Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Kernel Code Execution Via HTTP Request In IIS On Windows

ma.ttias.be

Post reply on HN
Print view View original

161–170 of 201 posts

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#161

Post by yuhong »

icebraining wrote: post #22
pjmlp wrote: post #18

Earlier quoted context omitted.

> webserver component running inside the kernel (yea right, great idea!) Actually an idea shared among many OS, including GNU/Linux. http://en.wikipedia.org/wiki/In-kernel_web_server

Well, of course you can make such a web server on any OS where you can modify or extend the kernel, but TUX is not exactly a popular or recommended solution. There's a reason the reference manual is dated 2001.

To be honest, the original version of http.sys (XP SP2/Server 2003) dates back to the same period.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#162

Post by na85 »

psibi wrote: post #158
na85 wrote: post #153

Earlier quoted context omitted.

Yep. Another reason folks are against systemd, as it also includes a baked-in http server. Systemd is also poised to become a veritable "second kernel" on linux systems and nobody seems to care enough to stop it.

Isn't systemd an user space process ?

Yes.

It's still on track to becoming a second kernel.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#164

Post by sudioStudio64 »

drzaiusapelord wrote: post #77
skillsfirst wrote: post #33

But wait, I thought Micro$oft were lauded as having "got" security these days? Surely it is isn't so!

Lets not play the "my team is better than your team" hysterics, especially when we all had to do emergency patching for shellshock, heartbleed, samba, etc in the past couple months. Hell, sambra runs as root too. There's a lot of security stupidity out there. I'm still waiting for a unixy OS to be written in something like Rust.

I know. Linux fan boys have the most intense selection bias. Check LWN to see this weeks distro security updates... somehow that doesn't count.

I'm with you on the rust kernel thing. All big piles of c code have the same problems.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#165

Post by ibre5041 »

It is not only about IIS. Various other SW use this API. For example Citrix Remote Receiver. And also various Antivirus Programs, use this HTTP interface – to be accessible from central management. Just try to execute “netsh show http urlacl” and you will see how many programs use it. Or you can use TCPView(Sysinternals) to see which ports are bound by "process" SYSTEM (pid 4).

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#166

Post by getsat »

h43k3r wrote: post #163
xPaw wrote: post #94

Made a online tool that tests for this vuln: https://lab.xpaw.me/MS15-034/?host=bing.com

I was wondering, is their a way to know the the type of webserver a website is using ? I mean can we do it using some kind of headers?

The "Server" response header will usually tell you but may omit a specific version depending on configuration.

Use "curl -I whatever.com" to send a HEAD request and look at the headers in the response.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#167

Post by wglb »

el_duderino wrote: post #141
cbrevik wrote: post #131

Earlier quoted context omitted.

I just crashed a 2008 R2 server without a rule, just with "Enable Kernel Caching". Not sure if it is relevant, but I first added a rule for .png, and then removed it again. Still worked.

Site to check: https://lab.xpaw.me/MS15-034

Sadly, only http is checked; won't work for https-only server.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#168

Post by Satchelmouth »

endian01 wrote: post #102
davman wrote: post #99

Best I could do on a freshly installed Win2k12 with IIS was: curl -v http://server-name/iis-85.png -H "Range: bytes=18-18446744073709551615" Run the curl twice and the bluescreen happens the second time. If I don't request the image then it doesn't work. I've not added any specific rules for output caching. Edit: The crash screen is very dull: http://imgur.com/MZ7VNHQ

Confirmed with Windows 8.1 Pro w/ IIS .. Same conditions, must run request twice for the .png (with the IIS rule set) Not like it matters, but I am toying with the first Range number.. (ie: 40-1884...615) Edit: crash @ 40-1884, oh-shit-reboot at 100-1884

Confirmed: I couldn't force a BS using the originally supplied range numbers, but changing it as per above to 100 did the trick (windows 2008 non R2 & 2012 R2)

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#170

Post by floatboth »

kstrauser wrote: post #156
easytiger wrote: post #78

Earlier quoted context omitted.

> http.sys which is a webserver component running inside the kernel (yea right, great idea!) I had no idea. Madness

> I had no idea. Madness They aren't the only ones who do this: https://www.freebsd.org/cgi/man.cgi?accf_http . All sorts of things are kernel-accelerated on modern operating systems, including lots of network operations. From that perspective, this is just one more and it could potentially have a huge benefit (like the same page served count on fewer hardware) for customers who need it. Obviously it's critically imp…

You haven't read the manpage, have you?

The idea is completely different.

accf_http is... here, just read the source: https://github.com/freebsd/freebsd/blob/master/sys/netinet/a... – if it sees something that looks like an HTTP request and delays returning to userspace until \r\n\r\n.

http.sys is an actual HTTP/1.x parser. That runs in ring 0.

Post reply on HN