关联漏洞
标题：
Microsoft Internet Information Services 缓冲区错误漏洞
(CVE-2017-7269)
描述：Microsoft Windows Server 2003 R2是美国微软（Microsoft）公司发布的一套服务器操作系统。Internet Information Services（IIS）是一套运行于Microsoft Windows中的互联网基本服务。 Microsoft Windows Server 2003 R2中的IIS 6.0版本中的WebDAV服务的‘ScStoragePathFromUrl’函数存在缓冲区溢出漏洞。远程攻击者可通过发送特制的PROPFIND请求利用该漏洞执行任意代码。
介绍
# CVE 2017.7269
## Index
1. [Authors](#authors)
2. [Abstract](#abstract)
3. [Description](#description)
## Authors
- NoexDevPen
- mag4no10
## Abstract
### What is Microsoft IIS?
Internet Information Services (IIS) is a flexible, general-purpose web server from Microsoft that runs on Windows systems to serve requested HTML pages or files. An IIS web server accepts requests from remote client computers and returns the appropriate response. This basic functionality allows web servers to share and deliver information across local area networks (LAN), such as corporate intranets, and wide area networks (WAN), such as the Internet.
### What is Microsft Windows server?
Is a line of Microsoft operating systems (OSes) comprised of extremely powerful machines. Windows Server was first launched in April 2003. It’s typically installed on heavy-use servers serving as a backbone for most IT companies, applications, and services. The server handles the administrative group-related activities on a network. It organizes, stores, sends, and receives files from devices connected to a network.
### What is WebDAV?
WebDAV, or Web Distributed Authoring and Versioning, enhances HTTP to allow users to manage and edit files on a web server collaboratively. It supports file sharing, editing, and versioning directly through a web interface, offering a more collaborative and firewall-friendly alternative to FTP. WebDAV facilitates in-place file editing, making it ideal for team projects.
## Description
This script performs a *Buffer Overflow Attack* using ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2.
The usage of the script could be:
```bash
python3 exploit.py <RHOST> <RPORT> <LHOST> <LPORT> [-v]
```
Where v is the verbose parameter, which will display additional messages.
## References & Discoverer
- [ExploitDB](https://www.exploit-db.com/exploits/41738)
- [g0rx Github](https://github.com/g0rx/iis6-exploit-2017-CVE-2017-7269)
Discoverer: Zhiniang Peng and Chen Wu.
文件快照
[4.0K] /data/pocs/7320015f3e8bbc3dc5d917955327ae184b75c67a
├── [ 15K] CVE-2017-7269.py
├── [ 34K] LICENSE
└── [2.1K] README.md
0 directories, 3 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。