CVE-2015-1635-POC, MS15-034 HTTP.sys

HTTP.sys is the kernel driver for Microsoft Windows that handles HTTP requests. It was introduced from IIS6.0 to optimize IIS server performance, and the IIS service process depends on HTTP.sys. The HTTP.sys remote code execution vulnerability is essentially an integer overflow vulnerability in HTTP.sys.

CVE-2015-1635-POC.py allows specifying IP/domain and port for vulnerability verification.

POC usage: python3 CVE-2015-1635-POC.py -i [ip/domain] -p [port]

Usage: python3 CVE-2015-1635-POC.py [options]
            
Options:
    -h,  --help          Show basic help message
    -i,  --ip            Target IP or Domain(e,g. "wolke.cn")
    -p,  --port          Target port
     
[+] example: python3 CVE-2015-1635-POC.py -i 10.0.0.1 -p 80