6 ms·
Windows Remote Desktop Protocol Security Bypass Vulnerability
- david_shaw 11y agoI think we'll be hearing about MS16-007 for a while into the future. Many organizations have a hard time keeping all of their machines up-to-date -- I've had a lot of experience with this while conducting penetration tests -- and vulnerabilities like this live on for a very long time. MS08-067 is still super common to find in the wild. Building complex software is hard work, so I won't judge the development team that released software this vulnerable. That said, this one seems pretty severe.
- zaroth 11y agoWindows 10 hosts running RDP services fail to prevent remote logon to accounts that have no passwords set. An attacker could exploit this vulnerability by using an older version of the RDP client to connect to the Windows 10 host. Once connected, the attacker could generate a list of user accounts on the host and attempt to log on as those users. If one of the user accounts has no password set, then the attacker is allowed to log on as that user, despite the default system setting that restricts access to accounts without passwords to local logon only. Is the user enumeration a feature and not a vulnerability of its own?
- peterwwillis 11y agoWindows displays a "Welcome" screen with all user accounts listed when you connect via RDP. I don't know how to automate enumeration, though. Perhaps scraping a screenshot after connecting and then OCRing the usernames.
- hamburglar 11y agoIt might be even easier than that, since RDP remotes the screen at the GDI level, so if you're looking at the protocol, you'll see a regular pattern of DrawText calls.
- voltagex_ 11y agoOut of interest, is there something like a Wireshark dissector that'd show this level of detail?
- yuhong 11y agoIt is encrypted I think.
- hamburglar 11y agoyuhong is correct: RDP rides inside a TLS connection (if I recall, pre-Vista didn't use TLS but there was some other encryption scheme). I'm not sure how much work it would be to sniff/log session keys and display the decrypted traffic in a nice format. I've never seen a tool for it. I'd be surprised if Microsoft doesn't have at least some netmon.exe tooling for it but it may not be released.
- peterwwillis 11y agoThere is a dissector, but no, it doesn't show this level of detail.
- Someone1234 11y agoCVE-2016-0019 in particular is uninteresting and unlikely to be widely exploited. Requires: - Windows 10 Pro or higher. - RDC to be enabled (not default). - A non-Microsoft Account to be utilised (not default). - That local account to have no password set. Essentially you really need to TRY to get your machine exploitable with that one.
- yuhong 11y agoStill really easy to trigger even by accident. All you need is to check a box to enable RDP while logged on with a local account with no password (though I hasn't tested, you may also need to uncheck another checkbox restricting logon to NLA).
- Someone1234 11y agoI disagree. It falls in a sweet spot where consumers won't be impacted (because they're utilising Microsoft Accounts/don't enable RDC), and enterprises won't be impacted (because they don't set up accounts with no password). And then on top of that you need RDC on a Windows 10 box to be exposed to the internet or a LAN with malicious users on it. It is a legitimate bug that should be patched. But a miniscule subset of users will be impacted, because the pre-conditions are so niche.
- Eridrus 11y agoThe first 3 bullet points seem like they would happen on corporate networks without really trying too hard.
- jameshart 11y agoBut typically that environment would fail bullet 4, right?
- peterwwillis 11y agoAre you asking if local accounts inside corporate networks are typically secure by default?
- qewrffewqwfqew 11y ago> The most severe of the vulnerabilities could allow remote code execution if an attacker is able to log on to a target system and run a specially crafted application. That reads to me like "RCE if you have RCE". Which I guess is a fair description of the DLL vulnerabilities if you ignore the privilege-escalation parts. The DirectShow and (perhaps) passwordless RDP vulnerabilities seem rather more severe to me. How is that leader quote appropriate?
- 13of40 11y agoIt seems like basically a local elevation of privilege. Useful to malware and/or wayward secretaries.
- yuhong 11y agoYou can repro on modern mstsc by using enablecredsspsupport:i:0 in the .rdp file BTW.
- forgotAgain 11y agoAnd once again I have to manually check the list of windows updates not to install so the Windows 10 upgrade malware is avoided. No matter how many times these updates are hidden they still show up again and again for install. In this instance KB2952664.
- mikegioia 11y agoI think you're fighting a war you can't win.
- forgotAgain 11y agoNot trying to win a war as much as show that the old ms is still there.
- gruez 11y agofind kb3035583, right click -> hide update. no more worrying about windows 10. if you haven't already, uninstall kb3035583.
- anonbanker 11y agoMy entire enterprise communicates using SPICE under Gentoo Linux, so I get to watch and laugh from the sidelines.