Rapid7

module

Apache Win32 Chunked Encoding

Try Surface Command
Back to search
Disclosed
Jun 19, 2002
Created
May 30, 2018

Description

This module exploits the chunked transfer integer wrap
vulnerability in Apache version 1.2.x to 1.3.24. This
particular module has been tested with all versions of the
official Win32 build between 1.3.9 and 1.3.24. Additionally,
it should work against most co-branded and bundled versions
of Apache (Oracle 8i, 9i, IBM HTTPD, etc).

You will need to use the Check() functionality to determine
the exact target version prior to launching the exploit. The
version of Apache bundled with Oracle 8.1.7 will not
automatically restart, so if you use the wrong target value,
the server will crash.

Authors

hdm [email protected]
jduck [email protected]

Platform

Windows

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use exploit/windows/http/apache_chunked
    msf exploit(apache_chunked) > show targets
        ...targets...
    msf exploit(apache_chunked) > set TARGET < target-id >
    msf exploit(apache_chunked) > show options
        ...show and set options...
    msf exploit(apache_chunked) > exploit
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report