News for hackers. Stuff that matters.

A comment on Remote Kernel Code Execution Via HTTP Request In IIS On Windows.

Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by Khao on Wednesday April 15, 2015 @09:44AM (#9380889)
I tried to send the bad curl request to our servers (test env, obviously) and I didn't get any error. It seems I should be getting "Requested Range Not Satisfiable" if the server is vulnerable and "The request has an invalid header name" if it's patched. I'm getting neither, simply a normal response HTTP 200 with the requested page. Anyone knows how to really test it?

EDIT : It is indeed related to "Output Cache" setting in IIS as I said I was suspecting in another comment. I managed to crash our servers by going to IIS Management, select the website I wanted to test, go to Output Caching, enable the feature AND also add a rule (I added a rule for .png just to test). If you have NO rules it is the same as having the feature disabled so you are safe. If you add a rule and check "Enable Kernal Caching" you are vulnerable!

EDIT 2 : As some have asked, this is the command I used to crash our test server. I tested it after having created a new Output Caching rule to cache all .png files in kernel mode.

curl -v http://example.com/image.png -H "Range: bytes=18-18446744073709551615"

I didn't take a screenshot of the BSOD and I don't plan on crashing our test env a second time today because people are using it (I tested it early enough that not a lot of people were at the office yet).

[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by cbrevik on Wednesday April 15, 2015 @01:19PM (#9382512)
I just crashed a 2008 R2 server without a rule, just with "Enable Kernel Caching". Not sure if it is relevant, but I first added a rule for .png, and then removed it again. Still worked.
[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by Khao on Wednesday April 15, 2015 @01:23PM (#9382538)
Can't edit the top comment anymore :( but it has been found that indeed no rules are needed to exploit this (my previous answer is outdated and wrong!)

If you can't afford to reboot your servers right now to install the patch, at least you can add this to your web.config and deploy your websites ASAP :

<configuration> <system.webServer> <caching enableKernelCache="false"/> </system.webServer> </configuration>

[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by mandeepj on Wednesday April 15, 2015 @02:47PM (#9383194)
Instead of updating every single web.config of your website I think it is better to just update once and for all by updating machine.config. What you say ?
[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by Khao on Wednesday April 15, 2015 @02:54PM (#9383251)
Seems like you can't add a system.webServer node on the machine.config, but you could add it to applicationHost.config (source: http://www.iis.net/learn/get-started/planning-your-iis-archi... ) so yes, that would be faster. You have to make sure that none of your web.config files override that setting though!
[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by JonBons on Wednesday April 15, 2015 @04:19PM (#9383794)
I believe IIS supports locking attributes (source: http://www.iis.net/learn/get-started/planning-for-security/h...) so you should be able to lock at applicationHost.config and restrict further modifications. (I'm testing this now)

EDIT:

It causes a config error when a lock violation occurs which means the site gets an error 500 so its not an ideal fix.

[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by el_duderino on Wednesday April 15, 2015 @02:01PM (#9382831)
Site to check: https://lab.xpaw.me/MS15-034
[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by buraksarica on Thursday April 16, 2015 @03:06PM (#9390119)
And doesn't check for static content first. Try http://ms15-034.azurewebsites.net/ (disclaimer: my app)
[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by wglb on Wednesday April 15, 2015 @06:08PM (#9384529)
Sadly, only http is checked; won't work for https-only server.
[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by eqkosch on Wednesday April 15, 2015 @12:30PM (#9382122)
As all our servers are behind a traffic manager product like F5/ZXTM I'm experimenting with removing the range header so it never reaches the webserver as some app's rely on kernel mode caching to achieve performance.

Also my tests seem to indicate that just having kernel mode caching enabled even if you dont have any rules still seem to cause a BSOD.

[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by Khao on Wednesday April 15, 2015 @12:47PM (#9382252)
You're right! Even with no rule having kernal caching enabled will crash it! I think IIS assumes it should cache all static content even when there are no rules specifically for them. Somehow I can't edit my comment anymore but I'll leave this here :

EVEN WITH NO RULES, YOU ARE VULNERABLE! My previous answer has been proven to be wrong!

[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by tracker1 on Wednesday April 15, 2015 @01:09PM (#9382434)
That was my case as well... initialized IIS on a fresh server to test against. (took me a while to figure out that IIS wasn't even setup, since the IIS manager was on the server) ... accidentally crashed my local machine too (forgot to change the localhost to the ip of the server whyn copy/pasting the url from the browser on the server)

This is pretty wild.

[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by lontivero on Wednesday April 15, 2015 @07:30PM (#9384949)
If I understood well, the HTTP request with the Range header is just a way to CHECK for the vulnerability and it is not THE vulnerability.

The vulnerability allows execute code remotly under the Syetem account.

Am I wrong?

[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by amarraja on Wednesday April 15, 2015 @10:27AM (#9381152)
Have tried on all our production facing domains (with and without CDN and get 200 responses also.

One server (our development server) has proven vulnerable. Maybe reverse proxies are sanitizing the results?

    $ curl -v 10.100.0.40/ -H "Host: irrelevant" -H "Range: bytes=0-18446744073709551615"
    * About to connect() to 10.100.0.40 port 80 (#0)
    *   Trying 10.100.0.40...
    * Adding handle: conn: 0x1d83278
    * Adding handle: send: 0
    * Adding handle: recv: 0
    * Curl_addHandleToPipeline: length: 1
    * - Conn 0 (0x1d83278) send_pipe: 1, recv_pipe: 0
    * Connected to 10.100.0.40 (10.100.0.40) port 80 (#0)
    > GET / HTTP/1.1
    > User-Agent: curl/7.30.0
    > Accept: */*
    > Host: irrelevant
    > Range: bytes=0-18446744073709551615
    >
    < HTTP/1.1 416 Requested Range Not Satisfiable
    < Content-Type: text/html
    < Last-Modified: Wed, 27 Aug 2014 14:56:23 GMT
    < Accept-Ranges: bytes
    < ETag: "885fe5117c2cf1:0"
    * Server Microsoft-IIS/7.5 is not blacklisted
    < Server: Microsoft-IIS/7.5
[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by ftcHn on Wednesday April 15, 2015 @07:24PM (#9384922)
I've just tried on AWS Elastic Beanstalk https servers and not been able to BSOD. We don't have output caching enabled.
[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by el_duderino on Wednesday April 15, 2015 @11:54AM (#9381794)
Proof of BSoD: https://www.youtube.com/watch?v=BlBXREzsytc
[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by functionCall on Wednesday April 15, 2015 @11:16AM (#9381491)
I can confirm what Khao is saying from my own testing.
[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by Khao on Wednesday April 15, 2015 @11:22AM (#9381548)
Do you happen to have a screenshot of the BSOD, or could test it a second time to take a screenshot? I don't really have a free test server that I can crash anymore since I tested this morning when not a lot of people were at the office yet.
[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by functionCall on Wednesday April 15, 2015 @01:13PM (#9382468)
http://imgur.com/RTbw7co
[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by pweissbrod on Wednesday April 15, 2015 @10:03AM (#9381009)
+1. Also tried this on multiple web servers. Unable to reproduce under several different scenarios using curl
[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by pweissbrod on Wednesday April 15, 2015 @12:28PM (#9382106)
EDIT: adding the output caching rules confirms it. BSOD :(
[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by pjc50 on Wednesday April 15, 2015 @09:54AM (#9380953)
Are you sure that curl is sending the request properly? (Check with tcpdump)
[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by Khao on Wednesday April 15, 2015 @10:02AM (#9381002)
Yep. I tried curl -v to get all the raw headers line by line and the payload is there, and I also tried in telnet, both return a 200 page.

I read the microsoft security bulletin and it says that your IIS server is protected if Kernal Caching is off, maybe that's why our servers are neither blocking the request nor crashing with the request.

[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by pweissbrod on Wednesday April 15, 2015 @10:07AM (#9381030)
I have tried this with kernel caching enabled. (kernel caching IS enabled by default from what I can see). Still unable to reproduce using curl.
[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by Khao on Wednesday April 15, 2015 @10:52AM (#9381326)
Even if you have Kernel Caching enabled (as it is by default) if you haven't created any rule for it you're safe.

I created a rule to cache all .png files and I changed the curl request to request a .png image on the server. I got a BSOD!

[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by trentnelson on Wednesday April 15, 2015 @11:06AM (#9381425)
Do you remember what the fault being reported on the BSOD was?

(If you could take a screenshot/snapshot that'd be great.)

I'm really curious to see what bugcheck is being hit.

[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by davman on Wednesday April 15, 2015 @11:47AM (#9381729)
I just get the standard "Your PC ran into a problem and needs to restart. We're just collecting some error info, and then we'll restart for you."

Edit:

Actually sometimes you get additional info:

http://imgur.com/zRHUV8o

[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by trentnelson on Wednesday April 15, 2015 @04:03PM (#9383679)
Ah, page fault in non-paged area! Interesting.
[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by Ash-k on Wednesday April 15, 2015 @11:15AM (#9381487)
I second that.. If you could provide a screenshot and Curl example it would be great.
[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by eqkosch on Wednesday April 15, 2015 @11:05AM (#9381417)
Can you please provide example of CURL syntax you used to produce this please?
[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by eqkosch on Wednesday April 15, 2015 @11:24AM (#9381552)
Thanks my syntax was slightly off I'm now able to reproduce.
[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by Khao on Wednesday April 15, 2015 @11:16AM (#9381492)
Specifically after enabling Output Caching for all .png files I send this :

curl -v http://example.com/image.png -H "Range: bytes=18-18446744073709551615"

[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by tracker1 on Wednesday April 15, 2015 @01:11PM (#9382455)
I was able to crash mine (local win8.1 and win2012 server) without any rules specified, only the checkbox enabled for kernel caching... it may vary based on windows version.
[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by micah_chatt on Wednesday April 15, 2015 @11:24AM (#9381555)
One other possibility, is that your systems have already been compromised and are giving you back incorrectly safe-looking output. I'm not saying its probable, just possible.
[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by guiomie on Wednesday April 15, 2015 @11:01AM (#9381389)
Are you sure you have IIS on an OS with the vulnerability? It seems like windows 2008 R2 has it, but not 2008. My work is all on windows 2008, not R2.
[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by vdnkh on Wednesday April 15, 2015 @01:48PM (#9382730)
I'm getting "Range requested not satisfiable" but no crash. Am I vulnerable or just doing it wrong?
[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by hitgeek on Wednesday April 15, 2015 @01:34PM (#9382620)
confirmed the above command crashed my win 2012 r2 server on AWS with no output cache rules. I found a png being served by my home page, and after 2 of the above requests the server crashed.

I installed the pending windows updates and after a restart the problem seems to be gone.

[ Parent | on HN ]