5 ms·
HTTP.sys vulnerability test
- blueflow 12y agoSourcecode: https://github.com/xPaw/HTTPsys https://github.com/xPaw/HTTPsys @xPaw: Nice to see you on HN, too^^
- discreditable 12y agoCorrect me if I'm wrong, but wouldn't this site DoS vulnerable servers when it checks them?
- thesimon 12y agoTested a site which got reported as vulnerable and the site is still up, so I guess not :)
- cmdrfred 12y agoIt seems to be checking if the server is patched I got "Cannot discern patch status of willcipriano.com, and it doesn't appear to be using IIS. This most likely means it is not vulnerable." when I checked my own site. So likely it isn't attempting to use the exploit.
- drzaiusapelord 12y agoHow does this work? Do we have a working exploit now?
- Pwntastic 12y agoAFAIK a working crash has been released but not the code to actually exploit it.
- drzaiusapelord 12y agoAh, thanks I just saw this elsewhere. Looks like anyone with curl can BSOD an unpatched IIS server. Wow, this is pretty bad. I patched last night when I saw this in the news. Scary stuff.
- quotedmycode 12y agoAh, but it's not IIS, this is something less than IIS called HTTP.sys which is used by SSRS in sql 2008 or 2012. It's also used by some other windows services, so chances are you wouldn't even know you are running http.sys unless your software specifically mentioned it.
- logicallee 12y agoUncharitably, how it works is the author of this link doesn't want to scan all 2^32 hosts himself, so he's asking people for URL's to their windows servers so he can reach them directly. I can't imagine a scenario where I would submit a URL. EDIT: again, yes, there are no doubt thousands of bots doing port scans for this. In the uncharitable reading, this 'service' is how the author beats them to the punch.
- ams6110 12y agoIf you are running a vulnerable server, don't think you can just keep it a secret. Without question there are many thousands of bots looking for this already.
- xPaw 12y agoI guess saying that I don't log anything wouldn't matter to you.
- logicallee 12y agoyes, it would help :) It's just that out of the reasons someone would throw up this service in a few hours, you will understand that getting the name of hosts directly would be high on the list. I realize (as I stated) that this is a very uncharitable reading, and I'm kind of sorry that I stated it. You could simply be helping.
- xPaw 12y agoI made this service in a couple of hours because I had nothing better to do at the time :)
- stephengillie 12y agoMain thread: https://news.ycombinator.com/item?id=9380468 https://news.ycombinator.com/item?id=9380468
- jesalg 12y agoI'm getting "Cannot discern patch status of X" (VulnStatus::NOT_VULN_MS) on couple of sites I tried. Wondering if that's a good or a bad sign?
- chaosfox 12y agothat means the server response was something different from expected, either the server is not running IIS or it is running another (older ?)version.
- drzaiusapelord 12y agoThat seems to mean not running IIS, or IIS is behind something sanitizing the range field (load balancer, apache/nginx, proxy, IPS, etc)
- volumejunkie 11y ago"or IIS is behind something sanitizing the range field (load balancer, apache/nginx, proxy, IPS, etc)"... If this is the case, would that mean the server is not at risk? thanks!