Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CVE-2015-1635 PoC — Microsoft Windows HTTP.sys 远程执行代码漏洞

Source
Associated Vulnerability
Title:Microsoft Windows HTTP.sys 远程执行代码漏洞 (CVE-2015-1635)
Description:HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."
Description
Concurrent network scanner for CVE-2015-1635
Readme
Webbased concurrent scanner for CVE-2015-1635.

[Live implementation running here](http://erlvulnscan.lolware.net/). This demonstration website is used for development of this project and it stability is not guaranteed.

[Information on this project is written here](https://lolware.net/2015/06/15/mass-vulnerability-scanning.html).  As the "TODO" list documented there has been completed this code is now in a stable state. 

[Code documentation can be found here](https://htmlpreview.github.io/?https://github.com/technion/erlvulnscan/blob/master/doc/index.html).

## Development and deployment

Clone the repository

	git clone https://github.com/technion/erlvulnscan.git

Get prerequisiites

	./rebar3 get-deps

Compile

	./rebar3 compile

Static analysis

    ./rebar3 built-plt #First time only
    ./rebar3 dialyzer

Generate release

	./rebar3 generate

Create edocs (only necessary after API change as these are synced to git)

	./rebar3 doc

Run test harness (EUnit and Common Test both implemented)

    ./rebar3 eunit
    ./rebar3 ct

Observing the cache whille attached to running process

    ets:match(simple_cache, '$1').

The "logs" directory can be accessed to identify two sources of tests by aliasing it to a URL. Accessing this directory without a subfolder will show the results of the CT test suite. Accessing view.png will show the PhantomJS output from the frontend test.

## Building the frontend
The frontend is built using Webpack plugins. From the frontend/ directory:

Install the requirements:

    npm install

To build the frontend:

    webpack

### nginx setup

These rules were used for routing:

    location /netscan {
        proxy_pass http://localhost:8080;
    }

File Snapshot

[4.0K] /data/pocs/d31a057cbdd88fcf5d9b46c8ef36abb1a9a8972a ├── [4.0K] config │   ├── [ 73] sys.config │   └── [ 64] vm.args ├── [4.0K] doc │   ├── [4.5K] cache.html │   ├── [ 151] edoc-info │   ├── [2.1K] erlang.png │   ├── [1.8K] erlvulnscan_app.html │   ├── [1.8K] erlvulnscan_sup.html │   ├── [ 490] index.html │   ├── [3.7K] ipmangle.html │   ├── [1.0K] modules-frame.html │   ├── [3.0K] mshttpsys.html │   ├── [3.5K] netscan.html │   ├── [1.1K] overview-summary.html │   ├── [ 346] packages-frame.html │   ├── [ 869] stylesheet.css │   └── [2.3K] toppage_handler.html ├── [1.9K] elvis.config ├── [4.0K] frontend │   ├── [4.0K] assets │   │   ├── [ 307] erlvulnscan-entry.tsx │   │   ├── [3.4K] erlvulnscan.tsx │   │   ├── [2.1K] images.tsx │   │   ├── [ 71] interfaces.d.ts │   │   └── [3.3K] netscanform.tsx │   ├── [4.0K] build │   │   └── [1.0K] index.html │   ├── [ 815] package.json │   ├── [ 366] tsconfig.json │   ├── [ 219] tslint.json │   ├── [ 856] webpack.config.js │   └── [ 564] webpack.debug.js ├── [4.0K] include │   └── [ 331] defs.hrl ├── [1.0K] LICENSE ├── [1.7K] README.md ├── [767K] rebar3 ├── [ 749] rebar.config ├── [ 498] rebar.lock ├── [4.0K] src │   ├── [2.6K] cache.erl │   ├── [ 749] erlvulnscan_app.erl │   ├── [ 458] erlvulnscan.app.src │   ├── [ 717] erlvulnscan_sup.erl │   ├── [2.1K] ipmangle.erl │   ├── [2.1K] mshttpsys.erl │   ├── [1.4K] netscan.erl │   ├── [ 857] recaptcha.erl │   └── [2.1K] toppage_handler.erl └── [4.0K] test └── [1.5K] erlvulnscan_SUITE.erl 8 directories, 44 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
    3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →