Hacker News Reader

You're right! Even with no rule having kernal caching enabled will crash it! I think IIS assumes it should cache all static content even when there are no rules specifically for them. Somehow I can't edit my comment anymore but I'll leave this here :

EVEN WITH NO RULES, YOU ARE VULNERABLE! My previous answer has been proven to be wrong!

That was my case as well... initialized IIS on a fresh server to test against. (took me a while to figure out that IIS wasn't even setup, since the IIS manager was on the server) ... accidentally crashed my local machine too (forgot to change the localhost to the ip of the server whyn copy/pasting the url from the browser on the server)

This is pretty wild.

If I understood well, the HTTP request with the Range header is just a way to CHECK for the vulnerability and it is not THE vulnerability.

The vulnerability allows execute code remotly under the Syetem account.

Am I wrong?