Remote Kernel Code Execution Via HTTP Request In IIS On Windows

Post by ftcHn » Wed, Apr 15, 2015, 11:24 PM UTC

amarraja wrote: post #56

Khao wrote: post #29

I tried to send the bad curl request to our servers (test env, obviously) and I didn't get any error. It seems I should be getting "Requested Range Not Satisfiable" if the server is vulnerable and "The request has an invalid header name" if it's patched. I'm getting neither, simply a normal response HTTP 200 with the requested page. Anyone knows how to really test it? EDIT : It is indeed related to "Output Cache" set…

Have tried on all our production facing domains (with and without CDN and get 200 responses also. One server (our development server) has proven vulnerable. Maybe reverse proxies are sanitizing the results? $ curl -v 10.100.0.40/ -H "Host: irrelevant" -H "Range: bytes=0-18446744073709551615" * About to connect() to 10.100.0.40 port 80 (#0) * Trying 10.100.0.40... * Adding handle: conn: 0x1d83278 * Adding handle: send…

Post by MichaelGG » Wed, Apr 15, 2015, 11:31 PM UTC

MichaelGG wrote: post #113

stephengillie wrote: post #59

The part that makes this really nasty is it doesn't just impact webservers. IIS is highly leveraged by other Microsoft technologies, everything from WSUS to SMTP to Exchange to Sharepoint are affected. In my environment, I estimate that 3/4 of my servers are vulnerable.

It's not IIS. It's HTTP.SYS. New configs have Powershel remote or WinRM. They use http.Sys and are vulnerable.

Post by 4ydx » Thu, Apr 16, 2015, 12:11 AM UTC

na85 wrote: post #162

psibi wrote: post #158

Earlier quoted context omitted.

Isn't systemd an user space process ?

Yes. It's still on track to becoming a second kernel.

Post by e12e » Thu, Apr 16, 2015, 12:51 AM UTC

mnw21cam wrote: post #28

cremno wrote: post #12

From the exploit code: memset(&serv_addr, '0', sizeof(serv_addr)); That doesn't seem to be correct. The digit character 0 is not the same as the null character ('\0'). Just write 0 or use `struct sockaddr_in serv_addr = { 0 };`.

It is common for code which is designed to trigger security bugs in systems to be published with several errors, so that skiddies can't just compile and run.

Post by e12e » Thu, Apr 16, 2015, 1:08 AM UTC

getsat wrote: post #166

h43k3r wrote: post #163

Earlier quoted context omitted.

I was wondering, is their a way to know the the type of webserver a website is using ? I mean can we do it using some kind of headers?

The "Server" response header will usually tell you but may omit a specific version depending on configuration. Use "curl -I whatever.com" to send a HEAD request and look at the headers in the response.

  nmap -T5 -sV --version-all -p 80,443 www.google.com
  Starting Nmap 6.00 ( http://nmap.org ) at 2015-04-16 03:02 CEST
  Nmap scan report for www.google.com (80.202.12.244)
  Host is up (0.0015s latency).
  Other addresses for www.google.com (not scanned): 
  (...)
  rDNS record for 80.202.12.244: cache.google.com
  PORT    STATE SERVICE  VERSION
  80/tcp  open  http     Google httpd 2.0 (GFE)
  443/tcp open  ssl/http Google httpd 2.0 (GFE)
  Service Info: OS: Linux; CPE: cpe:/o:linux:kernel

  nmap -T5 -sV --version-all -p 80,443 microsoft.com

  Starting Nmap 6.00 ( http://nmap.org ) at 2015-04-16 03:05 CEST
  Nmap scan report for microsoft.com (134.170.188.221)
  Host is up (0.18s latency).
  Other addresses for microsoft.com (not scanned): 
    134.170.185.46
  rDNS record for 134.170.188.221:  
    microsoftproductionstudios.org
  PORT    STATE SERVICE  VERSION
  80/tcp  open  http     Microsoft IIS httpd 8.5
  443/tcp open  ssl/http Microsoft IIS httpd 8.5
  Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows