I found that the research data for Remote Code Execution – Windows Remote Desktop Licensing Service “MadLicense” (CVE-2024-38077), which I wrote about 3 weeks ago, was deleted. Both on GitHub and on Google Sites.

And what does this all mean? 🤔 Who knows. 🤷‍♂️ Considering that it disappeared on two platforms at once, it was probably deleted by the Chinese researchers themselves. Why did they do this? Perhaps they established a dialogue with Microsoft and MS asked them to remove everything from the public (which, of course, is stupid – the Internet remembers everything). Perhaps someone else asked them to do this. 🫡 Another reason to pay attention to this vulnerability.

На русском

Remote Code Execution – Windows Remote Desktop Licensing Service “MadLicense” (CVE-2024-38077). The vulnerability was fixed in July Patch Tuesday. An unauthenticated attacker can get RCE by sending messages to RDL. CVSS 9.8. Updates for Win Server from 2008 to 2022.

What is the RDL service? By default, Remote Desktop Services allow only two simultaneous RDP connections to a Windows server. If you need more, you need to purchase additional licenses. These licenses are managed by the RDL service. Often, admins enable RDL on Win servers where it is not needed. 🙄🤷‍♂️

On August 9, a write-up and PoC for Server 2025 were posted on GitHub. So far, it’s only Python pseudo-code without critical parts.

They write that 170,000 hosts with RDL are accessible from the Internet. 🤷‍♂️ And there should be countless of them on intranets.

❗️ Looks like a long-running trending vulnerability story.

Researchers promise us BadLicense and DeadLicense as well. 😉

На русском