# RDP Known Vulnerability Detection

> Identifies known RDP vulnerabilities including BlueKeep, DejaBlue, and misconfigurations using Nmap scripts, Metasploit modules, and manual version checks.

- **URL:** https://hackindex.io/services/rdp/vulnerability-discovery/rdp-known-vulnerabilities-detection
- **Path:** RDP > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/rdp/vulnerability-discovery.md)
- **Published:** 2026-05-15
- **Updated:** 2026-05-15

BlueKeep (CVE-2019-0708) and DejaBlue (CVE-2019-1181/1182) are pre-authentication unauthenticated RCE vulnerabilities in Windows Remote Desktop Services. The safe check scans confirm exploitability without triggering the vulnerability. Run these before attempting any exploitation path: a positive result changes the priority of the host significantly.

## **Version fingerprinting to scope applicable CVEs**

Before running CVE-specific checks, identify the Windows version to determine which CVEs apply.

```bash
nmap -Pn -p 3389 -sV --script rdp-enum-encryption $TARGET_IP
nxc rdp $TARGET_IP
```

BlueKeep (CVE-2019-0708) affects:

- Windows XP, Windows Vista, Windows 7
- Windows Server 2003, Windows Server 2008, Windows Server 2008 R2

DejaBlue (CVE-2019-1181, CVE-2019-1182) affects:

- Windows 8, Windows 8.1, Windows 10
- Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019

Both families were patched in 2019. Unpatched hosts in either version range are viable targets. If the version is Windows 10 or Server 2016/2019, focus on DejaBlue. If it is Windows 7 or Server 2008 R2, BlueKeep is the primary path.

## **BlueKeep detection (CVE-2019-0708)**

The Metasploit auxiliary scanner is the standard check. It is a safe detection-only scan: it confirms the MS_T120 channel binding behavior without triggering the UAF.

> [!WARNING]
> This may be restricted in exams such as OSCP. Metasploit modules are limited to one machine per exam.

```bash
msfconsole -q -x "use auxiliary/scanner/rdp/cve_2019_0708_bluekeep; set RHOSTS $TARGET_IP; run; exit"
# [+] 10.10.10.10:3389 - The target is vulnerable. The target attempted cleanup of the incorrectly-bound MS_T120 channel.
# [-] 10.10.10.20:3389 - The target is not exploitable.
```

A positive result confirms the host is unpatched. Move to [BlueKeep CVE-2019-0708 Exploitation](https://hackindex.io/services/rdp/exploitation/vulnerabilities/bluekeep-cve-2019-0708).

`rdpscan` provides a faster, dependency-free alternative:

```bash
rdpscan $TARGET_IP
# 10.10.10.10 - VULNERABLE -- got appid
# 10.10.10.20 - SAFE
```

For subnet-wide scanning:

```bash
rdpscan $TARGET_SUBNET/24 | grep VULNERABLE
```

## **DejaBlue detection (CVE-2019-1181/1182)**

The Metasploit auxiliary scanner covers DejaBlue detection:

> [!WARNING]
> This may be restricted in exams such as OSCP. Metasploit modules are limited to one machine per exam.

```bash
msfconsole -q -x "use auxiliary/scanner/rdp/cve_2019_1181_bluekeep2; set RHOSTS $TARGET_IP; run; exit"
# [+] 10.10.10.10:3389 - The target is vulnerable.
#
```

A positive result on Windows 8 or later confirms the host is unpatched for CVE-2019-1181. No stable public RCE exploit exists for DejaBlue as of writing: the finding is reportable as critical but exploitation falls back to credentialed paths. See [DejaBlue CVE-2019-1181](https://hackindex.io/services/rdp/exploitation/vulnerabilities/dejablue-cve-2019-1181) for what is available.

## **Running both checks together**

When the Windows version is uncertain, run both scanners sequentially.

```bash
msfconsole -q -x "
use auxiliary/scanner/rdp/cve_2019_0708_bluekeep
set RHOSTS $TARGET_IP
run
use auxiliary/scanner/rdp/cve_2019_1181_bluekeep2
set RHOSTS $TARGET_IP
run
exit
"
```

`rdpscan` covers both BlueKeep and some DejaBlue detection in a single pass and is faster for quick subnet sweeps:

```bash
rdpscan $TARGET_IP
```

## **Patch level check via SMB**

If credentials are available, the Windows build number from SMB output can confirm patch status without running a CVE scanner.

```bash
nxc smb $TARGET_IP -u $USER -p $PASSWORD
```

Match the build in the output against patched builds:

| Version | Patched build (BlueKeep / DejaBlue) |
| --- | --- |
| Windows 7 SP1 | 7601.24441 (May 2019) |
| Windows Server 2008 R2 SP1 | 7601.24441 (May 2019) |
| Windows 10 1809 | 17763.678 (August 2019) |
| Windows Server 2016 | 14393.3143 (August 2019) |
| Windows Server 2019 | 17763.678 (August 2019) |

Builds below the patched threshold on the matching version are unpatched.

## References

- [CVE-2019-0708](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-0708) - Microsoft MSRC advisory with affected versions and patch references
- [CVE-2019-1181](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1181) - Microsoft MSRC advisory with affected versions and patch references
- [rdpscan](https://github.com/robertdavidgraham/rdpscan) - Fast RDP vulnerability scanner for BlueKeep and DejaBlue family detection
- [Metasploit BlueKeep scanner](https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliaries/scanner/rdp) - Safe auxiliary detection module