Stack Buffer Overflow in WebMod 0.48 connectHandle

This repository is a small standalone exploit PoC for CVE-2007-1260 affecting WebMod 0.48, a module used with Half-Life Dedicated Server (HLDS). It contains two files: a README describing the vulnerability, affected versions, exploitation notes, and suggested gadget locations; and a single C source file, w48crash.c, which is the actual exploit entry point. The exploit is a network-delivered stack buffer overflow triggered through an HTTP POST request. According to the README, WebMod allocates an 11-byte stack buffer for the Content-Length value but copies attacker-controlled data until newline/null without bounds checking. The PoC abuses this by connecting to a target host over TCP, defaulting to port 27015, and sending a crafted request beginning with "POST / HTTP/1.1\nHost: localhost:27015\nContent-Length: ". It then transmits a very large Content-Length field: seven 20,000-byte filler chunks plus 18,308 additional bytes to reach the saved return address, overwrites EIP with a hardcoded jmp esp address, appends shellcode, and terminates the header with two newlines. The code is clearly exploitative rather than merely demonstrative detection logic. It performs hostname resolution, socket creation, TCP connection, staged sending of the malicious request, and a delay to keep the socket open long enough for the target to receive the payload. The included payload is operational but not broadly portable: it is hardcoded Windows x86 shellcode intended for a specific Win2K SP4 environment with fixed API addresses. Its behavior is to display a MessageBox containing "HI!" and then terminate the process. The README also notes that setting the EIP value to 0xFFFFFFFF can be used to produce a crash-only denial of service. Overall, this is a genuine standalone exploit PoC with both DoS and RCE capability. Its structure is minimal, with one documentation file and one Windows C exploit source file. The main fingerprintable target characteristics are the HTTP POST handling path, the oversized Content-Length header, and the typical HLDS/WebMod listening port 27015.