RDP proof of concept triggers blue screen of death

By on
RDP proof of concept triggers blue screen of death

Proof of concept kills Windows machines.

Update: A proof of concept (POC) exploit of the deadly RDP vulnerability has been shown to trigger blue screens of death on Windows XP and Windows Server 2003 machines.

Two POCs were described as accurate in an email to SC by the discoverer of the vulnerability, Luigi Auriemma.

The first POC to emerge was posted briefly on a Chinese website before disappearing. The second, based off the Chinese POC, was described by Accuvant researcher Josh Drake.

A third which was circulating on Twitter was fake. 

HackLabs penetration tester Jody Melbourne said tests of the Chinese POC had crashed Windows virtual machines.

"I have tested both on XP and Win2k3 VMs, resulting in instant blue screen of death and/or reboots," Melbourne said.
"Network signature matches [the] RDP handshake; it's definitely targeting RDP and crashing the kernel via RDP pre-auth, so it's definitely a working proof of concept for the bug.
"[It is] a denial of service only at the moment, but it's probably safe to assume somebody somewhere has a working exploit by now."
He said Metasploit researchers were reverse-engineering the Chinese POC and expected that a Metasploit module would be only days away.
"In the race to produce a proof of concept, an unknown chinese hacker won .... and in the race to produce command execution? Who knows," he said.

bounty for a working exploit has been posted on developer site Gun.IO, funded in part by Metasploit creator HD Moore.

Auriemma said in a tweet that the packet stored in the Chinese rdpclient.exe POC was the "exact one" which he submitted to the Zero Day Initiative.

Some researchers said the source was the Microsoft's Active Protections Program. 

Got a news tip for our journalists? Share it with us anonymously here.

Copyright © SC Magazine, Australia


Most Read Articles

Log In

  |  Forgot your password?