Description
This module exploits a stack buffer overflow in iTunes 10.4.0.80 to 10.6.1.7. When opening an extended .m3u file containing an "#EXTINF:" tag description, iTunes will copy the content after "#EXTINF:" without appropriate checking from a heap buffer to a stack buffer, writing beyond the stack buffer's boundary, which allows code execution under the context of the user.
Please note before using this exploit, you must have precise knowledge of the victim machine's QuickTime version (if installed), and then select your target accordingly.
In addition, even though this exploit can be used as remote, you should be aware the victim's browser behavior when opening an itms link. For example, IE/Firefox/Opera by default will ask the user for permission before launching the itms link by iTunes. Chrome will ask for permission, but also spits a warning. Safari would be an ideal target, because it will open the link without any user interaction.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/windows/misc/itunes/extm3u_bofmsf undefined(extm3u_bof) > show actions ...actions...msf undefined(extm3u_bof) > set ACTION < action-name >msf undefined(extm3u_bof) > show options ...show and set options...msf undefined(extm3u_bof) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub