{"uuid": "dcbdaca1-a2b2-48c1-8965-a8aed1d8983e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/hacking_Attack/9637", "content": "Black Hat Ethical Hacking\nWindows PoC Exploit Released for Wormable RCE\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Windows PoC Exploit Released for Wormable RCEPost Views: 127 \nReading Time: 1 Minute\nA researcher has released\u00a0a proof-of-concept (PoC) exploit for CVE-2021-31166, a use-after-free, highly critical vulnerability in the HTTP protocol stack (http.sys) that could lead to wormable remote code execution (RCE).\nMicrosoft discovered the flaw internally, releasing a patch in its May 11 Patch Tuesday\u00a0update. This was the most severe bug in that batch: an http.sysissue that requires neither user authentication nor user interaction to exploit. An exploit would allow RCE with kernel privileges or a denial-of-service (DoS) attack.\n\nAccording to a tweet from Microsoft\u2019s Justin Campbell, the vulnerability was found by @_mxms\u00a0and @fzzyhd1.\nFortunately this http.sys bug was an internal find by our team. This one thanks to @_mxms, @fzzyhd1 and everyone who contributes to our tooling and automation. https://t.co/0ru9BQMaJ9\n\n\u2014 Justin Campbell (@metr0) May 13, 2021\nSee Also: Microsoft, Google Clouds Hijacked for Gobs of Phishing http.sysenables Windows and applications to communicate with other devices; it can be run standalone or in conjunction with Internet Information Services (IIS). Microsoft Advises Priority Patching\u201cIn most situations, an unauthenticated attacker could send a specially crafted packet to a targeted server utilizing the HTTP Protocol Stack (http.sys) to process packets,\u201d Microsoft explained in its advisory. Given that the vulnerability is wormable, Microsoft recommends prioritizing the patching of affected servers.\n\n\u201cWith a CVSS score of 9.8, the vulnerability announced has the potential to be both directly impactful and is also exceptionally simple to exploit, leading to a remote and unauthenticated denial-of-service (Blue Screen of Death) for affected products,\u201d McAfee\u2019s Steve Povolny said in an analysis\u00a0of the flaw at the time.\n\nPovolny explained that the problem lies in how Windows improperly tracks pointers while processing objects in network packets containing HTTP requests. The vulnerability only affects the latest versions of Windows 10 and Windows Server, meaning that the exposure for internet-facing enterprise servers is \u201cfairly limited,\u201d he said. That\u2019s because many of these systems run Long Term Servicing Channel (LTSC) versions, such as Windows Server 2016 and 2019, which aren\u2019t susceptible to this flaw. Public Exploit for Wormable Security BugResearcher Axel Souchet, who used to work for Microsoft, published the PoC to GitHub, noting that the bug happens in http!UlpParseContentCoding, where the function has a local LIST_ENTRYand appends an item to it. \u201cWhen it\u2019s done, it moves it into the Request structure; but it doesn\u2019t NULLout the local list,\u201d he explained. \u201cThe issue with that is that an attacker can trigger a code path that frees every [entry] of the local list, leaving them dangling in the Request object.\u201d\nSee Also: Offensive Security Tool: EyeWitness This isn\u2019t the first PoC exploit for CVE-2021-31166 that Souchet has released, but this is the first wormable one. Over the weekend, he released a PoC that only locked the impacted Windows system as long as it\u2019s running an IIS server. That initial exploit shows how an attacker can leverage the flaw to cause DoS on a targeted system by sending it specially crafted packets.\nI've built a PoC for CVE-2021-31166 the \"HTTP Protocol Stack Remote Code Execution Vulnerability\": https://t.co/8mqLCByvCp https://s.w.org/images/core/emoji/13.0.1/72x72/1[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:41.475243Z"}