Skip to content
PoC (DoS + scanner) for CVE-2020-0609 & CVE-2020-0610 - RD Gateway RCE
Python C++
Branch: master
Clone or download
Latest commit 96683a8 Jan 24, 2020
Type Name Latest commit message Commit time
Failed to load latest commit information.
old Added Python3 PoC Jan 24, 2020 Remove debug line Jan 24, 2020 Update Jan 24, 2020


Proof of Concept (Denial of Service + scanner) for CVE-2020-0609 and CVE-2020-0610.

These vulnerabilities allows an unauthenticated attacker to gain remote code execution with highest privileges via RD Gateway for RDP.

Please use for research and educational purpose only.


Make sure you have pyOpenSSL installed for python3.

usage: [-h] -M {check,dos} [-P PORT] host

positional arguments:
  host                  IP address of host

optional arguments:
  -h, --help            show this help message and exit
  -M {check,dos}, --mode {check,dos}
  -P PORT, --port PORT  UDP port of RDG, default: 3391


The vulnerabilities allows an unauthenticated attacker to write forward out-of-bound in the heap, by specifying an unchecked and arbitrary index parameter (0x00 - 0xFFFF). The data to write is also arbitrary with a length up to 1000 bytes at a time and a maximum of 4096 during one session.

If you would like to read more about the vulnerabilities, check this or read my latest tweets on Twitter with a PoC video as well.

What is RD Gateway?

RD Gateway acts as a proxy for RDP; i.e. between some internal servers and the internet, so you don't have to expose RDP directly to the internet.

Why BlueGate?

That was just the working title, and I couldn't come up with a better one at this stage.


  • Vulnerability scanner/checker DONE

  • Python implementation DONE

You can’t perform that action at this time.