RDP proof of concept triggers blue screen of death

By

Proof of concept kills Windows machines.

Update: A proof of concept (POC) exploit of the deadly RDP vulnerability has been shown to trigger blue screens of death on Windows XP and Windows Server 2003 machines.

RDP proof of concept triggers blue screen of death

Two POCs were described as accurate in an email to SC by the discoverer of the vulnerability, Luigi Auriemma.

The first POC to emerge was posted briefly on a Chinese website before disappearing. The second, based off the Chinese POC, was described by Accuvant researcher Josh Drake.

A third which was circulating on Twitter was fake. 

HackLabs penetration tester Jody Melbourne said tests of the Chinese POC had crashed Windows virtual machines.

"I have tested both on XP and Win2k3 VMs, resulting in instant blue screen of death and/or reboots," Melbourne said.
"Network signature matches [the] RDP handshake; it's definitely targeting RDP and crashing the kernel via RDP pre-auth, so it's definitely a working proof of concept for the bug.
"[It is] a denial of service only at the moment, but it's probably safe to assume somebody somewhere has a working exploit by now."
He said Metasploit researchers were reverse-engineering the Chinese POC and expected that a Metasploit module would be only days away.
"In the race to produce a proof of concept, an unknown chinese hacker won .... and in the race to produce command execution? Who knows," he said.

A bounty for a working exploit has been posted on developer site Gun.IO, funded in part by Metasploit creator HD Moore.

Auriemma said in a tweet that the packet stored in the Chinese rdpclient.exe POC was the "exact one" which he submitted to the Zero Day Initiative.

Some researchers said the source was the Microsoft's Active Protections Program. 

Got a news tip for our journalists? Share it with us anonymously here.

Copyright © SC Magazine, Australia

Tags:
exploitmetasploitpocrdpsecurityvulnerability

Sponsored Whitepapers

Modern Identity for SAP and Beyond: Replace SAP IDM with Saviynt
Modern Identity for SAP and Beyond: Replace SAP IDM with Saviynt
Saviynt Simplifies GRC and Access Control for SAP and Beyond
Saviynt Simplifies GRC and Access Control for SAP and Beyond
Futureproof Your Business with Datacom and AMD: Seamless Windows 11 Transition
Futureproof Your Business with Datacom and AMD: Seamless Windows 11 Transition
See everything. Do more.
See everything. Do more.
Lindentech Secures Digital Identity with Zero Trust and Microsoft Entra
Lindentech Secures Digital Identity with Zero Trust and Microsoft Entra

Events

Most Read Articles

NSW Police to embark on $126m IT overhaul

NSW Police to embark on $126m IT overhaul
CBA looks to GenAI to assist 1200 'security champions'

CBA looks to GenAI to assist 1200 'security champions'
Australia's super funds told to assess authentication controls

Australia's super funds told to assess authentication controls
WestJet probes cyber security incident

WestJet probes cyber security incident
techpartner.news logo
Dave Stevens on Brennan's evolution and the need for Aussie tech unity
Dave Stevens on Brennan's evolution and the need for Aussie tech unity
Sydney's ITKnocks on contact centre AI and the slow death of the IVR
Sydney's ITKnocks on contact centre AI and the slow death of the IVR
"It's an exciting time to be part of the health and aged care sector"
"It's an exciting time to be part of the health and aged care sector"
Insicon founder Matt Miller on the coming 'tsunami' of compliance and educating boards about cyber security
Insicon founder Matt Miller on the coming 'tsunami' of compliance and educating boards about cyber security
Orro claims Australia first with managed digital asset discovery service
Orro claims Australia first with managed digital asset discovery service

Log In

  |  Forgot your password?