Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Kernel Code Execution Via HTTP Request In IIS On Windows

ma.ttias.be

Post reply on HN
Print view View original

11–20 of 201 posts

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#11

Post by Mojah »

bontoJR wrote: post #8
0942v8653 wrote: post #6

Earlier quoted context omitted.

Sounds like the author understands the bug but does not understand why it allows remote code execution (which I don't understand either; once details are released it should be clarified).

That's a good point, because in the example we can clearly see how to check if a system is or not patched and that, using this attack, we can crash a Windows Server. The remote execution part is completely missing (fortunately), but I was wondering if this gives the admin rights on machine (I have absolutely no experience on Windows Server machines, so I don't know how it works in terms of services, permissions and r…

It would allow the same privileges as the user which is running IIS, usually a "system" account - which equals Administrative privileges.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#13

Post by comice »

__michaelg wrote: post #3

The interesting take-away is the .sys suffix on the filename: Yes, Windows contains a device driver running in Kernel mode that cares about (IIS) HTTP traffic.

goodness me yes. It appears to be a kernel-mode http parser:

http://www.microsoft.com/technet/prodtechnol/WindowsServer20...

is that really the only way MS could make IIS fast enough?

See also https://en.wikipedia.org/wiki/TUX_web_server

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#14

Post by benjamincburns »

cremno wrote: post #12

From the exploit code: memset(&serv_addr, '0', sizeof(serv_addr)); That doesn't seem to be correct. The digit character 0 is not the same as the null character ('\0'). Just write 0 or use `struct sockaddr_in serv_addr = { 0 };`.

ASCII NUL is indeed 0x0.

http://en.m.wikipedia.org/wiki/Null_character http://www.bibase.com/images/ascii.gif

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#15

Post by eis »

Mojah wrote: post #11
bontoJR wrote: post #8

Earlier quoted context omitted.

That's a good point, because in the example we can clearly see how to check if a system is or not patched and that, using this attack, we can crash a Windows Server. The remote execution part is completely missing (fortunately), but I was wondering if this gives the admin rights on machine (I have absolutely no experience on Windows Server machines, so I don't know how it works in terms of services, permissions and r…

It would allow the same privileges as the user which is running IIS, usually a "system" account - which equals Administrative privileges.

You two seem to not understand still, please re-read my comment.

The point is this is allowing code execution within the kernel of windows. It doesn't even reach the IIS userland process.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#16

Post by masklinn »

benjamincburns wrote: post #14
cremno wrote: post #12

From the exploit code: memset(&serv_addr, '0', sizeof(serv_addr)); That doesn't seem to be correct. The digit character 0 is not the same as the null character ('\0'). Just write 0 or use `struct sockaddr_in serv_addr = { 0 };`.

ASCII NUL is indeed 0x0. http://en.m.wikipedia.org/wiki/Null_character http://www.bibase.com/images/ascii.gif

But '0' is not ascii NUL (0x00), it's ascii 0 (0x30).

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#17

Post by ehmmm »

benjamincburns wrote: post #14
cremno wrote: post #12

From the exploit code: memset(&serv_addr, '0', sizeof(serv_addr)); That doesn't seem to be correct. The digit character 0 is not the same as the null character ('\0'). Just write 0 or use `struct sockaddr_in serv_addr = { 0 };`.

ASCII NUL is indeed 0x0. http://en.m.wikipedia.org/wiki/Null_character http://www.bibase.com/images/ascii.gif

'0' != '\0'

'0' == 48

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#18

Post by pjmlp »

eis wrote: post #4

Here the Microsoft Security Bulletin: https://technet.microsoft.com/library/security/ms15-034 I think the title is downplaying the severity of the bug. It's a remote code execution vulnerability in http.sys which is a webserver component running inside the kernel (yea right, great idea!) so you can get remote root via HTTP request. The blog quotes this correctly but I get the feeling the author didn't communicate it…

> webserver component running inside the kernel (yea right, great idea!)

Actually an idea shared among many OS, including GNU/Linux.

http://en.wikipedia.org/wiki/In-kernel_web_server

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#19

Post by IgorPartola »

eis wrote: post #4

Here the Microsoft Security Bulletin: https://technet.microsoft.com/library/security/ms15-034 I think the title is downplaying the severity of the bug. It's a remote code execution vulnerability in http.sys which is a webserver component running inside the kernel (yea right, great idea!) so you can get remote root via HTTP request. The blog quotes this correctly but I get the feeling the author didn't communicate it…

To be fair, http://en.wikipedia.org/wiki/TUX_web_server. Having said that, this is huge. This is way worse than Heartbleed for the IIS crowd.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#20

Post by eis »

masklinn wrote: post #16
benjamincburns wrote: post #14

Earlier quoted context omitted.

ASCII NUL is indeed 0x0. http://en.m.wikipedia.org/wiki/Null_character http://www.bibase.com/images/ascii.gif

But '0' is not ascii NUL (0x00), it's ascii 0 (0x30).

Additionally there are a bunch of other things very wrong with the exploit code.

If the connect() fails, it will use file descriptor 1 which is usually stdout and write the request to it and try to read from it.

And there is a problem with strstr() not getting a null terminated string (if the stack memory for recvBuff wasn't automatically zero'd out which some compilers can do).

Why do these people bother writing the exploit in C? A curl one liner is good enough.

Also the check for 'The request has an invalid header name' seems dubious to me because a proxy in front would likely return a different error (the header name is not invalid but rather the range not satisfyable).

Post reply on HN