RDP proof of concept triggers blue screen of death

Powered by SC Magazine
 

Proof of concept kills Windows machines.

Update: A proof of concept (POC) exploit of the deadly RDP vulnerability has been shown to trigger blue screens of death on Windows XP and Windows Server 2003 machines.

Two POCs were described as accurate in an email to SC by the discoverer of the vulnerability, Luigi Auriemma.

The first POC to emerge was posted briefly on a Chinese website before disappearing. The second, based off the Chinese POC, was described by Accuvant researcher Josh Drake.

A third which was circulating on Twitter was fake. 

HackLabs penetration tester Jody Melbourne said tests of the Chinese POC had crashed Windows virtual machines.

"I have tested both on XP and Win2k3 VMs, resulting in instant blue screen of death and/or reboots," Melbourne said.
"Network signature matches [the] RDP handshake; it's definitely targeting RDP and crashing the kernel via RDP pre-auth, so it's definitely a working proof of concept for the bug.
"[It is] a denial of service only at the moment, but it's probably safe to assume somebody somewhere has a working exploit by now."
He said Metasploit researchers were reverse-engineering the Chinese POC and expected that a Metasploit module would be only days away.
"In the race to produce a proof of concept, an unknown chinese hacker won .... and in the race to produce command execution? Who knows," he said.

bounty for a working exploit has been posted on developer site Gun.IO, funded in part by Metasploit creator HD Moore.

Auriemma said in a tweet that the packet stored in the Chinese rdpclient.exe POC was the "exact one" which he submitted to the Zero Day Initiative.

Some researchers said the source was the Microsoft's Active Protections Program. 

Copyright © SC Magazine, Australia


RDP proof of concept triggers blue screen of death
 
 
 
Top Stories
The True Cost of BYOD - 2014 survey
Twelve months on from our first study, is BYOD a better proposition?
 
Photos: Unboxing the Magnus supercomputer
Pawsey's biggest beast slots into place.
 
ANZ looks to life beyond the transaction
If digital disruptors think an online payments startup could rock the big four, they’ve missed the point of why people use banks, says Patrick Maes.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  29%
 
Application integration concerns
  3%
 
Security and compliance concerns
  28%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  21%
 
Lack of stakeholder support
  3%
 
Protecting on-premise IT jobs
  4%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 1071

Vote