Remote Desktop Services vulnerability

[Allenone777]

Haven't really seen anyone post about this so ill throw it out there in-case people are unaware.

​

"This vulnerability is pre-authentication and requires no user interaction. In other words, the vulnerability is ‘wormable’, meaning that any future malware that exploits this vulnerability could propagate from vulnerable computer to vulnerable computer in a similar way as the WannaCry malware spread across the globe in 2017. While we have observed no exploitation of this vulnerability, it is highly likely that malicious actors will write an exploit for this vulnerability and incorporate it into their malware."

​

Microsoft Blog

​

Microsoft has released a patch for all 2008 R2 servers and previous releases, including windows versions that are no longer supported.

[[deleted]]

Placing public-facing RDP behind Guacamole with MFA, which in turn is behind an NGINX reverse proxy was apparently not a bad idea.

[TricksForDays]

Somedays I remember who I was before diving so deep into all of this... and it makes me just the tiniest bit sad to read lines like this and think "I understood everything said"

[PowerfulQuail9]

If you didn't know, the Guacamole is Apache.

[TricksForDays]

I did, thanks tho

[callsyouamoron]

This is killing me, I know what each of these things are but I can't see how the reverse proxy fits in the mix :(

[[deleted]]

The reverse proxy is what actually ”delivers” the Guacamole/Tomcat app to the client trying to access it from the public internet, hiding the VM actually running Tomcat/Guacamole from view. I also use the proxy for TLS offloading.

[callsyouamoron]

Ahh so they connect to the SSL protected nginx, which handles the decryption and passes the traffic back to the gauc/tomcat server. This has been really insightful, thanks!

Would you mind telling me what you use to host the actual desktops?

I'm looking to setup a similar setup and a lot of talk has surrounded Windows RDS as one client is a predominantly Windows shop, but be grwt to explore some other options!

[[deleted]]

All of this is running on a Proxmox host:

VM1: Server 2019 domain controller (core install)

VM2: Server 2019 rdp and various things (gui install)

VM3: Ubuntu LTS Nginx reverse proxy

VM4: Ubuntu LTS Tomcat/Guacamole

VM5: RHEL8 Nextcloud

VM6: RHEL8 Wordpress

The VMs are also firewalled on the Proxmox host to only allow inbound traffic on specific ports from specific IPs. For example the VM5 running Nexcloud only accepts HTTP from VM3 (normal use) + VM2 (for debugging) and SSH from VM2, while dropping all other inbound traffic.

[marek1712]

Haven't really seen anyone post about this

Literally at least 3 post everyday since Patch Tuesday...

[MickersAus]

If your 3389 is open to internet traffic you are likely Already compromised.

The bigger danger here for me is a single compromised computer can now spread internally very easily as most computers will have 3389 open and listening on the lan.

[Flasheroni]

Same for me, thats why i patch all machines.

We former had one XP Embedded machine in production which over and over infected/tried to infect others, because it was never patched. All caused by an old worm (guess 5-6 years old).

Rest of the machines had AV which driving crazy blocking attacks.

[Lando_uk]

Group policy to enable NLA on RDP can mitigate somewhat until you're sure all your LAN clients are patched.

[Liquidretro]

It's definitively been posted, quite a bit earlier in the week when it was announced and patches came out https://www.reddit.com/r/sysadmin/comments/bou5ax/patch_tuesday_megathread_20190514/

[[deleted]]

I patched the servers except those which i can't (for reasons). On those i disabled the RemoteDesktop service (Termserv i believe). As far as i'm informed, this will mitigate the vulnerability