Skip to content
HackIndex logo

HackIndex

RDP Known Vulnerability Detection

3 min read May 15, 2026

BlueKeep (CVE-2019-0708) and DejaBlue (CVE-2019-1181/1182) are pre-authentication unauthenticated RCE vulnerabilities in Windows Remote Desktop Services. The safe check scans confirm exploitability without triggering the vulnerability. Run these before attempting any exploitation path — a positive result changes the priority of the host significantly.

Version fingerprinting to scope applicable CVEs

Before running CVE-specific checks, identify the Windows version to determine which CVEs apply.

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 3389 -sV --script rdp-enum-encryption $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ nxc rdp $TARGET_IP

BlueKeep (CVE-2019-0708) affects:

  • Windows XP, Windows Vista, Windows 7

  • Windows Server 2003, Windows Server 2008, Windows Server 2008 R2

DejaBlue (CVE-2019-1181, CVE-2019-1182) affects:

  • Windows 8, Windows 8.1, Windows 10

  • Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019

Both families were patched in 2019. Unpatched hosts in either version range are viable targets. If the version is Windows 10 or Server 2016/2019, focus on DejaBlue. If it is Windows 7 or Server 2008 R2, BlueKeep is the primary path.

BlueKeep detection (CVE-2019-0708)

The Metasploit auxiliary scanner is the standard check. It is a safe detection-only scan — it confirms the MS_T120 channel binding behavior without triggering the UAF.

┌──(kali㉿kali)-[~]
└─$ msfconsole -q -x "use auxiliary/scanner/rdp/cve_2019_0708_bluekeep; set RHOSTS $TARGET_IP; run; exit" 
[+] 10.10.10.10:3389 - The target is vulnerable. The target attempted cleanup of the incorrectly-bound MS_T120 channel.
[-] 10.10.10.20:3389 - The target is not exploitable.

A positive result confirms the host is unpatched. Move to BlueKeep CVE-2019-0708 Exploitation.

rdpscan provides a faster, dependency-free alternative:

┌──(kali㉿kali)-[~]
└─$ rdpscan $TARGET_IP 
10.10.10.10 - VULNERABLE -- got appid
10.10.10.20 - SAFE

For subnet-wide scanning:

┌──(kali㉿kali)-[~]
└─$ rdpscan $TARGET_SUBNET/24 | grep VULNERABLE

DejaBlue detection (CVE-2019-1181/1182)

The Metasploit auxiliary scanner covers DejaBlue detection:

┌──(kali㉿kali)-[~]
└─$ msfconsole -q -x "use auxiliary/scanner/rdp/cve_2019_1181_bluekeep2; set RHOSTS $TARGET_IP; run; exit" 
[+] 10.10.10.10:3389 - The target is vulnerable.

A positive result on Windows 8 or later confirms the host is unpatched for CVE-2019-1181. No stable public RCE exploit exists for DejaBlue as of writing — the finding is reportable as critical but exploitation falls back to credentialed paths. See DejaBlue CVE-2019-1181 for what is available.

Running both checks together

When the Windows version is uncertain, run both scanners sequentially.

┌──(kali㉿kali)-[~]
└─$ msfconsole -q -x "
use auxiliary/scanner/rdp/cve_2019_0708_bluekeep
set RHOSTS $TARGET_IP
run
use auxiliary/scanner/rdp/cve_2019_1181_bluekeep2
set RHOSTS $TARGET_IP
run
exit
"

rdpscan covers both BlueKeep and some DejaBlue detection in a single pass and is faster for quick subnet sweeps:

┌──(kali㉿kali)-[~]
└─$ rdpscan $TARGET_IP

Patch level check via SMB

If credentials are available, the Windows build number from SMB output can confirm patch status without running a CVE scanner.

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD

Match the build in the output against patched builds:

Version

Patched build (BlueKeep / DejaBlue)

Windows 7 SP1

7601.24441 (May 2019)

Windows Server 2008 R2 SP1

7601.24441 (May 2019)

Windows 10 1809

17763.678 (August 2019)

Windows Server 2016

14393.3143 (August 2019)

Windows Server 2019

17763.678 (August 2019)

Builds below the patched threshold on the matching version are unpatched.

References