Re:Remote Kernel Code Execution Via HTTP Request In IIS On W...
by functionCall on Wednesday April 15, 2015 @12:54PM
(#9382321)
http://imgur.com/RTbw7co confirmed for default IIS without any rules set, completely default values.
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W...
by Rapzid on Wednesday April 15, 2015 @01:08PM
(#9382433)
Yup, took me a few more goes but confirmed 2012R2 on AWS behind ELB. I've been up for a while making new images.. 5:08AM :|
I can also confirm it crashes my command window using curl via cygwin lol.
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W...
by Khao on Wednesday April 15, 2015 @11:55AM
(#9381804)
Did you have to configure any rule in the Output Caching or that's completely default values?
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W...
by davman on Wednesday April 15, 2015 @12:02PM
(#9381877)
I initially configured rules (I was following your instructions) but I've now deleted the rules and still have the crash.
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W...
by artanis0 on Wednesday April 15, 2015 @12:29PM
(#9382115)
Can confirm. No Output Caching rules defined, I am still able to reproduce crash.
[EDIT]
What is handy is that it appears that disabling "Enable kernel cache" takes effect immediately. No iisreset or server reboot required in my testing environment.
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W...
by davman on Wednesday April 15, 2015 @12:34PM
(#9382153)
Yes, unticking that checkbox works for me instantly.
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W...
by Khao on Wednesday April 15, 2015 @12:09PM
(#9381925)
Damnit. I'll double-check on my side too and update my answer accordingly. I don't want people to think they're safe if they're not!
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W...
by davman on Wednesday April 15, 2015 @11:57AM
(#9381822)
What is also interesting is that if I do this instead:
curl -v http://10.243.0.221/iis-85.png -I -H "Range: bytes=18-18446744073709551615"
(added -I), then it doesn't cause the crash.
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W...
by gkop on Wednesday April 15, 2015 @11:59AM
(#9381848)
-I sends a HEAD rather than a GET, so that's not too surprising.
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W...
by davman on Wednesday April 15, 2015 @12:11PM
(#9381942)
Ahh yeah, that should have been obvious. Thanks!
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W...
by endian01 on Wednesday April 15, 2015 @11:53AM
(#9381787)
Confirmed with Windows 8.1 Pro w/ IIS ..
Same conditions, must run request twice for the .png (with the IIS rule set)
Not like it matters, but I am toying with the first Range number.. (ie: 40-1884...615)
Edit: crash @ 40-1884, oh-shit-reboot at 100-1884
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W...
by Satchelmouth on Wednesday April 15, 2015 @06:33PM
(#9384701)
Confirmed: I couldn't force a BS using the originally supplied range numbers, but changing it as per above to 100 did the trick (windows 2008 non R2 & 2012 R2)
curl -v http://server-name/iis-85.png -H "Range: bytes=18-18446744073709551615"
Run the curl twice and the bluescreen happens the second time. If I don't request the image then it doesn't work.
I've not added any specific rules for output caching.
Edit: The crash screen is very dull:
http://imgur.com/MZ7VNHQ