🔬RDP
Last updated
Was this helpful?
Last updated
Was this helpful?
🔬
Target IP:
10.4.18.131RDP exploitation
Dictionaries to use:
/usr/share/metasploit-framework/data/wordlists/common_users.txt
/usr/share/metasploit-framework/data/wordlists/unix_passwords.txt
📌 The RDP is exposed on target port
3333, and not on the default port3389.
Try hydra to find valid username and password
freerdp cannot be used in this lab
Use xfreerdp to connect to target via RDP
🔬 Home Lab
I have prepared a vulnerable Windows 2008 R2 Virtual Machine and connected it to the same network of the Kali virtual machine. On the server, I have activated
RDPservice on default port3389.
Host system:
Kali LinuxTarget system:
Windown Server 2008 R2- IP192.168.31.131-Administrator:Eternal17010Exploitation tool:
❗ Targeting Kernel space memory and apps can cause system crashes.
The attacker can remotely execute arbitrary code by gaining access to a chunk of kernel memory, without authentication.
BlueKeep PoC's (Proof of Concepts) and exploits could be malicious in nature, use only verified exploit code and modules.
Target RDP activated:
📌 RDP Port
3389is open
❗ Kernel CRASH can be caused by this exploit, so pay attention on production environment ❗
On WinServer2008 target, open regedit
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
Set fDisableCam reg key on 0
The NPP address can be extracted from a memory dump of the target machine.
In VMWare, take a snapshot of the target virtual machine (Win Server 2008 R2).
From the VM (virtual machine) folder copy the .vmem and .vmsn files to the vmss2core tool folder
Run the tool to generate a memory.dmp file
Run !polfind a to get a message
That is the start of address of Non Page Pool, in this case fffffa8018c08000
Edit the exploit and set the GROOMBASE variable if not already set.
In my case it is already set as the above address, for the 2008 R2 (6.1.7601 x64 - VMWare 15.1) target number 5.
Save the exploit file and run reload_all in the Metasploit interface.
Set the GROOMSIZE to 50.
Target IP:
10.4.22.41RDP exploitation
Dictionaries to use:
/usr/share/metasploit-framework/data/wordlists/common_users.txt
/usr/share/metasploit-framework/data/wordlists/unix_passwords.txt
Use Metasploit module to check if port 3333 is running RDP.
Vulnerability:
To make the exploit work, I've used the and .
To make the exploit work, it needs the correct GROOMBASE value which is the start address of the (NPP).
Download the
Run and open the memory.dmp file
