Tag Info

Hot answers tagged

13

That the code "runs as root" is mostly irrelevant. Root or non-root is a distinction that makes sense only locally to a machine, and only if you want to contain some potentially hostile code (e.g. hijacked server code) without bringing down the whole machine. This is the mainframe model from a few decades ago. At that time, it was believed that you could ...


7

Frankly, the relevant words are "custom code running as root and exposed to the Public." To justify the coding effort and delays, you will have to do some quick calculations on the impact of the code being exploited and a malicious actor gaining root access to the server it is running on. If the cost of a breach is more than the cost of the coding effort ...


4

IIS is one of many applications that get HTTP requests passed to it from HTTP.sys, so HTTP.sys can be loaded without IIS running or even being installed. Windows implements an HTTP listener as part of the network subsystem via a kernel mode driver (HTTP.sys). HTTP.sys is what's actually listening for HTTP requests and passing it on to the application ...


3

You might try demonstrating server problems that occurred in well-tested servers and make the claim "If after all of the testing and examination they were insecure, how can we expect to do better?" The first example that pops into my head is the Shellshock bug. When combined with CGI from the Apache Web server, it allowed remote execution. This was not due ...


1

Almost certainly, but it may not translate to a reliable exploit. As you are controlling ESI, EDI and ECX you are most likely controlling a byte copy operation and I'm assuming the crash is caused because you're trying to read/write to an address like 0x41414141. At worst you can hard code some addresses where ESI points at the start of your shell code, ...


1

This reddit give us some information based in the reported exploits. As you may see, it is a problem regarding validation in the "Range" HTTP Header. Some users reported getting immediate BSoD after issuing the mentioned requests to their web servers. Correction: So, as it seems, you do NOT have to be running IIS to be affected by this vulnerability. ...


1

Exactly as you are doing. The idea of open redirect vulnerabilities is to use the trust a user has in a specific website (the vulnerable site), and exploit it to get them to visit your website. So you would send this link to a user: example.com/?url=evil.com/sploitCode.php. Because the website they see is example.com, and they trust them, they will click on ...



Only top voted, non community-wiki answers of a minimum length are eligible