nvd.nist.gov/vuln/detail/CVE-2024-38077
• Xing (Ver) L., Lewis Lee, Zhiniang Peng — Original disclosure
• https://attackerkb.com/topics/CVE-2024-38077