News for hackers. Stuff that matters.
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by davman on Wednesday April 15, 2015 @11:45AM (#9381718)
Best I could do on a freshly installed Win2k12 with IIS was:

curl -v http://server-name/iis-85.png -H "Range: bytes=18-18446744073709551615"

Run the curl twice and the bluescreen happens the second time. If I don't request the image then it doesn't work.

I've not added any specific rules for output caching.

Edit: The crash screen is very dull:

http://imgur.com/MZ7VNHQ

Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by functionCall on Wednesday April 15, 2015 @12:54PM (#9382321)
http://imgur.com/RTbw7co confirmed for default IIS without any rules set, completely default values.
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by Rapzid on Wednesday April 15, 2015 @01:08PM (#9382433)
Yup, took me a few more goes but confirmed 2012R2 on AWS behind ELB. I've been up for a while making new images.. 5:08AM :|

I can also confirm it crashes my command window using curl via cygwin lol.

Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by Khao on Wednesday April 15, 2015 @11:55AM (#9381804)
Did you have to configure any rule in the Output Caching or that's completely default values?
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by davman on Wednesday April 15, 2015 @12:02PM (#9381877)
I initially configured rules (I was following your instructions) but I've now deleted the rules and still have the crash.
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by artanis0 on Wednesday April 15, 2015 @12:29PM (#9382115)
Can confirm. No Output Caching rules defined, I am still able to reproduce crash. [EDIT] What is handy is that it appears that disabling "Enable kernel cache" takes effect immediately. No iisreset or server reboot required in my testing environment.
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by davman on Wednesday April 15, 2015 @12:34PM (#9382153)
Yes, unticking that checkbox works for me instantly.
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by Khao on Wednesday April 15, 2015 @12:09PM (#9381925)
Damnit. I'll double-check on my side too and update my answer accordingly. I don't want people to think they're safe if they're not!
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by davman on Wednesday April 15, 2015 @11:57AM (#9381822)
What is also interesting is that if I do this instead:

curl -v http://10.243.0.221/iis-85.png -I -H "Range: bytes=18-18446744073709551615"

(added -I), then it doesn't cause the crash.

Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by gkop on Wednesday April 15, 2015 @11:59AM (#9381848)
-I sends a HEAD rather than a GET, so that's not too surprising.
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by davman on Wednesday April 15, 2015 @12:11PM (#9381942)
Ahh yeah, that should have been obvious. Thanks!
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by endian01 on Wednesday April 15, 2015 @11:53AM (#9381787)
Confirmed with Windows 8.1 Pro w/ IIS ..

Same conditions, must run request twice for the .png (with the IIS rule set)

Not like it matters, but I am toying with the first Range number.. (ie: 40-1884...615)

Edit: crash @ 40-1884, oh-shit-reboot at 100-1884

Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by Satchelmouth on Wednesday April 15, 2015 @06:33PM (#9384701)
Confirmed: I couldn't force a BS using the originally supplied range numbers, but changing it as per above to 100 did the trick (windows 2008 non R2 & 2012 R2)
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by shawnz on Wednesday April 15, 2015 @12:54PM (#9382320)
> Edit: The crash screen is very dull:

Could you show the event log entry also?

Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by davman on Wednesday April 15, 2015 @01:06PM (#9382413)
I couldn't find anything that wasn't just the report of a bluescreen.