With more hints dropped online on how to exploit BlueKeep, you've patched that Windows RDP flaw, right?

Someone just revealed the tricky kernel heap spray part

Vital clues on how to exploit the notorious Windows RDP bug, aka CVE-2019-0708 aka BlueKeep, and hijack vulnerable boxes, emerged online this week.

The growing number of hints can be used by folks to develop working code that attacks Microsoft's Remote Desktop Services software, on Windows XP through to Server 2008, and gains kernel-level code execution without any authentication or user interaction. You just need to be able to reach a vulnerable RDP server across the network or internet.

Such an intrusion would give an attacker full control of a machine. So far, publicly available proof-of-concept exploit code mostly crashes vulnerable systems, rather than commandeer boxes. It's feared that publicly shared, working, and reliable remote code-execution exploits, built from the aforementioned hints and tips, will be used to create a worm that can move from machine to machine, infecting them via BlueKeep as it goes, while stealing information or rolling out ransomware.

Microsoft issued free patches for BlueKeep in May, though not everyone has installed them.

New details

Earlier this week, a researcher using the handle 0xeb_bp created a GitHub repository including a written in-depth analysis of the flaw, and incomplete proof-of-concept Python code that targets Windows XP.

BlueKeep is a use-after-free() vulnerability in Remote Desktop Services's kernel driver termdd.sys. There are more technical details here, by the Zero Day Initiative, however the summary is: it is possible to open a connection to a vulnerable RDP server, open a channel called MS_T120\x00 through this connection, send a payload of malicious code, and then terminate the connection. That will trigger the bug, and with the right voodoo, cause the smuggled code to execute.

In order to do this, you need to pull off something rather tricky: spraying the Windows kernel's heap memory pool with data just right to achieve code execution. While the concept of heap spraying is understood by exploit developers and security engineers, it hasn't been publicly explained within the context of CVE-2019-0708 – until now.

Rust in peace: Memory bugs in C and C++ code cause security issues so Microsoft is considering alternatives once again


0xeb_bp's PDF write-up in their GitHub repo details these vital steps, and how to overwrite the pool successfully. Although industry folks are aware of heap spraying, particularly in the context of browser exploitation, using the technique against the Windows kernel's nonpaged pool of memory is non-trivial. For CVE-2019-0708, though, a walk-through on how to do just that is now public, and a video of it all working can be found here.

You may be relieved to hear the PDF deliberately omits certain details, such as the essential shellcode needed to commandeer a box. Also, it focuses on Windows XP, and the technique may not work on later editions of the operating system. However, along with exploitation tips detailed in a Chinese-language slide deck that appeared online two days ago, the difficult parts of a viable working exploit are now public, paving the way for someone to finish off the work and share it.

"The information here is already available within the Chinese hacker community," 0xeb_bp pointed out.

WannaCry breaker and noted security researcher Marcus Hutchins, who is awaiting sentencing in the US for his role in developing banking malware, said this extra info will make it easier for white and black hats to exploit BlueKeep. "They provided the code to actually do the actual pool spray," the Brit said, adding we're probably now a week away from someone completing a working public exploit.

This should give admins who have yet to install Microsoft's patches that last bit of motivation they need to get the bug walled off once and for all. ®

Other stories you might like

  • Ex-Qualcomm Snapdragon chief turns CEO at AI chip startup MemryX

    Meet the new boss

    A former executive leading Qualcomm's Snapdragon computing platforms has darted the company to become CEO at an AI chip startup.

    Keith Kressin will lead product commercialization for MemryX, which was founded in 2019 and makes memory-intensive AI chiplets.

    The company is now out of stealth mode and will soon commercially ship its AI chips to non-tech customers. The company was testing early generations of its chips with industries including auto and robotics.

    Continue reading
  • Aircraft can't land safely due to interference with upcoming 5G C-band broadband service

    Expect flight delays and diversions, US Federal Aviation Administation warns

    The new 5G C-band wireless broadband service expected to rollout on 5 January 2022 in the US will disrupt local radio signals and make it difficult for airplanes to land safely in harsh weather conditions, according to the Federal Aviation Administration.

    Pilots rely on radio altimeter readings to figure out when and where an aircraft should carry out a series of operations to prepare for touchdown. But the upcoming 5G C-band service beaming from cell towers threatens to interfere with these signals, the FAA warned in two reports.

    Flights may have to be delayed or restricted at certain airports as the new broadband service comes into effect next year. The change could affect some 6,834 airplanes and 1,828 helicopters. The cost to operators is expected to be $580,890.

    Continue reading
  • Canadian charged with running ransomware attack on US state of Alaska

    Cross-border op nabbed our man, boast cops and prosecutors

    A Canadian man is accused of masterminding ransomware attacks that caused "damage" to systems belonging to the US state of Alaska.

    A federal indictment against Matthew Philbert, 31, of Ottawa, was unsealed yesterday, and he was also concurrently charged by the Canadian authorities with a number of other criminal offences at the same time. US prosecutors [PDF] claimed he carried out "cyber related offences" – including a specific 2018 attack on a computer in Alaska.

    The Canadian Broadcasting Corporation reported that Philbert was charged after a 23 month investigation "that also involved the [Royal Canadian Mounted Police, federal enforcers], the FBI and Europol."

    Continue reading

Biting the hand that feeds IT © 1998–2021