Reward offered for Windows RDP exploit

An exploit is apparently already in circulation

The vulnerability in the remote desktop server in all versions of Windows that was revealed on March's Patch Tuesday has sparked some greed. Both Black and White Hats are currently trying to develop an exploit that could remotely compromise an unpatched Windows system – as long as the RDP (Remote Desktop Protocol) server is active on the target system and accessible over the web.

On the hacker job site gun.io, a reward of about $1,500 has even been offered for a Metasploit module that can be used to exploit the vulnerability. If someone wants to claim the reward, they will have to release the Metasploit module under an open source licence and make it available to the public.

Meanwhile, an exploit has been circulating on Chinese websites that is apparently written in Python and able to open a remote shell on vulnerable target systems. A screenshot of an alleged exploit called ms12-020.exe is also making the rounds, although it's unlikely to really be a working exploit.

Based on the vulnerability's seriousness and how widespread it is, Microsoft expects to see an exploit within 30 days. The vulnerability was reported confidentially as part of the Zero Day Initiative, which means that few details are available. According to the entry in the CVE vulnerability database, an attacker can compromise a Windows system with specially crafted RDP packets that trigger access to objects in memory that were deleted or not properly initialised.

(fab)