4 ms·
How does this work? Do we have a working exploit now?
by drzaiusapelord 12y ago
How does this work? Do we have a working exploit now?
- Pwntastic 12y agoAFAIK a working crash has been released but not the code to actually exploit it.
- drzaiusapelord 12y agoAh, thanks I just saw this elsewhere. Looks like anyone with curl can BSOD an unpatched IIS server. Wow, this is pretty bad. I patched last night when I saw this in the news. Scary stuff.
- quotedmycode 12y agoAh, but it's not IIS, this is something less than IIS called HTTP.sys which is used by SSRS in sql 2008 or 2012. It's also used by some other windows services, so chances are you wouldn't even know you are running http.sys unless your software specifically mentioned it.
- logicallee 12y agoUncharitably, how it works is the author of this link doesn't want to scan all 2^32 hosts himself, so he's asking people for URL's to their windows servers so he can reach them directly. I can't imagine a scenario where I would submit a URL. EDIT: again, yes, there are no doubt thousands of bots doing port scans for this. In the uncharitable reading, this 'service' is how the author beats them to the punch.
- ams6110 12y agoIf you are running a vulnerable server, don't think you can just keep it a secret. Without question there are many thousands of bots looking for this already.
- xPaw 12y agoI guess saying that I don't log anything wouldn't matter to you.
- logicallee 12y agoyes, it would help :) It's just that out of the reasons someone would throw up this service in a few hours, you will understand that getting the name of hosts directly would be high on the list. I realize (as I stated) that this is a very uncharitable reading, and I'm kind of sorry that I stated it. You could simply be helping.
- xPaw 12y agoI made this service in a couple of hours because I had nothing better to do at the time :)