MS IIS http ping of death

[ocabj]

I hope you all patched any IIS web servers in your infrastructure.

http://www.theregister.co.uk/2015/04/16/http_sys_exploit_wild_ms15_034/

We made the decision to patch the day of release, given the fact that it only required sending a malformed web request to an exploitable server.

https://ma.ttias.be/remote-code-execution-via-http-request-in-iis-on-windows/

[yellowsulphur]

"Ping of Death" now that's a term I haven't heard since Nirvana and Soundgarden.

[skunkbad]

IIS has been, and will continue to be, the easiest server to hack. I can tell you from personal experience, never ever host a website on IIS. If a knucklehead like me can gain access to every other user account on the server, then a pro hacker could do anything they want.

[Germz]

I just deny ICMP on my router.

[SkyHawk]

I just deny ICMP on my router.

Considering it is a http or https get request that crashes the kernel, I don't think this will help at all It isn't a ping of death, it is a GET of death.

A simple WGET command will do it. You can either test or crash with it.

To test:
wget -O get.txt --header="Range: 0-18446744073709551615" http://8.8.8.8/

If you see 'Requested Header Range Not Satisfiable' either in the server response or the get.txt output file, you are probably vulnerable.

If you want to crash the kernel, simply change the string to:
wget -O get.txt --header="Range: 20-18446744073709551615" http://8.8.8.8/

Of course use your own IP instead of 8.8.8.8 - Google would probably appreciate it.

[ocabj]

I just deny ICMP on my router.

As indicated, this isn't a true "ping of death". It is sending a malformed web request to an IIS server. It's a quasi ping of death in that the malicious actor doesn't care about the ack / return packet from the server.

Note: You'll need to re-think how you address ICMP, since ICMP is used for a lot more when it comes to IPv6 networking. Blindly blocking all ICMP on IPv6 will actually prevent IPv6 from properly routing.

[71MUSTY]

I guess there is a reason my server is still an old model with the hand crank on the front,