CVE-2021-31166 PoC — Microsoft HTTP.sys 资源管理错误漏洞

Source

https://github.com/mvlnetdev/CVE-2021-31166-detection-rules

Associated Vulnerability

Title:Microsoft HTTP.sys 资源管理错误漏洞 (CVE-2021-31166)
Description:Microsoft HTTP.sys是美国微软（Microsoft）公司的一个应用协议。HTTP应用协议。 HTTP.sys存在资源管理错误漏洞。以下产品和版本受到影响：Windows 10 Version 2004 for 32-bit Systems,Windows 10 Version 2004 for ARM64-based Systems,Windows 10 Version 2004 for x64-based Systems,Windows Server, version 2004 (Ser

Description

Different rules to detect if CVE-2021-31166 is being exploited

Readme

# CVE-2021-31166 Detection Rules
Different rules to detect if CVE-2021-31166 is being exploited

Rules available:
- Suricata
- Snort
  - The snort rules also work on suricata.
- Zeek

To Do:
- Make PCAPs available which where used during the development of the signatures

# Zeek script
- Detection when the CVE-2021-31166 vulnerability is being exploited.
- Detection if the 'exploited host' is down (this has a high threshold and may give some false negatives).
- Only detect on a given subnet. Default: 192.168.0.0/16, 172.16.0.0/12 and 10.0.0.0/8.
- Learn hosts that have IIS installed or have the WinRM or WSDAPI enabled an thus may be vulnerable. Only detect for the exploit on those hosts after they have been found. 
  - This feature is turned off by default. Change the value of `learn_iis_webservers` to `T` if you want it turned on.

# FAQ

## Which OS versions are vulnerable?
- Windows Server, version 2004 (or 20H1) (Server Core installation),
- Windows 10 Version 2004 (or 20H1) for ARM64/x64/32-bit Systems,
- Windows Server, version 20H2 (Server Core Installation),
- Windows 10 Version 20H2 for ARM64/x64/32-bit Systems.

For more information visit: <https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31166>

The following software is vulnerable on those versions:
- IIS
- WinRM
- WSDAPI

## Do the suricata rules and the zeek script also work on WinRM and WSDAPI?
Yes they do. The ports for WinRM and WSDAPI are:
- WinRM = 5357
- WSDAPI = 5985 (HTTP)

# Credits:
- Initial PoC: <https://github.com/0vercl0k/CVE-2021-31166>
- WinRM affected: <https://twitter.com/JimDinMN/status/1395071966487269376>
- WSDAPI affected: <https://twitter.com/HenkPoley/status/1394309837304082439>

# Disclaimer
The scripts or rules have not been tested in production. Use at your own risk.

I basically have no idea what I am doing.

Please send feedback if you have it.

File Snapshot


 [4.0K]  /data/pocs/170d3fdfbfa14559747c858f4ba925ee9b6818d4
├── [2.0K]  cve-2021-31166.zeek
├── [1.0K]  LICENSE
├── [1.8K]  README.md
├── [ 450]  snort.rule
└── [ 441]  suricata.rules

0 directories, 5 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!