{"uuid": "16d5acba-bf8a-4d13-9a5c-267a8e372b85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-0708", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/rdp/cve_2019_0708_bluekeep_rce.rb", "content": "{\"aliases\": [], \"arch\": \"x64\", \"author\": [\"Sean Dillon \", \"Ryan Hanson\", \"OJ Reeves\", \"Brent Cook \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"The RDP termdd.sys driver improperly handles binds to internal-only channel MS_T120,\\n          allowing a malformed Disconnect Provider Indication message to cause use-after-free.\\n          With a controllable data/size remote nonpaged pool spray, an indirect call gadget of\\n          the freed channel is used to achieve arbitrary code execution.\\n\\n          Windows 7 SP1 and Windows Server 2008 R2 are the only currently supported targets.\\n\\n          Windows 7 SP1 should be exploitable in its default configuration, assuming your target\\n          selection is correctly matched to the system's memory layout.\\n\\n          HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\TerminalServer\\\\Winstations\\\\RDP-Tcp\\\\fDisableCam\\n          *needs* to be set to 0 for exploitation to succeed against Windows Server 2008 R2.\\n          This is a non-standard configuration for normal servers, and the target will crash if\\n          the aforementioned Registry key is not set!\\n\\n          If the target is crashing regardless, you will likely need to determine the non-paged\\n          pool base in kernel memory and set it as the GROOMBASE option.\", \"disclosure_date\": \"2019-05-14\", \"fullname\": \"exploit/windows/rdp/cve_2019_0708_bluekeep_rce\", \"is_install_path\": true, \"mod_time\": \"2026-03-24 17:48:31 +0000\", \"name\": \"CVE-2019-0708 BlueKeep RDP Remote Windows Kernel Use After Free\", \"needs_cleanup\": null, \"notes\": {\"AKA\": [\"Bluekeep\"], \"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/windows/rdp/cve_2019_0708_bluekeep_rce.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 0, \"ref_name\": \"windows/rdp/cve_2019_0708_bluekeep_rce\", \"references\": [\"CVE-2019-0708\", \"URL-https://github.com/zerosum0x0/CVE-2019-0708\", \"URL-https://zerosum0x0.blogspot.com/2019/11/fixing-remote-windows-kernel-payloads-meltdown.html\", \"ATT&CK-T1059\", \"ATT&CK-T1068\"], \"rport\": 3389, \"session_types\": false, \"targets\": [\"Automatic targeting via fingerprinting\", \"Windows 7 SP1 / 2008 R2 (6.1.7601 x64)\", \"Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - Virtualbox 6)\", \"Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - VMWare 14)\", \"Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - VMWare 15)\", \"Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - VMWare 15.1)\", \"Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - Hyper-V)\", \"Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - AWS)\", \"Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - QEMU/KVM)\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:27.513444Z"}