Module Import alias Import alias ImportFrom alias ClassDef bases NameLoad body Expr Str FunctionDef arguments args NameParam defaults body Expr Call AttributeLoad NameLoad attr NameLoad keyword Str keyword Str keyword Str keyword Str keyword Lambda arguments args TupleStore TupleStore NameStore NameStore TupleStore NameStore NameStore defaults BoolOpOr CompareIn NameLoad TupleLoad Num Num Num CompareIn NameLoad TupleLoad Num Num Num keyword Str decorator_list FunctionDef arguments args NameParam NameParam NameParam NameParam NameParam NameParam defaults body If CompareEq NameLoad NameLoad body TryExcept body Assign NameStore Call AttributeLoad NameLoad attr NameLoad Str If UnaryOpNot Call AttributeLoad NameLoad attr Str body Return handlers ExceptHandler body Return Expr Call AttributeLoad NameLoad attr BinOpMod Str TupleLoad AttributeLoad NameLoad attr AttributeLoad NameLoad attr NameLoad Call AttributeLoad NameLoad attr orelse TryExcept body Assign NameStore Call AttributeLoad NameLoad attr NameLoad Str If UnaryOpNot Call AttributeLoad NameLoad attr Str body Return handlers ExceptHandler body Return If BoolOpAnd NameLoad BoolOpOr CompareEq AttributeLoad NameLoad attr Str CompareEq AttributeLoad NameLoad attr Str body Expr Call AttributeLoad NameLoad attr BinOpMod Str TupleLoad AttributeLoad NameLoad attr NameLoad Call AttributeLoad NameLoad attr If CompareNotEq AttributeLoad NameLoad attr Str body Pass decorator_list decorator_list If CompareEq NameLoad Str body Assign NameStore Call NameLoad Print NameLoad orelse Assign NameStore Call NameLoad
N/A N/A dshell N/A util httpdecoder HTTPDecoder DshellDecoder N/A HTTPDecoder N/A N/A 
    15 April 2015

    Proof-of-concept code to detect attempts to enumerate MS15-034 vulnerable
    IIS servers and/or cause a denial of service.  Each event will generate an
    alert that prints out the HTTP Request method and the range value contained
    with the HTTP stream.

    Usage: 
        decode -d ms15-034 -q *.pcap
        decode -d ms15-034 -i <interface> -q 

    References:
    https://technet.microsoft.com/library/security/ms15-034
    https://ma.ttias.be/remote-code-execution-via-http-request-in-iis-on-windows/
     __init__ N/A N/A self N/A N/A N/A N/A N/A HTTPDecoder __init__ self name ms15-034 description detect attempts to enumerate MS15-034 vulnerable IIS servers longdescription 
Proof-of-concept code to detect attempts to enumerate MS15-034 vulnerable
IIS servers and/or cause a denial of service.  Each event will generate an
alert that prints out the HTTP Request method and the range value contained
with the HTTP stream.

Usage: 
decode -d ms15-034 -q *.pcap
decode -d ms15-034 -i <interface> -q
 filter tcp and (port 80 or port 8080 or port 8000) filterfn N/A N/A N/A N/A N/A sip sp N/A dip dp N/A N/A N/A sp N/A 80 8000 8080 N/A dp N/A 80 8000 8080 author bg N/A HTTPHandler N/A N/A self conn request response requesttime responsetime N/A N/A N/A N/A response None N/A N/A N/A N/A rangestr N/A N/A util getHeader request range N/A N/A N/A N/A rangestr endswith 18446744073709551615 N/A N/A N/A N/A N/A N/A N/A N/A N/A self alert N/A MS15-034 DoS [Request Method: "%s" URI: "%s" Range: "%s"] N/A N/A request method N/A request uri rangestr N/A N/A conn info N/A N/A N/A N/A rangestr N/A N/A util getHeader request range N/A N/A N/A N/A rangestr endswith 18446744073709551615 N/A N/A N/A N/A N/A N/A N/A N/A rangestr N/A N/A N/A response status 416 N/A N/A response reason Requested Range Not Satisfiable N/A N/A N/A N/A self alert N/A MS15-034 Vulnerable Server  [Request Method: "%s" Range: "%s"] N/A N/A request method rangestr N/A N/A conn info N/A N/A N/A request method GET N/A N/A N/A N/A N/A N/A __name__ __main__ N/A N/A dObj N/A DshellDecoder N/A dObj N/A N/A dObj N/A DshellDecoder