Need help with BlueGate?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

ollypwn
230 Stars 73 Forks 5 Commits 1 Opened issues

Description

PoC (DoS + scanner) for CVE-2020-0609 & CVE-2020-0610 - RD Gateway RCE

Services available

!
?

Need anything else?

Contributors list

BlueGate

Proof of Concept (Denial of Service + scanner) for CVE-2020-0609 and CVE-2020-0610.

These vulnerabilities allows an unauthenticated attacker to gain remote code execution with highest privileges via RD Gateway for RDP.

Please use for research and educational purpose only.

Usage

Make sure you have pyOpenSSL installed for python3.

usage: BlueGate.py [-h] -M {check,dos} [-P PORT] host

positional arguments: host IP address of host

optional arguments: -h, --help show this help message and exit -M {check,dos}, --mode {check,dos} Mode -P PORT, --port PORT UDP port of RDG, default: 3391

Vulnerability

The vulnerabilities allows an unauthenticated attacker to write forward out-of-bound in the heap, by specifying an unchecked and arbitrary index parameter

(0x00 - 0xFFFF)
. The data to write is also arbitrary with a length up to 1000 bytes at a time and a maximum of 4096 during one session.

If you would like to read more about the vulnerabilities, check this or read my latest tweets on Twitter with a PoC video as well.

What is RD Gateway?

RD Gateway acts as a proxy for RDP; i.e. between some internal servers and the internet, so you don't have to expose RDP directly to the internet.

Why BlueGate?

That was just the working title, and I couldn't come up with a better one at this stage.

Todo:

  • ~~Vulnerability scanner/checker~~ DONE

  • ~~Python implementation~~ DONE

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.