rapid7 / metasploit-framework

Metasploit Framework
https://www.metasploit.com/
Other
33.8k stars 13.9k forks source link

cliprdr groom strategy on cve-2019-0708? #12597

Closed miou-gh closed 3 years ago

miou-gh commented 4 years ago

This repository (https://github.com/0xeb-bp/bluekeep) appears to use CLIPRDR instead of MS_T120 and RDPSND. I tried specifying MS_T120 instead of the default RDPSND to spawn a shell on a default install 2008 R2 VM and it didn't work, even with the correct NPP address (offset as well).

I read an earlier issue which had a replied suggesting there's an incorrect number of arguments popped from the stack in relation to 2008 R2. Is this still an issue, or has it been resolved?

Thanks in advance.

github-actions[bot] commented 3 years ago

Hi!

This issue has been left open with no activity for a while now.

We get a lot of issues, so we currently close issues after 60 days of inactivity. It’s been at least 30 days since the last update here. If we missed this issue or if you want to keep it open, please reply here. You can also add the label "not stale" to keep this issue open!

As a friendly reminder: the best way to see this issue, or any other, fixed is to open a Pull Request.