Exploit-DB #14843
Description: Apple QuickTime - '_Marshaled_pUnk' Backdoor Client-Side Arbitrary Code Execution
Type: dos
Platform: windows
Date: 2010-08-30
Author: Ruben Santamarta

Exploit:
Original Source: http://reversemode.com/index.php?option=com_content&task=view&id=69&Itemid=1

Victim prerequisites:

* Internet Explorer.
* XP,Vista,W7.
* Apple Quicktime 7.x, 6.x ( 2004 versions are also vulnerable, older versions not checked )

1. Victim is enticed into visiting, by any mean, a specially crafted webpage.
2. Attacker's payload to be executed under the context of the browser.
3. Attacker calls his girlfriend to inform about the successful exploitation, who indeed turns out to be very interested in the issue. She demands more technical details.
4. Attacker wakes up.


Technical details

QTPlugin.ocx implements IPersistPropertyBag2::Read (1000E330) to handle params received from where it is embedded, including HTML documents.

Let's take a look

.text:1000E330
.text:1000E330 ; =============== S U B R O U T I N E =======================================
.text:1000E330
.text:1000E330
.text:1000E330 sub_1000E330    proc near               ; DATA XREF: .rdata:1002E0ECo
.text:1000E330                                         ; .rdata:1002E86Co
.text:1000E330
.text:1000E330 arg_0           = dword ptr  4
.text:1000E330 arg_4           = dword ptr  8
.text:1000E330 arg_8           = dword ptr  0Ch
.text:1000E330
.text:1000E330                 push    esi
.text:1000E331                 mov     esi, [esp+4+arg_0]
.text:1000E335                 mov     ecx, [esi+84h]
.text:1000E33B                 xor     eax, eax
.text:1000E33D                 test    ecx, ecx
.text:1000E33F                 jz      short loc_1000E393
.text:1000E341                 mov     eax, [esp+4+arg_8]
.text:1000E345                 mov     edx, [esp+4+arg_4]
.text:1000E349                 push    eax
.text:1000E34A                 push    edx
.text:1000E34B                 call    sub_100031F0 



Following the flow...

sub_10002980+27A
sub_10002980+27A  loc_10002BFA:                           ; CODE XREF: sub_10002980+266j
sub_10002980+27A                                          ; sub_10002980+272j
sub_10002980+27A                  push    offset aType    ; "type"
sub_10002980+27F                  push    ebx             ; lpString1
sub_10002980+280                  call    ebp ; lstrcmpiA
sub_10002980+282                  test    eax, eax
sub_10002980+284                  jnz     short loc_10002C22
sub_10002980+286                  push    edi             ; lpString
sub_10002980+287                  call    ds:lstrlenA
sub_10002980+28D                  cmp     eax, 104h
sub_10002980+292                  jnb     short loc_10002C22
sub_10002980+294                  push    edi             ; lpString2
sub_10002980+295                  lea     edx, [esi+83Ch]
sub_10002980+29B                  push    edx             ; lpString1
sub_10002980+29C                  call    ds:lstrcpyA
sub_10002980+2A2
sub_10002980+2A2  loc_10002C22:                           ; CODE XREF: sub_10002980+284j
sub_10002980+2A2                                          ; sub_10002980+292j
sub_10002980+2A2                  push    offset a_marshaled_pun ; "_Marshaled_pUnk"
sub_10002980+2A7                  push    ebx             ; lpString1
sub_10002980+2A8                  call    ebp ; lstrcmpiA
sub_10002980+2AA                  test    eax, eax
sub_10002980+2AC                  jnz     short loc_10002C4A
sub_10002980+2AE                  push    edi
sub_10002980+2AF                  call    sub_10001310   ; SIMPLE ASCII NUMBERS TO LONG routine
sub_10002980+2B4                  add     esp, 4
sub_10002980+2B7                  lea     ecx, [esi+13B8h]
sub_10002980+2BD                  push    ecx             ; ppv
sub_10002980+2BE                  push    offset iid      ; iid
sub_10002980+2C3                  push    eax             ; pStm
sub_10002980+2C4                  call    ds:CoGetInterfaceAndReleaseStream  ; WE HAVE A WINNER!!
sub_10002980+2CA
sub_10002980+2CA  loc_10002C4A:                           ; CODE XREF: sub_10002980+2ACj
sub_10002980+2CA                  push    edi             ; int




Oops! programming rules state that hidden properties should be preceded by "_" so this property matches the requirement. It's time to google "_Marshaled_pUnk" which brings us 0 results. Apple scripting guide for Quicktime does not even mention it. Weird.

What's is going on here?

QTPlugin.OCX checks for the existence of "_Marshaled_pUnk" within object's attributes, if so, unmarshals it by converting the address from its ascii representation into a numerical one ( sub_10001310 ). Then, it uses the resulting pointer as pStm,"A pointer to the IStream interface on the stream to be unmarshaled", CoGetInterfaceAndReleaseStream in order to obtain the IUnknown pointer (pUnk from now on) of the marshalled interface. This method is pretty common for sharing interface pointers between threads within COM enabled scenarios ( e.g browsers + plugins ).

So we are controlling an IStream pointer, which is good :)

However at this point the things didn't make sense for me. Despite of the fact that a CPluginHost object's variable holds this pointer (pPlugin+0x13b8), pUnk is never used,. According to the COM model, this pointer shouldn't be used by any other thread. Why in the hell an apple engineer implemented this? A conspiration between NSA, FSB and the bloody Andorra's secret service may be possible but I think there must be another explanation.

Back to the future

So I am downloading an older version of QTPlugin.ocx, which dates from 2004 (6.5.1.17), to try to explain an issue in 2010, cool.

Module: QTPlugin.ocx

.text:6670BE86                 mov     eax, [ebp+1480h ; pPlugin->pUnk ]
.text:6670BE8C                 cmp     eax, edi
.text:6670BE8E                 jz      short loc_6670BEF7
.text:6670BE90                 lea     edx, [esp+7Ch+pHandles]
.text:6670BE97                 mov     [esp+7Ch+pHandles], edi
.text:6670BE9E