CVE-2021-31166 PoC — HTTP Protocol Stack Remote Code Execution Vulnerability

Source

Associated Vulnerability

Description

Different rules to detect if CVE-2021-31166 is being exploited

Readme

# CVE-2021-31166 Detection Rules
Different rules to detect if CVE-2021-31166 is being exploited

Rules available:
- Suricata
- Snort
  - The snort rules also work on suricata.
- Zeek

To Do:
- Make PCAPs available which where used during the development of the signatures

# Zeek script
- Detection when the CVE-2021-31166 vulnerability is being exploited.
- Detection if the 'exploited host' is down (this has a high threshold and may give some false negatives).
- Only detect on a given subnet. Default: 192.168.0.0/16, 172.16.0.0/12 and 10.0.0.0/8.
- Learn hosts that have IIS installed or have the WinRM or WSDAPI enabled an thus may be vulnerable. Only detect for the exploit on those hosts after they have been found. 
  - This feature is turned off by default. Change the value of `learn_iis_webservers` to `T` if you want it turned on.

# FAQ

## Which OS versions are vulnerable?
- Windows Server, version 2004 (or 20H1) (Server Core installation),
- Windows 10 Version 2004 (or 20H1) for ARM64/x64/32-bit Systems,
- Windows Server, version 20H2 (Server Core Installation),
- Windows 10 Version 20H2 for ARM64/x64/32-bit Systems.

For more information visit: <https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31166>

The following software is vulnerable on those versions:
- IIS
- WinRM
- WSDAPI

## Do the suricata rules and the zeek script also work on WinRM and WSDAPI?
Yes they do. The ports for WinRM and WSDAPI are:
- WinRM = 5357
- WSDAPI = 5985 (HTTP)

# Credits:
- Initial PoC: <https://github.com/0vercl0k/CVE-2021-31166>
- WinRM affected: <https://twitter.com/JimDinMN/status/1395071966487269376>
- WSDAPI affected: <https://twitter.com/HenkPoley/status/1394309837304082439>

# Disclaimer
The scripts or rules have not been tested in production. Use at your own risk.

I basically have no idea what I am doing.

Please send feedback if you have it.

File Snapshot

 [4.0K]  /data/pocs/170d3fdfbfa14559747c858f4ba925ee9b6818d4
├── [2.0K]  cve-2021-31166.zeek
├── [1.0K]  LICENSE
├── [1.8K]  README.md
├── [ 450]  snort.rule
└── [ 441]  suricata.rules

0 directories, 5 files

Remarks