Isn't a lot of government using IIS? How long before someone starts attacking their services with this?
Is Azure vulnerable?
Remote Kernel Code Execution Via HTTP Request In IIS On Windows
101–110 of 201 posts
Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows
#102Best I could do on a freshly installed Win2k12 with IIS was: curl -v http://server-name/iis-85.png -H "Range: bytes=18-18446744073709551615" Run the curl twice and the bluescreen happens the second time. If I don't request the image then it doesn't work. I've not added any specific rules for output caching. Edit: The crash screen is very dull: http://imgur.com/MZ7VNHQ
Confirmed with Windows 8.1 Pro w/ IIS ..
Same conditions, must run request twice for the .png (with the IIS rule set)
Not like it matters, but I am toying with the first Range number.. (ie: 40-1884...615)
Edit: crash @ 40-1884, oh-shit-reboot at 100-1884
Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows
#103I tried to send the bad curl request to our servers (test env, obviously) and I didn't get any error. It seems I should be getting "Requested Range Not Satisfiable" if the server is vulnerable and "The request has an invalid header name" if it's patched. I'm getting neither, simply a normal response HTTP 200 with the requested page. Anyone knows how to really test it? EDIT : It is indeed related to "Output Cache" set…
Proof of BSoD:
https://www.youtube.com/watch?v=BlBXREzsytc
Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows
#104Best I could do on a freshly installed Win2k12 with IIS was: curl -v http://server-name/iis-85.png -H "Range: bytes=18-18446744073709551615" Run the curl twice and the bluescreen happens the second time. If I don't request the image then it doesn't work. I've not added any specific rules for output caching. Edit: The crash screen is very dull: http://imgur.com/MZ7VNHQ
Did you have to configure any rule in the Output Caching or that's completely default values?
Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows
#105Best I could do on a freshly installed Win2k12 with IIS was: curl -v http://server-name/iis-85.png -H "Range: bytes=18-18446744073709551615" Run the curl twice and the bluescreen happens the second time. If I don't request the image then it doesn't work. I've not added any specific rules for output caching. Edit: The crash screen is very dull: http://imgur.com/MZ7VNHQ
What is also interesting is that if I do this instead:
curl -v http://10.243.0.221/iis-85.png -I -H "Range: bytes=18-18446744073709551615"
(added -I), then it doesn't cause the crash.
Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows
#106It seems to me that if you're running a vulnerable high-value server, the only option for you as an IT admin is to completely wipe the host hard drive and install everything from scratch--and even that may not be enough. Remote kernel code execution means an attacker could install malicious drivers, mess with device firmware, or do pretty much anything else the Windows kernel could do, no? It's a gamble to simply patch the server and hope you weren't already compromised; after all, how does one detect that remote kernel code execution occurred?
In a virtualized environment, I imagine blowing away any disks/volumes should be enough to recover from a potentially compromised system. That said, new Windows volumes (say, on EC2) should be created without inbound HTTP access, patched, and only then allowed to serve HTTP traffic.
Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows
#107After running windows update my machine went from responding with
HTTP Error 416. The requested range is not satisfiable.
to
HTTP Error 400. The request has an invalid header name.
Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows
#108Best I could do on a freshly installed Win2k12 with IIS was: curl -v http://server-name/iis-85.png -H "Range: bytes=18-18446744073709551615" Run the curl twice and the bluescreen happens the second time. If I don't request the image then it doesn't work. I've not added any specific rules for output caching. Edit: The crash screen is very dull: http://imgur.com/MZ7VNHQ
What is also interesting is that if I do this instead: curl -v http://10.243.0.221/iis-85.png -I -H "Range: bytes=18-18446744073709551615" (added -I), then it doesn't cause the crash.
-I sends a HEAD rather than a GET, so that's not too surprising.
Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows
#109Best I could do on a freshly installed Win2k12 with IIS was: curl -v http://server-name/iis-85.png -H "Range: bytes=18-18446744073709551615" Run the curl twice and the bluescreen happens the second time. If I don't request the image then it doesn't work. I've not added any specific rules for output caching. Edit: The crash screen is very dull: http://imgur.com/MZ7VNHQ
Did you have to configure any rule in the Output Caching or that's completely default values?
I initially configured rules (I was following your instructions) but I've now deleted the rules and still have the crash.
Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows
#110Earlier quoted context omitted.
Did you have to configure any rule in the Output Caching or that's completely default values?
I initially configured rules (I was following your instructions) but I've now deleted the rules and still have the crash.
Damnit. I'll double-check on my side too and update my answer accordingly. I don't want people to think they're safe if they're not!