Subreption blog

Wed, 28 Nov 2007

Quicktime RTSP Redux released

While we wouldn't release exploit code under normal circumstances, we are pretty much emerging and wanted to show an example of our work. Since this vulnerability was already public, and the Apple security people are most probably working on an imminent update to Quicktime, potential attackers have a limited time-span to abuse it.

Hopefully Apple will speed up on this one and release an update to fix the vulnerability. We enjoy the versatility of Mac OS X on daily basis, and want it to be as more secure as possible.

Thanks to Kevin Finisterre for the testing environment and proofing of the exploit on PowerPC. Thanks to HD Moore for suggestions and the Metasploit project.

The exploit code is available at: static.subreption.com/public/exploits/qtimertsp_redux.rb

Some improvements that might be released:

Better PowerPC target information.
Reliable Microsoft Windows Vista target.
Reliabe Leopard target for x86.

Some screenshots might illustrate the functionality included in the exploit a bit better:

Mac OS X Targets...

Exploit against Mac OS X Tiger Quicktime 7.3

Microsoft Windows Targets...

Memory dump of the payload for Microsoft Windows Executing the exploit from a Microsoft Windows Vista host Connected to a XP SP2 vulnerable host from Microsoft Windows Vista