Let's Dance in the Cache: Destabilizing Hash Tables on Microsoft IIS
Orange Tsai presents groundbreaking research into Microsoft IIS hash table implementations, weaponizing cache collisions and memory layout manipulation for RCE.
Summary
The Fundamental Role of Hash Tables in Web Servers
Hash tables are ubiquitous data structures used by web servers like Microsoft IIS to manage request routing, module pipelines, and output caching.
Reverse Engineering Microsoft IIS Cache Internals
Orange Tsai analyzes the underlying hash algorithms and bucket resolution mechanisms inside the IIS core binary (http.sys and w3core.dll).
Inducing Deterministic Hash Collisions and Cache Confusion
Tsai demonstrates crafting specific URL requests to induce hash collisions, corrupting internal cache tables and overwriting cached authentication states.
Achieving Pre-Auth Remote Code Execution on Windows Servers
The author details weaponizing cache corruption to gain unauthorized remote code execution on fully patched Microsoft IIS servers.
Related talks
Main Stage·36 min
Jeffrey Hofmann
Jeffrey Hofmann details discovering multiple pre-authentication remote code execution chains in Quest KACE Systems Management Appliance (SMA).
Main Stage·45 min
Aaditya Purani · Max Garrett
Aaditya Purani and Max Garrett expose systemic Electron framework misconfigurations, turning standard web XSS into remote code execution across popular desktop apps.
Main Stage·32 min
Samuel Erb · Justin Gardner
Samuel Erb and Justin Gardner share the story of finding and exploiting a complex RCE exploit chain against KASM Workspaces streaming software.