Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Kernel Code Execution Via HTTP Request In IIS On Windows

ma.ttias.be

Post reply on HN
Print view View original

131–140 of 201 posts

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#131

Post by cbrevik »

Khao wrote: post #29

I tried to send the bad curl request to our servers (test env, obviously) and I didn't get any error. It seems I should be getting "Requested Range Not Satisfiable" if the server is vulnerable and "The request has an invalid header name" if it's patched. I'm getting neither, simply a normal response HTTP 200 with the requested page. Anyone knows how to really test it? EDIT : It is indeed related to "Output Cache" set…

I just crashed a 2008 R2 server without a rule, just with "Enable Kernel Caching". Not sure if it is relevant, but I first added a rule for .png, and then removed it again. Still worked.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#132

Post by [deleted] »

drzaiusapelord wrote: post #77
skillsfirst wrote: post #33

But wait, I thought Micro$oft were lauded as having "got" security these days? Surely it is isn't so!

Lets not play the "my team is better than your team" hysterics, especially when we all had to do emergency patching for shellshock, heartbleed, samba, etc in the past couple months. Hell, sambra runs as root too. There's a lot of security stupidity out there. I'm still waiting for a unixy OS to be written in something like Rust.

[deleted]

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#133

Post by tracker1 »

zokier wrote: post #111
pjmlp wrote: post #89

Earlier quoted context omitted.

I fully agree that the idea doesn't make sense, specially when coupled with memory unsafe languages. Just wanted to make the point it isn't a Windows specific idea.

Deploying this sort of thing in production on the other hand seems to be a Windows specific idea.

IIS is marketted by MS as a VERY capable web server... typically out-performing other web servers by a large margin. The caching system for IIS has always been one of their crowning achievements, working better than most systems. Though, these days most will put a caching server(or cluster) in front of their operations servers. Just the same, it has worked pretty well. Though I predict this feature will be removed, or disabled by default in future versions.

I'm kind of surprised this issue wasn't discovered previously. Fortunately, there doesn't seem to be an exploit beyond crashing the server yet (which is bad enough). (sigh, kind of glad I'm in the process of migrating everything away from IIS).

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#134

Post by Khao »

cbrevik wrote: post #131
Khao wrote: post #29

I tried to send the bad curl request to our servers (test env, obviously) and I didn't get any error. It seems I should be getting "Requested Range Not Satisfiable" if the server is vulnerable and "The request has an invalid header name" if it's patched. I'm getting neither, simply a normal response HTTP 200 with the requested page. Anyone knows how to really test it? EDIT : It is indeed related to "Output Cache" set…

I just crashed a 2008 R2 server without a rule, just with "Enable Kernel Caching". Not sure if it is relevant, but I first added a rule for .png, and then removed it again. Still worked.

Can't edit the top comment anymore :( but it has been found that indeed no rules are needed to exploit this (my previous answer is outdated and wrong!)

If you can't afford to reboot your servers right now to install the patch, at least you can add this to your web.config and deploy your websites ASAP :

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#135

Post by __michaelg »

TazeTSchnitzel wrote: post #69
__michaelg wrote: post #3

The interesting take-away is the .sys suffix on the filename: Yes, Windows contains a device driver running in Kernel mode that cares about (IIS) HTTP traffic.

Windows also has a TCP/IP stack in the kernel. And a GUI stack (win32k.sys).

Yup, that's not that special though. All major OS have the TCP/IP stack in the kernel. And many (but not all) OS have at least parts of their GUI stacks in the kernel.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#136

Post by balakk »

shaunrussell wrote: post #101

Isn't a lot of government using IIS? How long before someone starts attacking their services with this? Is Azure vulnerable?

There's a chance the Azure load-balancer might filter out malicious requests; but I wouldn't know for sure. One of the boxes I have on Azure didn't crash.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#137

Post by hitgeek »

Khao wrote: post #29

I tried to send the bad curl request to our servers (test env, obviously) and I didn't get any error. It seems I should be getting "Requested Range Not Satisfiable" if the server is vulnerable and "The request has an invalid header name" if it's patched. I'm getting neither, simply a normal response HTTP 200 with the requested page. Anyone knows how to really test it? EDIT : It is indeed related to "Output Cache" set…

confirmed the above command crashed my win 2012 r2 server on AWS with no output cache rules. I found a png being served by my home page, and after 2 of the above requests the server crashed.

I installed the pending windows updates and after a restart the problem seems to be gone.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#139

Post by vdnkh »

Khao wrote: post #29

I tried to send the bad curl request to our servers (test env, obviously) and I didn't get any error. It seems I should be getting "Requested Range Not Satisfiable" if the server is vulnerable and "The request has an invalid header name" if it's patched. I'm getting neither, simply a normal response HTTP 200 with the requested page. Anyone knows how to really test it? EDIT : It is indeed related to "Output Cache" set…

I'm getting "Range requested not satisfiable" but no crash. Am I vulnerable or just doing it wrong?

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#140

Post by Cakez0r »

bontoJR wrote: post #8
0942v8653 wrote: post #6

Earlier quoted context omitted.

Sounds like the author understands the bug but does not understand why it allows remote code execution (which I don't understand either; once details are released it should be clarified).

That's a good point, because in the example we can clearly see how to check if a system is or not patched and that, using this attack, we can crash a Windows Server. The remote execution part is completely missing (fortunately), but I was wondering if this gives the admin rights on machine (I have absolutely no experience on Windows Server machines, so I don't know how it works in terms of services, permissions and r…

I would guess it involves spamming the server with specially crafted requests to fill memory with bytecode. After some trial and error (vast simplification) the request from the article could be used to divert the flow of execution into the bytecode spam, rather than causing DoS. The DoS is likely because flow of execution is being diverted to a random area of memory that doesn't contain anything executable, and so crashes instead.

The heap spraying is the missing puzzle piece from the article.

Post reply on HN