RDP proof of concept triggers blue screen of death

By Darren Pauli on Mar 16, 2012 3:27 PM
Filed under Applications

Proof of concept kills Windows machines.

Update: A proof of concept (POC) exploit of the deadly RDP vulnerability has been shown to trigger blue screens of death on Windows XP and Windows Server 2003 machines.

Two POCs were described as accurate in an email to SC by the discoverer of the vulnerability, Luigi Auriemma.

The first POC to emerge was posted briefly on a Chinese website before disappearing. The second, based off the Chinese POC, was described by Accuvant researcher Josh Drake.

A third which was circulating on Twitter was fake.

HackLabs penetration tester Jody Melbourne said tests of the Chinese POC had crashed Windows virtual machines.

"I have tested both on XP and Win2k3 VMs, resulting in instant blue screen of death and/or reboots," Melbourne said.

"Network signature matches [the] RDP handshake; it's definitely targeting RDP and crashing the kernel via RDP pre-auth, so it's definitely a working proof of concept for the bug.

"[It is] a denial of service only at the moment, but it's probably safe to assume somebody somewhere has a working exploit by now."

He said Metasploit researchers were reverse-engineering the Chinese POC and expected that a Metasploit module would be only days away.

"In the race to produce a proof of concept, an unknown chinese hacker won .... and in the race to produce command execution? Who knows," he said.

A bounty for a working exploit has been posted on developer site Gun.IO, funded in part by Metasploit creator HD Moore.

Auriemma said in a tweet that the packet stored in the Chinese rdpclient.exe POC was the "exact one" which he submitted to the Zero Day Initiative.

Some researchers said the source was the Microsoft's Active Protections Program.

RDP proof of concept triggers blue screen of death

metasploit, rdp, vulnerability, poc, exploit

microsoft, Accuvant

RDP

Readers of this article also read...

Ads by Google

What are your thoughts on this article? Add your comment below.

To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.

NOTE: You must be a registered member of SC Magazine to post a comment.

Click here to login | Click here to register

comments powered by Disqus