Pierluigi Paganini June 05, 2019

A security expert has developed a Metasploit module to exploit the critical BlueKeep vulnerability and get remote code execution.

The security researcher Zǝɹosum0x0 has developed a module for the popular Metasploit penetration testing framework to exploit the critical BlueKeep flaw.

The vulnerability, tracked as CVE-2019-0708, impacts the Windows Remote Desktop Services (RDS) and was addressed by Microsoft with May 2019 Patch Tuesday updates. BlueKeep is a wormable flaw that can be exploited by malware authors to create malicious code with WannaCry capabilities.

As explained by Microsoft, this vulnerability could be exploited by malware with wormable capabilities, it could be exploited without user interaction, making it possible for malware to spread in an uncontrolled way into the target networks.

Many security experts have already developed their own exploit code for this issue without publicly disclosing it for obvious reasons.

Microsoft has released patches for Windows 7, Server 2008, XP and Server 2003. Windows 7 and Server 2008 users can prevent unauthenticated attacks by enabling Network Level Authentication (NLA), and the threat can also be mitigated by blocking TCP port 3389.

The Metasploit module could be used to trigger the BlueKeep flaw on vulnerable Windows XP, 7, and Server 2008, but the expert has not publicly disclosed it to avoid threat actors abusing it.

Unfortunately, it has been determined that roughly one million devices exposed online are vulnerable to attacks exploiting the BlueKeep Windows vulnerability and hackers are ready to hit them.

Zǝɹosum0x0 also published a video PoC that shows how to exploit the BlueKeep vulnerability on a Windows 2008 system.

According to Zǝɹosum0x0, the module could be used also against machines running on Windows 7 and Server 2008 R2.

This Metasploit module doesn’t work against Windows Server 2003.

Zǝɹosum0x0 also developed a scanner Metasploit module for the CVE-2019-0708 BlueKeep RCE vulnerability.

At the end of May, Microsoft issued a second warning for users of older Windows OS versions to update their systems in order to patch the remote code execution vulnerability dubbed BlueKeep.

The NSA also issued an alert to urge users to install the security patches to address the BlueKeep flaw.

“The National Security Agency is urging Microsoft Windows administrators and users to ensure they are using a patched and updated system in the face of growing threats. Recent warnings by Microsoft stressed the importance of installing patches to address a protocol vulnerability in older versions of Windows ” reads the NSA’s advisory.

“This is the type of vulnerability that malicious cyber actors frequently exploit through the use of software code that specifically targets the vulnerability. For example, the vulnerability could be exploited to conduct denial of service attacks. It is likely only a matter of time before remote exploitation code is widely available for this vulnerability. NSA is concerned that malicious cyber actors will use the vulnerability in ransomware and exploit kits containing other known exploits, increasing capabilities against other unpatched systems.

NSA urges everyone to invest the time and resources to know your network and run supported operating systems with the latest patches.”

Pierluigi Paganini

(SecurityAffairs – Metasploit, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]