module

Apache Win32 Chunked Encoding

Try Surface Command
Back to search
Disclosed
2002-06-19
Created
2018-05-30

Description

This module exploits the chunked transfer integer wrap
vulnerability in Apache version 1.2.x to 1.3.24. This
particular module has been tested with all versions of the
official Win32 build between 1.3.9 and 1.3.24. Additionally,
it should work against most co-branded and bundled versions
of Apache (Oracle 8i, 9i, IBM HTTPD, etc).

You will need to use the Check() functionality to determine
the exact target version prior to launching the exploit. The
version of Apache bundled with Oracle 8.1.7 will not
automatically restart, so if you use the wrong target value,
the server will crash.

Authors

hdm x@hdm.io
jduck jduck@metasploit.com

Platform

Windows

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:


    msf > use exploit/windows/http/apache_chunked
    msf exploit(apache_chunked) > show targets
        ...targets...
    msf exploit(apache_chunked) > set TARGET < target-id >
    msf exploit(apache_chunked) > show options
        ...show and set options...
    msf exploit(apache_chunked) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today