Find your exposed Microsoft RDP services

CVE-2019-0708 exploits an unauthenticated remote code execution vulnerability in Microsoft RDP service. As the patch is out, you should apply it as quickly as possible before bad guys start to exploit it.

But what if you don’t know where are your servers to patch?

Most companies have hard time locating and keeping an inventory of all their assets. Especially those exposed on the Internet. Another cause is the explosion of shadow IT or shadow cloud. In this blog post, we will describe how to locate them by querying our data.

Identify your network blocks

If you are a mature company, you probably already have a list of all your subnets (being your own datacenters or some possibly outsourced). That’s great. But what if you don’t?

You could use our inetnum category of data to first build your list of subnets you will be able to use afterwards to search for open RDP services. The subnet field is the way to go for such a use case. Another possibility, if you are a big company, is to get the list of your own AS numbers by listing asn field values.

Some requests you can enter in our search engine (or via our API) to achieve this goal:

category:inetnum netname:"your netname"
category:inetnum organization:"your organization"
category:inetnum domain:your_domain.com
category:inetnum asn:ASyour_number
category:inetnum ip:some_of_your_ips

Note: search filters are only available when you have access to the Search API. These APIs are available starting from “Dragonfly View” [1].

As a customer of our solution, you could also use the new (currently BETA) function called -wildcard:

category:inetnum -wildcard:netname,*your_organization*
category:inetnum -wildcard:organization,*your_organization*

What will most interest you is the value of the field subnet. By listing all of them, you will be able to go to the next step to find open RDP services.

Note: search functions are only available for “Entreprise Views” [1]. The -wildcard function searches only on the previous day of results by default. To search from older times, use the -dayago function like: -dayago:4 to search 4 days ago.

Sample result for inetnum category:

Search by using the synscan category of information

While performing SYN scans over the full IPv4 address space, we also perform reliable remote Operating System (OS) identification. You may base your following searches on such data to identify open ports 3389/tcp with Windows OS running on your subnets as identified during the previous step.

category:synscan ip:93.184.216.0/24 os:Windows port:3389
category:synscan asn:ASyour_number os:Windows port:3389
category:synscan organization:"your organization" os:Windows port:3389

Note: the CIDR search (like the Search API, which allows the use of these search filters) is available only starting from the “Dragonfly View” as described at [1].

Note2: values are case sensitive in all searches, so be sure to write Windows with a capital W and not windows. That would yeld no result.

Sample result for synscan category:

Search by using the datascan category of information

The previous method will eventually return matches, but the best way is to leverage the datascan category. synscan entries don’t have information about the application layer, while datascan entries do. In fact, we are identifying the application layer protocol and you can perform searches directly using the protocol field:

category:datascan protocol:rdp ip:93.184.216.0/24 os:Windows
category:datascan protocol:rdp asn:ASyour_number os:Windows
category:datascan protocol:rdp organization:"your organization" os:Windows

Note: we may have some results for RDP services not listening on usual port 3389/tcp thanks to that protocol identification.

Now that you have a complete list of all your subnets and AS numbers, you can refine the search to discover your Internet exposed assets.

Search using DNS resolution enrichments within the datascan category of information

As we perform numerous DNS resolutions to enrich our data, you may also search your exposed assets by querying related fields like:

  • domain: the domain name with only one “.” character;
  • subdomains: one of your subdomains, those with multiple “.” characters;
  • hostname: the fully qualified domain name;
  • reverse: or use the reverse fully qualified domain name.
category:datascan protocol:rdp domain:your_domain.com
category:datascan protocol:rdp subdomains:sub.your_domain.com
category:datascan protocol:rdp hostname:www.sub.your_domain.com
category:datascan protocol:rdp reverse:ptr.your_domain.com

Sample result:

The admin tag

And if you want to put such kind of surveillance into practice, you may also directly use tag:admin filter. It will match for any remote admin protocols used to perform administrative tasks like RDP, SSH or telnet (list not complete).

And sometimes, administrative interfaces are vulnerable to some CVEs…

Sample result:

Conclusion

As the CVE-2019-0708 is claimed to be wormable, we urge our customers to perform described searches. If you are not yet a customer, take a look at our pricing page [1] and don’t hesitate to contact us at sales[at]onyphe.io for any enquiry.

[1] https://www.onyphe.io/pricing/

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.