full-disclosure - [FD] NSE script for exploiting BOF in Microsoft's IIS 6.0 and Windows Server 2003

Open Source and information security mailing list archives

Message-ID: <CAF-KJUKyOXqNBPr8Yym7OyK1YZ0vnmrS2ocaO0XG_HFFRf=cyA@mail.gmail.com>
Date: Sat, 8 Apr 2017 10:32:35 +0530
From: Rewanth Cool <ravatheruler4@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] NSE script for exploiting BOF in Microsoft's IIS 6.0 and
 Windows Server 2003

Hi,

I'm sorry, I was not aware of the FD group and I was sending all my work to
the developers group (dev@...p.org). So now, I'm forwarding all my
vulnerability detection and exploitation NSE scripts to this group.

I developed an NSE script for the most recently found vulnerability.

It exploits the Buffer Overflow vulnerability in Microsoft Internet
Information Services (IIS) 6.0 and Microsoft Windows Server 2003.

Its marked under CVE-2017-7269 with High Severity and a score of 10.0 in
CVSS.

The script is crafted carefully and beautifully by separating the shellcode
into two parts namely editable portion and non-editable portion. So
developers who want to experiment with the shellcode can modify it easily
without any doubt.

A PR is opened on #828 <https://github.com/nmap/nmap/pull/828> for
exploiting the BOF vulnerability i.e CVE 2017-7269.

Best regards,
Rewanth.

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives