Hacker News Reader

Comment by drzaiusapelord | Hacker News Reader

How does this work? Do we have a working exploit now?

Uncharitably, how it works is the author of this link doesn't want to scan all 2^32 hosts himself, so he's asking people for URL's to their windows servers so he can reach them directly. I can't imagine a scenario where I would submit a URL.

EDIT: again, yes, there are no doubt thousands of bots doing port scans for this. In the uncharitable reading, this 'service' is how the author beats them to the punch.

If you are running a vulnerable server, don't think you can just keep it a secret. Without question there are many thousands of bots looking for this already.

I guess saying that I don't log anything wouldn't matter to you.

yes, it would help :)

It's just that out of the reasons someone would throw up this service in a few hours, you will understand that getting the name of hosts directly would be high on the list.

I realize (as I stated) that this is a very uncharitable reading, and I'm kind of sorry that I stated it. You could simply be helping.

I made this service in a couple of hours because I had nothing better to do at the time :)

AFAIK a working crash has been released but not the code to actually exploit it.

Ah, thanks I just saw this elsewhere. Looks like anyone with curl can BSOD an unpatched IIS server. Wow, this is pretty bad. I patched last night when I saw this in the news. Scary stuff.

Ah, but it's not IIS, this is something less than IIS called HTTP.sys which is used by SSRS in sql 2008 or 2012. It's also used by some other windows services, so chances are you wouldn't even know you are running http.sys unless your software specifically mentioned it.

Reply on news.ycombinator.com