Dumping Application Memory (iOS Attacks) Part of the iOS attacks.

[Cyberizm]

Objective-C:​

Vulnerable Code:

NSString *offsetsCommand = @"python";
NSArray *arguments = @[@"-c", @"hex(0x00008000 + 0x007a0000)"];
NSString *result = [self executeCommandffsetsCommand withArguments:arguments];
NSString *memoryReadCommand = [NSString stringWithFormat"memory read --force --outfile /tmp/mem.bin --binary 0x00008000 %@", result];
[self executeCommand:memoryReadCommand];
NSString *ddCommand = @"dd bs=1 seek=0x8000 conv=notrunc if=/tmp/mem.bin of=Snapchat-decrypted";
[self executeCommand:ddCommand];
// Additional steps for modifying the binary and copying it back to the device
Description: This code snippet executes shell commands without proper input sanitization, making it vulnerable to command injection attacks. An attacker could potentially manipulate the arguments array to inject malicious commands.

Patched Code:

NSTask *offsetsTask = [[NSTask alloc] init];
[offsetsTask setLaunchPath"/usr/bin/python"];
[offsetsTask setArguments[@"-c", @"hex(0x00008000 + 0x007a0000)"]];
NSPipe *pipe = [NSPipe pipe];
[offsetsTask setStandardOutput:pipe];
[offsetsTask launch];
[offsetsTask waitUntilExit];
NSData *data = [[pipe fileHandleForReading] readDataToEndOfFile];
NSString *result = [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
NSString *memoryReadCommand = [NSString stringWithFormat"memory read --force --outfile /tmp/mem.bin --binary 0x00008000 %@", result];
NSTask *memoryReadTask = [[NSTask alloc] init];
[memoryReadTask setLaunchPath"/usr/bin/lldb"];
[memoryReadTask setArguments[@"-c", memoryReadCommand]];
[memoryReadTask launch];
// Additional steps for modifying the binary and copying it back to the device
Description: The patched code utilizes NSTask to execute shell commands with proper input handling, mitigating the risk of command injection attacks. It reads the output of the Python command safely and constructs the subsequent commands accordingly.

Swift:

Vulnerable Code:

let offsetsCommand = "python"
let arguments = ["-c", "hex(0x00008000 + 0x007a0000)"]
let result = executeCommand(command: offsetsCommand, arguments: arguments)
let memoryReadCommand = "memory read --force --outfile /tmp/mem.bin --binary 0x00008000 \(result)"
executeCommand(command: memoryReadCommand)
let ddCommand = "dd bs=1 seek=0x8000 conv=notrunc if=/tmp/mem.bin of=Snapchat-decrypted"
executeCommand(command: ddCommand)
// Additional steps for modifying the binary and copying it back to the device
Description: This Swift code snippet is vulnerable to command injection attacks as it directly interpolates the result variable into the memoryReadCommand string, without proper validation.

Patched Code:

let offsetsCommand = "/usr/bin/python"
let arguments = ["-c", "hex(0x00008000 + 0x007a0000)"]
let result = executeCommand(command: offsetsCommand, arguments: arguments)
let memoryReadCommand = "/usr/bin/lldb -c 'memory read --force --outfile /tmp/mem.bin --binary 0x00008000 \(result)'"
executeCommand(command: memoryReadCommand)
// Additional steps for modifying the binary and copying it back to the device
Description: The patched Swift code employs a safer approach by directly specifying the executable paths and arguments, reducing the risk of command injection attacks. It uses lldb to execute the memory read command securely.

Inspecting Binaries​

Objective-C:

Vulnerable Code:

NSString *binaryName = @"MobileMail";
NSString *command = [NSString stringWithFormat"otool -IV %@", binaryName];
NSString *result = [self executeCommand:command];
Description: This code snippet executes the otool command without proper input sanitization, which could lead to command injection attacks if the binaryNamevariable is manipulated by an attacker.

Patched Code:

NSString *binaryName = @"MobileMail";
NSString *command = [NSString stringWithFormat"/usr/bin/otool -IV %@", binaryName];
NSString *result = [self executeCommand:command];
Description: The patched code specifies the full path of the otool command, reducing the risk of command injection attacks by ensuring that only the intended command is executed.

Swift:

Vulnerable Code:

let binaryName = "MobileMail"
let command = "otool -IV \(binaryName)"
let result = executeCommand(command: command)
Description: Similar to the Objective-C vulnerable code, this Swift code snippet is susceptible to command injection attacks as it directly interpolates the binaryNamevariable into the command string without proper validation.

Patched Code:

let binaryName = "MobileMail"
let command = "/usr/bin/otool -IV \(binaryName)"
let result = executeCommand(command: command)
Description: The patched Swift code specifies the full path of the otool command, mitigating the risk of command injection attacks by ensuring that only the intended command is executed.