BlueKeep: A Proof Of Concept Tool For CVE-2019-0708 Called "Bluekeep"

About Bluekeep PoC Tool
   This tool contains research concerning CVE-2019-0708.
   Bluekeep or CVE-2019-0708 is an RCE exploit that effects the following versions of Windows systems:

• Windows 2003 
• Windows XP 
• Windows Vista 
• Windows 7 
• Windows Server 2008 
• Windows Server 2008 R2

   The vulnerability occurs during pre-authorization and has the potential to run arbitrary malicious code in the NT Authority\system user security context.

How CVE-2019-0708 "Bluekeep" works
   By sending a specially crafted packet an attacker is able to set the value for the Channel ID to something the RDP service isn't expecting, this causes a memory corruption bug that will create the conditions for Remote Code Execution to occur. Should the attacker choose to follow up with packets designed to take advantage of this flaw remote code execution can be achieved with System user privileges.

BlueKeep Installation and Using
   To use BlueKeep PoC, use this command:
python2 bluekeep_poc.py -i [target]

   And then, to perform a DoS attack through Bluekeep vulnerability, use this command:
python2 bluekeep_weaponized_dos.py -i [target] -v

Credits of BlueKeep PoC:
   Research by Ekultek and (VectorSEC)/NullArray.
   Development & Testing by Ekultek.

   Follow they on Twitter:

• Ekultek
• VectorSEC

In Closing: You can see some of they research, along with a list of potentially vulnerable targets under the research directory. They started with very little and decided that we weren't going to stop until we had a working exploit. Ekultek has been able to execute commands on Windows XP with this PoC personally.

Note: There are no payloads. This is just a PoC. HOWEVER it is easily ported to an exploit since you can easily add payloads to this.

Download BlueKeep PoC