{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5150","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5150/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5150/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5150/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/5150","id":68592834,"number":5150,"title":"Add MS15-034 (CVE-2015-1635) https.sys Request Handling Denial-of-Service (and check)","user":{"login":"wchen-r7","id":1170914,"avatar_url":"https://avatars.githubusercontent.com/u/1170914?v=3","gravatar_id":"","url":"https://api.github.com/users/wchen-r7","html_url":"https://github.com/wchen-r7","followers_url":"https://api.github.com/users/wchen-r7/followers","following_url":"https://api.github.com/users/wchen-r7/following{/other_user}","gists_url":"https://api.github.com/users/wchen-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wchen-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wchen-r7/subscriptions","organizations_url":"https://api.github.com/users/wchen-r7/orgs","repos_url":"https://api.github.com/users/wchen-r7/repos","events_url":"https://api.github.com/users/wchen-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wchen-r7/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/feature","name":"feature","color":"bfe5bf"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420"}],"state":"closed","locked":false,"assignee":{"login":"jvazquez-r7","id":1742838,"avatar_url":"https://avatars.githubusercontent.com/u/1742838?v=3","gravatar_id":"","url":"https://api.github.com/users/jvazquez-r7","html_url":"https://github.com/jvazquez-r7","followers_url":"https://api.github.com/users/jvazquez-r7/followers","following_url":"https://api.github.com/users/jvazquez-r7/following{/other_user}","gists_url":"https://api.github.com/users/jvazquez-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/jvazquez-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jvazquez-r7/subscriptions","organizations_url":"https://api.github.com/users/jvazquez-r7/orgs","repos_url":"https://api.github.com/users/jvazquez-r7/repos","events_url":"https://api.github.com/users/jvazquez-r7/events{/privacy}","received_events_url":"https://api.github.com/users/jvazquez-r7/received_events","type":"User","site_admin":false},"milestone":null,"comments":42,"created_at":"2015-04-15T06:45:14Z","updated_at":"2015-04-16T08:30:10Z","closed_at":"2015-04-15T19:30:27Z","pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5150","html_url":"https://github.com/rapid7/metasploit-framework/pull/5150","diff_url":"https://github.com/rapid7/metasploit-framework/pull/5150.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/5150.patch"},"body":"I didn't do much, I found a work-in-progress code here: http://pastebin.com/raw.php?i=ypURDPc4\r\n\r\nI tested it and worked on my IIS:\r\n\r\n![screen shot 2015-04-15 at 1 46 48 am](https://cloud.githubusercontent.com/assets/1170914/7153450/708a1ee8-e311-11e4-98fb-2475071201ee.png)\r\n\r\nSo I ported that to Metasploit. This MSF module can do two things:\r\n1. It can check if the target is vulnerable or not (if you use the check command)\r\n2. It can dos the target (if you use the run command, but the check will kick in first)\r\n\r\nHere's how you can test it:\r\n\r\n- [x] Set up a Windows 7 SP1 box\r\n- [x] Install IIS\r\n- [x] Open IIS Manager, click on Default Web Site. You will see Output Caching there, double click on that, and then on the right you will see Edit Feature Settings: Make sure \"Enable kernel cache\" is enabled. By default it already is.\r\n- [x] I added a ```.htm``` extension for kernel-mode caching too during testing, ~~but this may not be necessary.~~\r\n- [x] Run the module\r\n\r\n```\r\nmsf auxiliary(ms15_034_ulonglongadd) > run\r\n\r\n[*] 192.168.1.169:80 - DOS request sent\r\n[*] Scanned 1 of 1 hosts (100% complete)\r\n[*] Auxiliary module execution completed\r\n```\r\n\r\nOf if you see me in person, you can use my box, too."},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/93677458","html_url":"https://github.com/rapid7/metasploit-framework/pull/5150#issuecomment-93677458","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5150","id":93677458,"user":{"login":"Meatballs1","id":1854557,"avatar_url":"https://avatars.githubusercontent.com/u/1854557?v=3","gravatar_id":"","url":"https://api.github.com/users/Meatballs1","html_url":"https://github.com/Meatballs1","followers_url":"https://api.github.com/users/Meatballs1/followers","following_url":"https://api.github.com/users/Meatballs1/following{/other_user}","gists_url":"https://api.github.com/users/Meatballs1/gists{/gist_id}","starred_url":"https://api.github.com/users/Meatballs1/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Meatballs1/subscriptions","organizations_url":"https://api.github.com/users/Meatballs1/orgs","repos_url":"https://api.github.com/users/Meatballs1/repos","events_url":"https://api.github.com/users/Meatballs1/events{/privacy}","received_events_url":"https://api.github.com/users/Meatballs1/received_events","type":"User","site_admin":false},"created_at":"2015-04-16T08:30:10Z","updated_at":"2015-04-16T08:30:10Z","body":">From ‏@Lee_Holmes:\r\n\r\n>>MS015-034 vulnerability requires that services use Kernel Mode Caching in http.sys. WinRM and PowerShell Remoting do not.\r\n\r\nNetwork Discovery 5357 is also a HTTP.sys service, but was also not vuln. :cry: \r\n\r\nYou can list available HTTP.sys services with `netsh http show iplisten`"}}