PoC for the Remote Desktop Gateway vulnerability - CVE-2020-0609 & CVE-2020-0610. Thanks to ollypwn for pointing out my silly mistake!
I'm using a patched version of pydtls as the original repository wouldn't build properly.
cd pydtls
sudo python setup.py install
A PoC for the DoS attack can be found in dos.py. This essentially crashes the Remote Desktop Gateway service. The initial PoC can be found in the commits or here.
python dos.py 192.168.8.133 3391
Before:
After:
A scanner that is able to determin whether the target is vulnerable or not. The script can be found in check.py. The timeout is set to 3 seconds by default but can be adjusted in the source code.
python check.py 192.168.8.134 3391
It says either Vulnerable! or Not vulnerable!.