91–100 of 201 posts
Earlier quoted context omitted.
Even if you have Kernel Caching enabled (as it is by default) if you haven't created any rule for it you're safe. I created a rule to cache all .png files and I changed the curl request to request a .png image on the server. I got a BSOD!
Can you please provide example of CURL syntax you used to produce this please?
Earlier quoted context omitted.
Yep. I tried curl -v to get all the raw headers line by line and the payload is there, and I also tried in telnet, both return a 200 page. I read the microsoft security bulletin and it says that your IIS server is protected if Kernal Caching is off, maybe that's why our servers are neither blocking the request nor crashing with the request.
I have tried this with kernel caching enabled. (kernel caching IS enabled by default from what I can see). Still unable to reproduce using curl.
But does it have a catchy name yet? I suggest: Long-range
Earlier quoted context omitted.
Not sure if I am not clear enough but yes, it 'hits the kernel and the context is low level'. As low as it can get on Windows.
[deleted]
The title was giving people the wrong impression about the severity of the vulnerability. This has nothing to do with "avoid giving people ideas" which would be stupid anyways.
Made a online tool that tests for this vuln: https://lab.xpaw.me/MS15-034/?host=bing.com
>A remote code execution vulnerability exists in the HTTP protocol stack [...] could execute arbitrary code in the context of the System account. SYSTEM is higher than admin. Using IIS on windows is like running a webserver as root on linux.
Lets not play the "my team is better than your team" hysterics, especially when we all had to do emergency patching for shellshock, heartbleed, samba, drupal, etc in the past couple months. Hell, sambra runs as root and that doesn't seem to outrage anyone.
I suspect such a patch would not get far, just as many ridiculed the TUX web server some fifteen years ago.
curl -v http://server-name/iis-85.png -H "Range: bytes=18-18446744073709551615"
Run the curl twice and the bluescreen happens the second time. If I don't request the image then it doesn't work.
I've not added any specific rules for output caching.
Edit: The crash screen is very dull:
Earlier quoted context omitted.
Even if you have Kernel Caching enabled (as it is by default) if you haven't created any rule for it you're safe. I created a rule to cache all .png files and I changed the curl request to request a .png image on the server. I got a BSOD!
Do you remember what the fault being reported on the BSOD was? (If you could take a screenshot/snapshot that'd be great.) I'm really curious to see what bugcheck is being hit.
Edit:
Actually sometimes you get additional info:
