HTTP.sys vulnerability test | Hacker News Reader

HTTP.sys vulnerability test

lab.xpaw.me

41 pointsxPaw17 comments

Correct me if I'm wrong, but wouldn't this site DoS vulnerable servers when it checks them?

Tested a site which got reported as vulnerable and the site is still up, so I guess not :)

It seems to be checking if the server is patched I got "Cannot discern patch status of willcipriano.com, and it doesn't appear to be using IIS. This most likely means it is not vulnerable." when I checked my own site. So likely it isn't attempting to use the exploit.

I'm getting "Cannot discern patch status of X" (VulnStatus::NOT_VULN_MS) on couple of sites I tried. Wondering if that's a good or a bad sign?

that means the server response was something different from expected, either the server is not running IIS or it is running another (older ?)version.

That seems to mean not running IIS, or IIS is behind something sanitizing the range field (load balancer, apache/nginx, proxy, IPS, etc)

"or IIS is behind something sanitizing the range field (load balancer, apache/nginx, proxy, IPS, etc)"... If this is the case, would that mean the server is not at risk? thanks!

Sourcecode:

https://github.com/xPaw/HTTPsys

@xPaw: Nice to see you on HN, too^^

How does this work? Do we have a working exploit now?

AFAIK a working crash has been released but not the code to actually exploit it.

Ah, thanks I just saw this elsewhere. Looks like anyone with curl can BSOD an unpatched IIS server. Wow, this is pretty bad. I patched last night when I saw this in the news. Scary stuff.

Ah, but it's not IIS, this is something less than IIS called HTTP.sys which is used by SSRS in sql 2008 or 2012. It's also used by some other windows services, so chances are you wouldn't even know you are running http.sys unless your software specifically mentioned it.

Uncharitably, how it works is the author of this link doesn't want to scan all 2^32 hosts himself, so he's asking people for URL's to their windows servers so he can reach them directly. I can't imagine a scenario where I would submit a URL.

EDIT: again, yes, there are no doubt thousands of bots doing port scans for this. In the uncharitable reading, this 'service' is how the author beats them to the punch.

If you are running a vulnerable server, don't think you can just keep it a secret. Without question there are many thousands of bots looking for this already.

I guess saying that I don't log anything wouldn't matter to you.

yes, it would help :)

It's just that out of the reasons someone would throw up this service in a few hours, you will understand that getting the name of hosts directly would be high on the list.

I realize (as I stated) that this is a very uncharitable reading, and I'm kind of sorry that I stated it. You could simply be helping.

I made this service in a couple of hours because I had nothing better to do at the time :)

Reply on news.ycombinator.com