HTTP Protocol Stack Remote Code Execution Vulnerability

This repository contains a single Metasploit auxiliary module that exploits CVE-2021-31166, a use-after-free vulnerability in the Windows HTTP Protocol Stack (http.sys) affecting IIS servers. The module is written in Ruby and leverages the Metasploit framework's HTTP client and DoS auxiliary mixins. The exploit works by sending a specially crafted HTTP GET request with a malformed Accept-Encoding header to the target IIS server. If the server is vulnerable, this causes a Blue Screen of Death (BSOD) and a subsequent reboot, resulting in a denial of service. The module allows the user to specify the target URI (default is '/'). The code includes logic to check if the server is alive before and after sending the payload, and reports on the success of the attack. The repository is operational and provides a working denial-of-service exploit for the specified vulnerability.

This repository contains a proof-of-concept exploit for CVE-2021-31166, a remote use-after-free vulnerability in Microsoft's HTTP.sys driver. The main exploit file, 'cve-2021-31166.py', is a short Python script that sends a specially crafted HTTP GET request with a malformed 'Accept-Encoding' header to a specified target. The exploit is designed to trigger a crash (bugcheck) in vulnerable Windows systems running HTTP.sys, as described in the README. The repository includes a detailed README explaining the vulnerability, affected Windows versions (Windows 10/Server 2004/20H2), and references to further technical details. The exploit does not provide remote code execution or a shell, but demonstrates the ability to crash the target system, confirming the presence of the vulnerability. No hardcoded IPs or domains are present; the target is specified by the user at runtime.

This repository contains a proof-of-concept (PoC) exploit for CVE-2021-31166, a use-after-free vulnerability in Microsoft's HTTP.sys driver. The main file, 'CVE-2021-31166.py', is a Python script that sends a specially crafted HTTP GET request with a malformed 'Accept-Encoding' header to a specified target. The exploit is designed to trigger a crash (denial of service) in the HTTP.sys service on vulnerable Windows 10 and Windows Server 2004/20H2 systems. The README.md provides background on the vulnerability, affected versions, and references. The exploit does not provide code execution or shell access; its primary capability is to demonstrate the vulnerability by causing a service crash. The only fingerprintable endpoint is the HTTP service on the target system, specified by the user at runtime.

This repository provides proof-of-concept (POC) exploit code for CVE-2021-31166, a critical remote code execution vulnerability in the Windows HTTP protocol stack (HTTP.sys). The repository contains two main exploit scripts: 'CVE-2021-31166.py' (Python) and 'main.go' (Go), both implementing similar logic. The exploit works by sending a specially crafted HTTP GET request with a malformed 'Accept-Encoding' header to a target Windows system. If the target is vulnerable, this can trigger a use-after-free condition in HTTP.sys, leading to a denial of service (system crash/blue screen). The scripts include logic to check the target's availability before and after the exploit attempt, and to confirm if the system has crashed and restarted. The README provides detailed information about the vulnerability, affected Windows versions, and references. No weaponized or post-exploitation payload is included; the code is strictly a POC for triggering the vulnerability and observing the result.