Remote Kernel Code Execution Via HTTP Request In IIS On Windows

Post by el_duderino » Wed, Apr 15, 2015, 6:01 PM UTC

cbrevik wrote: post #131

Khao wrote: post #29

I tried to send the bad curl request to our servers (test env, obviously) and I didn't get any error. It seems I should be getting "Requested Range Not Satisfiable" if the server is vulnerable and "The request has an invalid header name" if it's patched. I'm getting neither, simply a normal response HTTP 200 with the requested page. Anyone knows how to really test it? EDIT : It is indeed related to "Output Cache" set…

I just crashed a 2008 R2 server without a rule, just with "Enable Kernel Caching". Not sure if it is relevant, but I first added a rule for .png, and then removed it again. Still worked.

Post by el_duderino » Wed, Apr 15, 2015, 6:12 PM UTC

51Cards wrote: post #96

xPaw wrote: post #94

Made a online tool that tests for this vuln: https://lab.xpaw.me/MS15-034/?host=bing.com

Tested against three servers, one patched and two not. Small test but it correctly identified which was which.

Post by kennethgeiler » Wed, Apr 15, 2015, 6:23 PM UTC

Post by pslam » Wed, Apr 15, 2015, 6:24 PM UTC

    if (inclusiveEnd + 1 > size) {
        return ERR_INVALID;
    }

    if (size  size - offset) {
        ... // range violated
    }

Post by thefreeman » Wed, Apr 15, 2015, 6:37 PM UTC

maxerickson wrote: post #83

est wrote: post #65

Earlier quoted context omitted.

SYSTEM account is far more powerful than Administrator, especially after Win2008

This page makes it sound easy to go from the one to the other: http://blogs.technet.com/b/askds/archive/2008/10/22/getting-... (not as easy as earlier versions, but still)