for study purposes I have to break an old apache version, the 1.3.x.
I'm focusing on the chunked encoding vulnerability because it can allow me to execute arbitrary code and, using metasploit, I managed to hack an apache 1.3.9 version on windows xp sp2.
Problem is that I have to do this on a compiled version too...the metasploit hacking seems to work just with the binaries, if I compile myself the apache 1.3.9 the exploit seems to not work.
Final objective is to inject some detection code into apache's source code, so just hacking the binary version is not enough...can you help me out?
It's really strange because compilation goes just fine, I did it by command line using vc++ 6 with command:
nmake /f _apacher
as guide suggests....moreover I checked source code too and it presents the boundary condition which is used by the exploit.
by the way I came to discover what piece of code was exploited by reading a comment on an exploit's source code found in the web, if you have some good reference to this chunked encoding exploit be free to direct me as I'd like to understand better (I already checked securityfocus.com and nist but they just mention the weakness, I'd like some deepest analysis).