Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Kernel Code Execution Via HTTP Request In IIS On Windows

ma.ttias.be

Post reply on HN
Print view View original

111–120 of 201 posts

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#111

Post by zokier »

pjmlp wrote: post #89
icebraining wrote: post #22

Earlier quoted context omitted.

Well, of course you can make such a web server on any OS where you can modify or extend the kernel, but TUX is not exactly a popular or recommended solution. There's a reason the reference manual is dated 2001.

I fully agree that the idea doesn't make sense, specially when coupled with memory unsafe languages. Just wanted to make the point it isn't a Windows specific idea.

Deploying this sort of thing in production on the other hand seems to be a Windows specific idea.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#112

Post by davman »

gkop wrote: post #108
davman wrote: post #105

Earlier quoted context omitted.

What is also interesting is that if I do this instead: curl -v http://10.243.0.221/iis-85.png -I -H "Range: bytes=18-18446744073709551615" (added -I), then it doesn't cause the crash.

-I sends a HEAD rather than a GET, so that's not too surprising.

Ahh yeah, that should have been obvious. Thanks!

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#113

Post by MichaelGG »

stephengillie wrote: post #59

The part that makes this really nasty is it doesn't just impact webservers. IIS is highly leveraged by other Microsoft technologies, everything from WSUS to SMTP to Exchange to Sharepoint are affected. In my environment, I estimate that 3/4 of my servers are vulnerable.

It's not IIS. It's HTTP.SYS. New configs have Powershel remote or WinRM. They use http.Sys and are vulnerable.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#114

Post by [deleted] »

eis wrote: post #4

Here the Microsoft Security Bulletin: https://technet.microsoft.com/library/security/ms15-034 I think the title is downplaying the severity of the bug. It's a remote code execution vulnerability in http.sys which is a webserver component running inside the kernel (yea right, great idea!) so you can get remote root via HTTP request. The blog quotes this correctly but I get the feeling the author didn't communicate it…

[deleted]

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#115

Post by pweissbrod »

pweissbrod wrote: post #42
Khao wrote: post #29

I tried to send the bad curl request to our servers (test env, obviously) and I didn't get any error. It seems I should be getting "Requested Range Not Satisfiable" if the server is vulnerable and "The request has an invalid header name" if it's patched. I'm getting neither, simply a normal response HTTP 200 with the requested page. Anyone knows how to really test it? EDIT : It is indeed related to "Output Cache" set…

+1. Also tried this on multiple web servers. Unable to reproduce under several different scenarios using curl

EDIT: adding the output caching rules confirms it. BSOD :(

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#116

Post by artanis0 »

davman wrote: post #109
Khao wrote: post #104

Earlier quoted context omitted.

Did you have to configure any rule in the Output Caching or that's completely default values?

I initially configured rules (I was following your instructions) but I've now deleted the rules and still have the crash.

Can confirm. No Output Caching rules defined, I am still able to reproduce crash. [EDIT] What is handy is that it appears that disabling "Enable kernel cache" takes effect immediately. No iisreset or server reboot required in my testing environment.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#117

Post by eqkosch »

Khao wrote: post #29

I tried to send the bad curl request to our servers (test env, obviously) and I didn't get any error. It seems I should be getting "Requested Range Not Satisfiable" if the server is vulnerable and "The request has an invalid header name" if it's patched. I'm getting neither, simply a normal response HTTP 200 with the requested page. Anyone knows how to really test it? EDIT : It is indeed related to "Output Cache" set…

As all our servers are behind a traffic manager product like F5/ZXTM I'm experimenting with removing the range header so it never reaches the webserver as some app's rely on kernel mode caching to achieve performance.

Also my tests seem to indicate that just having kernel mode caching enabled even if you dont have any rules still seem to cause a BSOD.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#118

Post by davman »

artanis0 wrote: post #116
davman wrote: post #109

Earlier quoted context omitted.

I initially configured rules (I was following your instructions) but I've now deleted the rules and still have the crash.

Can confirm. No Output Caching rules defined, I am still able to reproduce crash. [EDIT] What is handy is that it appears that disabling "Enable kernel cache" takes effect immediately. No iisreset or server reboot required in my testing environment.

Yes, unticking that checkbox works for me instantly.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#119

Post by spork1 »

xorcist wrote: post #98
drzaiusapelord wrote: post #85

Earlier quoted context omitted.

Lets not play the "my team is better than your team" hysterics, especially when we all had to do emergency patching for shellshock, heartbleed, samba, drupal, etc in the past couple months. Hell, sambra runs as root and that doesn't seem to outrage anyone.

Samba doesn't run as a kernel module though. I suspect such a patch would not get far, just as many ridiculed the TUX web server some fifteen years ago.

no, but cifs does; https://www.kernel.org/doc/readme/Documentation-filesystems-...

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#120

Post by Khao »

eqkosch wrote: post #117
Khao wrote: post #29

I tried to send the bad curl request to our servers (test env, obviously) and I didn't get any error. It seems I should be getting "Requested Range Not Satisfiable" if the server is vulnerable and "The request has an invalid header name" if it's patched. I'm getting neither, simply a normal response HTTP 200 with the requested page. Anyone knows how to really test it? EDIT : It is indeed related to "Output Cache" set…

As all our servers are behind a traffic manager product like F5/ZXTM I'm experimenting with removing the range header so it never reaches the webserver as some app's rely on kernel mode caching to achieve performance. Also my tests seem to indicate that just having kernel mode caching enabled even if you dont have any rules still seem to cause a BSOD.

You're right! Even with no rule having kernal caching enabled will crash it! I think IIS assumes it should cache all static content even when there are no rules specifically for them. Somehow I can't edit my comment anymore but I'll leave this here :

EVEN WITH NO RULES, YOU ARE VULNERABLE! My previous answer has been proven to be wrong!

Post reply on HN