Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Kernel Code Execution Via HTTP Request In IIS On Windows

ma.ttias.be

Post reply on HN
Print view View original

151–160 of 201 posts

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#151

Post by Khao »

mandeepj wrote: post #150
Khao wrote: post #134

Earlier quoted context omitted.

Can't edit the top comment anymore :( but it has been found that indeed no rules are needed to exploit this (my previous answer is outdated and wrong!) If you can't afford to reboot your servers right now to install the patch, at least you can add this to your web.config and deploy your websites ASAP :

Instead of updating every single web.config of your website I think it is better to just update once and for all by updating machine.config. What you say ?

Seems like you can't add a system.webServer node on the machine.config, but you could add it to applicationHost.config (source: http://www.iis.net/learn/get-started/planning-your-iis-archi... ) so yes, that would be faster. You have to make sure that none of your web.config files override that setting though!

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#152

Post by maxerickson »

thefreeman wrote: post #149
maxerickson wrote: post #83

Earlier quoted context omitted.

This page makes it sound easy to go from the one to the other: http://blogs.technet.com/b/askds/archive/2008/10/22/getting-... (not as easy as earlier versions, but still)

that is from 7 years ago...

Sure. I read est as saying that Administrators are more restricted in Server 2008 than they were in earlier Windows versions. I assumed they were talking about the relatively well known technique of scheduling a cmd shell to run as SYSTEM, which that blog mentions being prevented in Server 2008.

But you would still expect an Administrator account to be able to load files onto the system, so obtaining the SYSTEM shell remains pretty easy.

The distinction between SYSTEM and Administrator was a convenience, and if I understood est correctly, it still is.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#153

Post by na85 »

IgorPartola wrote: post #55
psibi wrote: post #23

Earlier quoted context omitted.

From the linked page: "TUX has never been an integrated part of the official Linux kernel, although it has been shipped in some distributions, notably Red Hat, SuSE and Fedora."

Sure. My point is that Microsoft isn't the entity to put a web server (or at least components of one) in the kernel. Some may look at it and laugh about how silly that idea is, but in reality many have tried it.

Yep. Another reason folks are against systemd, as it also includes a baked-in http server. Systemd is also poised to become a veritable "second kernel" on linux systems and nobody seems to care enough to stop it.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#154

Post by trentnelson »

davman wrote: post #100
trentnelson wrote: post #81

Earlier quoted context omitted.

Do you remember what the fault being reported on the BSOD was? (If you could take a screenshot/snapshot that'd be great.) I'm really curious to see what bugcheck is being hit.

I just get the standard "Your PC ran into a problem and needs to restart. We're just collecting some error info, and then we'll restart for you." Edit: Actually sometimes you get additional info: http://imgur.com/zRHUV8o

Ah, page fault in non-paged area! Interesting.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#156

Post by kstrauser »

easytiger wrote: post #78
eis wrote: post #4

Here the Microsoft Security Bulletin: https://technet.microsoft.com/library/security/ms15-034 I think the title is downplaying the severity of the bug. It's a remote code execution vulnerability in http.sys which is a webserver component running inside the kernel (yea right, great idea!) so you can get remote root via HTTP request. The blog quotes this correctly but I get the feeling the author didn't communicate it…

> http.sys which is a webserver component running inside the kernel (yea right, great idea!) I had no idea. Madness

> I had no idea. Madness

They aren't the only ones who do this: https://www.freebsd.org/cgi/man.cgi?accf_http . All sorts of things are kernel-accelerated on modern operating systems, including lots of network operations. From that perspective, this is just one more and it could potentially have a huge benefit (like the same page served count on fewer hardware) for customers who need it.

Obviously it's critically important that MS get this right if they're going to offer it at all, but that's pretty much a tautology when talking about kernels and core OS functionality. Judge them on a bad implementation, not on any inherent badness in the idea.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#157

Post by JonBons »

Khao wrote: post #151
mandeepj wrote: post #150

Earlier quoted context omitted.

Instead of updating every single web.config of your website I think it is better to just update once and for all by updating machine.config. What you say ?

Seems like you can't add a system.webServer node on the machine.config, but you could add it to applicationHost.config (source: http://www.iis.net/learn/get-started/planning-your-iis-archi... ) so yes, that would be faster. You have to make sure that none of your web.config files override that setting though!

I believe IIS supports locking attributes (source: http://www.iis.net/learn/get-started/planning-for-security/h...) so you should be able to lock at applicationHost.config and restrict further modifications. (I'm testing this now)

EDIT:

It causes a config error when a lock violation occurs which means the site gets an error 500 so its not an ideal fix.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#158

Post by psibi »

na85 wrote: post #153
IgorPartola wrote: post #55

Earlier quoted context omitted.

Sure. My point is that Microsoft isn't the entity to put a web server (or at least components of one) in the kernel. Some may look at it and laugh about how silly that idea is, but in reality many have tried it.

Yep. Another reason folks are against systemd, as it also includes a baked-in http server. Systemd is also poised to become a veritable "second kernel" on linux systems and nobody seems to care enough to stop it.

Isn't systemd an user space process ?

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#159

Post by eeZi »

balakk wrote: post #136
shaunrussell wrote: post #101

Isn't a lot of government using IIS? How long before someone starts attacking their services with this? Is Azure vulnerable?

There's a chance the Azure load-balancer might filter out malicious requests; but I wouldn't know for sure. One of the boxes I have on Azure didn't crash.

Probably patched already.
Post reply on HN