Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Assignement_3-CVE-2017-7269 | Kitploit
Tools/GitHubGitHub/killian0713/assignement_3-cve-2017-7269
Exploit FrameworksVulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityPenetration TestingLearning & Education
GitHubkillian0713/assignement_3-cve-2017-7269

Assignement_3-CVE-2017-7269

View Repository
7 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2017-7269

Name : Killian Munt-Buron and Naji Ullah Abbasi

Description of the CVE

CVE-2017-7269 is a buffer overflow vulnerability in Microsoft Windows Server 2003 R2.

The vulnerability is in the ScStoragePathFromUrl function in the WebDAV.

This vulnerability allows to execute arbitrary code via a long header.

The headers starts by if: <http://

Technologies used

  • Windows Server 2003 R2 on Vmware Workstation
  • IIS 6.0
  • WebDAV
  • Ubuntu

Setup VM

Windows Server 2003 R2

Use a iso file (link to download : https://archive.org/details/en_windows_server_2003_standard)

IIS

Control Panel => Add or Remove Programs = > Add/Remove Windows Components

Select Application Server, after click Details.

Select Internet Information Services (IIS)

Verify that Common files and World Wide Web Service are selected.

To verify that IIS has been installed, open with ethernet explorer this url: http://localhost/

If you have followed the instruction, you have this screen:

WebDAV

Go to Internet Information Services Manager => click on the device name => go Web service extension => right-click WebDAV and allowed

Exploit

We have the attacker machine, with the Ubuntu VM :

And the victim, with the Windows VM :

From the attacker machine, we can see the victim using Nmap :

We tried to recreate the vulnerability but We encountered an issue.

In the victim machine, we create a directory /webdav.

And we add read, write and directory browsing folder permissions :

With cadaver, a WebdAV client, we can see that the communication works :

First, we use a script to see if the server answer with a PROFIND requests :

root@kitploit:~
import socket

host = "192.168.79.153"
port = 80

request = (
    "PROPFIND /webdav/ HTTP/1.1\r\n"
    "Host: {host}\r\n"
    "Content-Length: 0\r\n"
    "Content-Type: text/xml\r\n"
    "Depth: 0\r\n"
    "Translate: f\r\n"
    "\r\n"
).format(host=host)

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
s.send(request.encode())
response = s.recv(4096)
s.close()

print(response.decode())

We have this :

root@kitploit:~
killian@vmlinux:~$ python3 mis3.py
HTTP/1.1 207 Multi-Status
Date: Sun, 18 Jan 2026 19:22:56 GMT
Server: Microsoft-IIS/6.0
Content-Type: text/xml
Transfer-Encoding: chunked

After that, we use Metasploit, to generate the buffer overflow :

But we encountered a probleme with Internet Information Services (IIS)

We have this in the log :

root@kitploit:~

2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 207 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0
2026-01-19 13:19:50 192.168.79.153 PROPFIND /webdav - 80 - 192.168.79.154 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+14.7;+rv:133.0)+Gecko/20100101+Firefox/133.0 500 0 0

We have many HTTP 500 Internal Server Error responses. This indicates that IIS encountered internal exceptions while processing malformed WebDAV requests, which is normal for the CVE.

We tried to understand the problem, use other python script, payload with metasploit, but always the same problem.

We have verified that the Server Windows 2003 is vulnerable with this :

wmic qfe list | find "KB4011783"

For the windows firewall, the server is not equipped with it, according us researchers.

Video

https://youtu.be/M94kNhSivHU

Conclusion

Although full remote code execution was not achieved, the experimental results demonstrate that the vulnerable WebDAV code path associated with CVE-2017-7269 is reachable on the target system.

The server consistently processes malformed PROPFIND requests and returns internal server errors (HTTP 500), indicating memory handling issues consistent with the documented vulnerability.

The inability to achieve reliable exploitation is likely due to environmental factors such as operating system configuration or undocumented security mitigations.

Disclaimer

This project was conducted strictly in a controlled laboratory environment for educational purposes only.

Download Tool