error after sending shell code about bluekeep_cve-2019-0708_poc_to_exploit

[algo7]

Yes. There is a reason it's named magic. As the saying goes "Programming is the closest humanity has come to writing spells, and by extension, programmers are as close as we've come to wizards."

It won't work with any set of shell code, you have to play around with several different combinations.

It took me 40hrs non-sleep. Just FYI.

[algo7]

my payload spawns a reverse tcp shell which can be used with metasploit. You can play around with yours and see if it works. BlueKeep is not stable, as well as its spouses in the "Blue" family.

[algo7]

show me your code. there must be a bracket mismatch

[0xh4di]

no change in your code. just run your poc.py on my win2008r2 rdp.

[algo7]

which python version are you using

[LDrakura]

win2008r2 may be not vulnerability

[0xh4di]

python3

[0xh4di]

which windows versions affected?

[algo7]

Windows 2003
Windows XP
Windows Vista
Windows 7
Windows Server 2008
Windows Server 2008 R2

but it depends from host to host

[0xh4di]

what your payload do? can I replace with my payload? just hexencoded string?

[0xh4di]

for custom payload, I should replace magic = ("") with my hexencoded windows command wants to run after exploit. right?

[Chinalover]

@algo7 which version you have test?
i tried win2k8 and win7sp2 it doesn't work.
i also change the shell code to hexed 'calc',but nothing happen

[xiaozhu1337]

@algo7 which version you have test?
i tried win2k8 and win7sp2 it doesn't work.
i also change the shell code to hexed 'calc',but nothing happen

hello

[algo7]

@Chinalover @xiaozhu1337 I've tested against all versions. Some of them work at some times and vice versa. It's not a stable exploit. Plus, not all the auto-generated shellcode will fit. That's why I keep stressing on customization.