Exploit for CVE-2022-21907-http.sys

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-P0DALIRIUS-CVE-2022-21907-HTTP.SYS
# CVE-2022-21907 - http.sys 驱动程序中的双重释放

![](https://assets.kitploit.com/production/public/readmes/30396/46a468637f444402a7319c1d017f9b56215df52ab6107e7806f90812c4fd9ea7.png)

CVE-2022-21907 - http.sys 驱动程序中的双重释放   
![GitHub release \(latest by date\)](https://img.shields.io/github/v/release/p0dalirius/CVE-2022-21907-http.sys) ![](https://img.shields.io/twitter/follow/podalirius_?label=Podalirius&style=social) ![YouTube Channel Subscribers](https://img.shields.io/youtube/channel/subscribers/UCF_x5O7CSfr82AfNVTKOv_A?style=social)   
  


## 概要

未经身份验证的攻击者可以发送带有“`Accept-Encoding`”HTTP 请求头的 HTTP 请求，在 HTTP 协议栈（`http.sys`）处理数据包时，于未知编码列表中触发双重释放，最终导致内核崩溃。

### 易受攻击的系统

  * **Windows Server 2019 和 Windows 10 版本 1809** : 
    * ❌ 默认情况下不易受攻击。除非你在 `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters\` 中将 HTTP Trailer Support 设置为 `EnableTrailerSupport`，否则系统不会受影响。
  * **Windows 10 版本 2004（内部版本`19041.450`）**: 
    * ✔️ 易受攻击



你可以在此处找到 Windows 10 版本 2004（内部版本 `19041.450`）的 `http.sys` 驱动程序：

补丁状态| 驱动程序  
---|---  
补丁前| ./ressources/drivers_before_update/C/Windows/System32/drivers/http.sys  
补丁后| ./ressources/drivers_after_update/C/Windows/System32/drivers/http.sys  
  
## 演示

https://user-images.githubusercontent.com/79218792/149931289-57615b83-8208-4afc-bcc0-a4155b1db8aa.mp4

## 用法

root@kitploit:~
    
    
    $ ./CVE-2022-21907_http.sys_crash.py -h
    usage: CVE-2022-21907_http.sys_crash.py [-h] -t TARGET [-v]
    
    Description message
    
    optional arguments:
      -h, --help            show this help message and exit
      -t TARGET, --target TARGET
                            Target IIS Server.
      -v, --verbose         Verbose mode. (default: False)
    

## 崩溃时的调用图

调用图：

root@kitploit:~
    
    
    STACK_TEXT:
    ffffca0d`46cdf158 fffff800`4a1efe29 : 00000000`00000139 00000000`00000003 ffffca0d`46cdf480 ffffca0d`46cdf3d8 : nt!KeBugCheckEx
    ffffca0d`46cdf160 fffff800`4a1f0250 : 00000000`00001000 ffffca0d`46cdf4a0 fffff800`4aa4ef00 00000000`00000000 : nt!KiBugCheckDispatch+0x69
    ffffca0d`46cdf2a0 fffff800`4a1ee5e3 : 00000000`00000000 00000000`00000002 00000000`c0000225 01b00030`4a1ec14c : nt!KiFastFailDispatch+0xd0
    ffffca0d`46cdf480 fffff800`4707f537 : 00000000`00000010 00000000`00010202 ffffca0d`46cdf638 00000000`00000018 : nt!KiRaiseSecurityCheckFailure+0x323
    ffffca0d`46cdf610 fffff800`47036ac5 : ffff930c`202efef9 ffffca0d`00000001 ffffca0d`46cdf694 00000000`00000000 : HTTP!UlFreeUnknownCodingList+0x63
    ffffca0d`46cdf640 fffff800`4700d191 : ffff70ca`b45420d8 ffffca0d`46cdf819 00000000`00000010 fffff800`4700d140 : HTTP!UlpParseAcceptEncoding+0x298f5
    ffffca0d`46cdf730 fffff800`46fe9368 : fffff800`46fb46e0 ffffca0d`46cdf819 ffff930c`210ca050 00000000`00000000 : HTTP!UlAcceptEncodingHeaderHandler+0x51
    ffffca0d`46cdf780 fffff800`46fe8a47 : ffffca0d`46cdf8e8 00000000`00000004 00000000`00000000 00000000`00000010 : HTTP!UlParseHeader+0x218
    ffffca0d`46cdf880 fffff800`46f44c5f : ffff930c`19c16228 ffff930c`19c16010 ffffca0d`46cdfa79 00000000`00000000 : HTTP!UlParseHttp+0xac7
    ffffca0d`46cdf9e0 fffff800`46f4490a : fffff800`46f44760 ffff930c`202efcf0 00000000`00000000 00000000`00000001 : HTTP!UlpParseNextRequest+0x1ff
    ffffca0d`46cdfae0 fffff800`46fe4852 : fffff800`46f44760 fffff800`46f44760 00000000`00000001 00000000`00000000 : HTTP!UlpHandleRequest+0x1aa
    ffffca0d`46cdfb80 fffff800`4a146745 : ffff930c`19c16090 fffff800`46fb5f80 00000000`00000284 00000000`00000000 : HTTP!UlpThreadPoolWorker+0x112
    ffffca0d`46cdfc10 fffff800`4a1e5598 : ffffa580`1afc0180 ffff930c`1eec0040 fffff800`4a1466f0 00000000`00000246 : nt!PspSystemThreadStartup+0x55
    ffffca0d`46cdfc60 00000000`00000000 : ffffca0d`46ce0000 ffffca0d`46cda000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
    

函数调用图：

root@kitploit:~
    
    
     ───> nt!KiStartSystemThread+0x28
     │    ├──> nt!PspSystemThreadStartup+0x55
     │    │    ├──> HTTP!UlpThreadPoolWorker+0x112
     │    │    │    ├──> HTTP!UlpHandleRequest+0x1aa
     │    │    │    │    ├──> HTTP!UlpParseNextRequest+0x1ff
     │    │    │    │    │    ├──> HTTP!UlParseHttp+0xac7
     │    │    │    │    │    │    ├──> HTTP!UlParseHeader+0x218
     │    │    │    │    │    │    │    ├──> HTTP!UlAcceptEncodingHeaderHandler+0x51
     │    │    │    │    │    │    │    │    ├──> HTTP!UlpParseAcceptEncoding+0x298f5
     │    │    │    │    │    │    │    │    │    ├──> HTTP!UlFreeUnknownCodingList+0x63
     │    │    │    │    │    │    │    │    │    │    ├──> nt!KiRaiseSecurityCheckFailure+0x323
     │    │    │    │    │    │    │    │    │    │    │    ├──> nt!KiFastFailDispatch+0xd0
     │    │    │    │    │    │    │    │    │    │    │    │    ├──> nt!KiBugCheckDispatch+0x69
     │    │    │    │    │    │    │    │    │    │    │    │    │    └──> nt!KeBugCheckEx
    

## 参考资料

  * https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21907
  * https://vulners.com/cve/CVE-2022-21907
  * http://msdl.microsoft.com/download/symbols/http.pdb/3D8ADB52C1BF2F56F4EFE17AD29AC5B41/http.pdb
  * https://www.zerodayinitiative.com/blog/2021/5/17/cve-2021-31166-a-wormable-code-execution-bug-in-httpsys