/ Infosec

Serious RDP Vulnerability found in older OS'es - patch now

If you are still running older operating systems like Windows 2008, Windows 7 and even Windows XP or 2003 and you have RDP enabled then you should be aware that there is a serious vulnerbility in RDP in these operating systems. It is so serious that Microsoft have issued a patch for these operating systems even though 2003 and XP are past end of life, this shows how serious this issue is.

If you run Windows 2003, XP, 2008 or Windows 7 - PATCH NOW. If these machines have RDP accessible from the internet, disable it now, patch and leave it disabled. RDP avaibility over the internet is never a good idea.

Microsoft have issued an advisory here.

One place that seems to love having RDP open to the world are the cloud vendors like AWS and Azure. I've thrown together a very quick and dirty script that will pull all public IP's from an AWS account's EC2 machines. This script uses the AWS CLI to parse the public IP's from the EC2 machines and lists those public IP's. You will need an account with an access key, secret key and the necessary permissions to parse the EC2 VM's.
If you have a large estate where developers can spin up their own machines, you might want to run this to get a list of external IP's to scan.

aws configure set default.region us-west-2
aws ec2 describe-instances |find "PublicIPAddress" /i
aws configure set default.region us-east-1
aws ec2 describe-instances |find "PublicIPAddress" /i
aws configure set default.region us-east-2
aws ec2 describe-instances |find "PublicIPAddress" /i
aws configure set default.region us-west-1
aws ec2 describe-instances |find "PublicIPAddress" /i
aws configure set default.region us-west-2
aws ec2 describe-instances |find "PublicIPAddress" /i
aws configure set default.region ca-central-1
aws ec2 describe-instances |find "PublicIPAddress" /i
aws configure set default.region eu-central-1
aws ec2 describe-instances |find "PublicIPAddress" /i
aws configure set default.region eu-west-1
aws ec2 describe-instances |find "PublicIPAddress" /i
aws configure set default.region eu-west-2
aws ec2 describe-instances |find "PublicIPAddress" /i
aws configure set default.region eu-west-3
aws ec2 describe-instances |find "PublicIPAddress" /i
aws configure set default.region eu-north-1
aws ec2 describe-instances |find "PublicIPAddress" /i
aws configure set default.region ap-east-1
aws ec2 describe-instances |find "PublicIPAddress" /i
aws configure set default.region ap-northeast-1
aws ec2 describe-instances |find "PublicIPAddress" /i
aws configure set default.region ap-northeast-2
aws ec2 describe-instances |find "PublicIPAddress" /i
aws configure set default.region ap-northeast-3
aws ec2 describe-instances |find "PublicIPAddress" /i
aws configure set default.region ap-southeast-1
aws ec2 describe-instances |find "PublicIPAddress" /i
aws configure set default.region ap-southeast-2
aws ec2 describe-instances |find "PublicIPAddress" /i
aws configure set default.region ap-south-1
aws ec2 describe-instances |find "PublicIPAddress" /i
aws configure set default.region sa-east-1

aws ec2 describe-instances |find "PublicIPAddress" /i

Gary Williams

Gary Williams

IT Person | Veeam Vanguard | VMware vExpert | Windows admin | Docker fan | Spiceworks moderator | keeper of 3 cats | Avid Tea fan

Read More