Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Kernel Code Execution Via HTTP Request In IIS On Windows

ma.ttias.be

Post reply on HN
Print view View original

51–60 of 201 posts

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#51

Post by userbinator »

jsmeaton wrote: post #34
detaro wrote: post #9

Earlier quoted context omitted.

According to comments in the other discussion here about this it might not IIS be only, because that kernel component is used for other HTTP services as well: https://news.ycombinator.com/item?id=9378449

Yes, but the user/server would have to be running a web server for it to be hit. Usually, that's IIS. But not every windows machine runs a web server.

Nor is every machine's port 80 publicly reachable. Everyone behind a NAT won't be, for example (unless they've explicitly forwarded the port for the purposes of running such a server.)

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#52

Post by MichaelGG »

jsmeaton wrote: post #34
detaro wrote: post #9

Earlier quoted context omitted.

According to comments in the other discussion here about this it might not IIS be only, because that kernel component is used for other HTTP services as well: https://news.ycombinator.com/item?id=9378449

Yes, but the user/server would have to be running a web server for it to be hit. Usually, that's IIS. But not every windows machine runs a web server.

Nope. WinRM or Power shell seem to use it too. Enabled by default. (Just created a 2012R2 server last night.)

Plus if you have reservations created with HTTP.SYS, your app doesn't even have to be running. A friend tried turning off IIS, but port 80 would still respond.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#53

Post by icebraining »

tribaal wrote: post #24
IgorPartola wrote: post #19

Earlier quoted context omitted.

To be fair, http://en.wikipedia.org/wiki/TUX_web_server . Having said that, this is huge. This is way worse than Heartbleed for the IIS crowd.

And how much internet-facing web content is served with this toy webserver exactly? That's what I thought, none (except maybe the author's blog? wild guess).

except maybe the author's blog? wild guess

Nope, Ingo Mólnar uses Google+ for his occasional blogging (though the last post seems to be from 2013).

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#55

Post by IgorPartola »

psibi wrote: post #23
IgorPartola wrote: post #19

Earlier quoted context omitted.

To be fair, http://en.wikipedia.org/wiki/TUX_web_server . Having said that, this is huge. This is way worse than Heartbleed for the IIS crowd.

From the linked page: "TUX has never been an integrated part of the official Linux kernel, although it has been shipped in some distributions, notably Red Hat, SuSE and Fedora."

Sure. My point is that Microsoft isn't the entity to put a web server (or at least components of one) in the kernel. Some may look at it and laugh about how silly that idea is, but in reality many have tried it.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#56

Post by amarraja »

Khao wrote: post #29

I tried to send the bad curl request to our servers (test env, obviously) and I didn't get any error. It seems I should be getting "Requested Range Not Satisfiable" if the server is vulnerable and "The request has an invalid header name" if it's patched. I'm getting neither, simply a normal response HTTP 200 with the requested page. Anyone knows how to really test it? EDIT : It is indeed related to "Output Cache" set…

Have tried on all our production facing domains (with and without CDN and get 200 responses also.

One server (our development server) has proven vulnerable. Maybe reverse proxies are sanitizing the results?

    $ curl -v 10.100.0.40/ -H "Host: irrelevant" -H "Range: bytes=0-18446744073709551615"
    * About to connect() to 10.100.0.40 port 80 (#0)
    *   Trying 10.100.0.40...
    * Adding handle: conn: 0x1d83278
    * Adding handle: send: 0
    * Adding handle: recv: 0
    * Curl_addHandleToPipeline: length: 1
    * - Conn 0 (0x1d83278) send_pipe: 1, recv_pipe: 0
    * Connected to 10.100.0.40 (10.100.0.40) port 80 (#0)
    > GET / HTTP/1.1
    > User-Agent: curl/7.30.0
    > Accept: */*
    > Host: irrelevant
    > Range: bytes=0-18446744073709551615
    >

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#57

Post by tribaal »

icebraining wrote: post #53
tribaal wrote: post #24

Earlier quoted context omitted.

And how much internet-facing web content is served with this toy webserver exactly? That's what I thought, none (except maybe the author's blog? wild guess).

except maybe the author's blog? wild guess Nope, Ingo Mólnar uses Google+ for his occasional blogging (though the last post seems to be from 2013).

Haha, I knew somebody would actually look it up :)

Thank you!

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#59

Post by stephengillie »

The part that makes this really nasty is it doesn't just impact webservers. IIS is highly leveraged by other Microsoft technologies, everything from WSUS to SMTP to Exchange to Sharepoint are affected. In my environment, I estimate that 3/4 of my servers are vulnerable.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#60

Post by stephengillie »

comice wrote: post #13
__michaelg wrote: post #3

The interesting take-away is the .sys suffix on the filename: Yes, Windows contains a device driver running in Kernel mode that cares about (IIS) HTTP traffic.

goodness me yes. It appears to be a kernel-mode http parser: http://www.microsoft.com/technet/prodtechnol/WindowsServer20... is that really the only way MS could make IIS fast enough? See also https://en.wikipedia.org/wiki/TUX_web_server

HTTP.sys feeds directly into the IIS Request Queue. When that queue overruns, (i.e. too many pending requests that are waiting on a backend NAS or other resource) it's HTTP.sys providing the 503 error, not IIS.
Post reply on HN