ed0e1e4d44
1979 changes to exploits/shellcodes Couchdb 1.5.0 - 'uuids' Denial of Service Apache CouchDB 1.5.0 - 'uuids' Denial of Service Beyond Remote 2.2.5.3 - Denial of Service (PoC) udisks2 2.8.0 - Denial of Service (PoC) Termite 3.4 - Denial of Service (PoC) SoftX FTP Client 3.3 - Denial of Service (PoC) Silverstripe 2.3.5 - Cross-Site Request Forgery / Open redirection SilverStripe CMS 2.3.5 - Cross-Site Request Forgery / Open Redirection Silverstripe CMS 3.0.2 - Multiple Vulnerabilities SilverStripe CMS 3.0.2 - Multiple Vulnerabilities Silverstripe CMS 2.4 - File Renaming Security Bypass SilverStripe CMS 2.4 - File Renaming Security Bypass Silverstripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities SilverStripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities Silverstripe CMS 2.4.7 - 'install.php' PHP Code Injection SilverStripe CMS 2.4.7 - 'install.php' PHP Code Injection Silverstripe Pixlr Image Editor - 'upload.php' Arbitrary File Upload SilverStripe CMS Pixlr Image Editor - 'upload.php' Arbitrary File Upload Silverstripe CMS 2.4.x - 'BackURL' Open Redirection SilverStripe CMS 2.4.x - 'BackURL' Open Redirection Silverstripe CMS - 'MemberLoginForm.php' Information Disclosure SilverStripe CMS - 'MemberLoginForm.php' Information Disclosure Silverstripe CMS - Multiple HTML Injection Vulnerabilities SilverStripe CMS - Multiple HTML Injection Vulnerabilities Apache CouchDB 1.7.0 and 2.x before 2.1.1 - Remote Privilege Escalation Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation Monstra CMS before 3.0.4 - Cross-Site Scripting Monstra CMS < 3.0.4 - Cross-Site Scripting (2) Monstra CMS < 3.0.4 - Cross-Site Scripting Monstra CMS < 3.0.4 - Cross-Site Scripting (1) Navigate CMS 2.8 - Cross-Site Scripting Collectric CMU 1.0 - 'lang' SQL injection Joomla! Component CW Article Attachments 1.0.6 - 'id' SQL Injection LG SuperSign EZ CMS 2.5 - Remote Code Execution MyBB Visual Editor 1.8.18 - Cross-Site Scripting Joomla! Component AMGallery 1.2.3 - 'filter_category_id' SQL Injection Joomla! Component Micro Deal Factory 2.4.0 - 'id' SQL Injection RICOH Aficio MP 301 Printer - Cross-Site Scripting Joomla! Component Auction Factory 4.5.5 - 'filter_order' SQL Injection RICOH MP C6003 Printer - Cross-Site Scripting Linux/ARM - Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (28 Bytes) Linux/ARM - sigaction() Based Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (52 Bytes)
35 lines
No EOL
2.4 KiB
Text
35 lines
No EOL
2.4 KiB
Text
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1289
|
|
|
|
The exploit gains code execution on the Wi-Fi firmware on the iPhone 7.
|
|
|
|
The exploit has been tested against the Wi-Fi firmware as present on iOS 10.2 (14C92), but should work on all versions of iOS up to 10.3.3 (included). However, some symbols might need to be adjusted for different versions of iOS, see "exploit/symbols.py" for more information.
|
|
|
|
Upon successful execution of the exploit, a backdoor is inserted into the firmware, allowing remote read/write commands to be issued to the firmware via crafted action frames (thus allowing easy remote control over the Wi-Fi chip).
|
|
|
|
The attached archive contains the following directories:
|
|
-hostapd-2.6 - A modified version of hostapd utilised in the exploit. This version of hostapd is configured to
|
|
support 802.11k RRM, and in particular Neighbor Reports. Moreover, this version of hostapd is
|
|
instrumented to add various commands, allowing injection and reception of crafted action frames
|
|
used throughout the exploit.
|
|
-exploit - The exploit itself.
|
|
|
|
To run the exploit, you must execute the following steps:
|
|
-Connect (and enable) a SoftMAC Wi-Fi dongle to your machine (such as the TL-WN722N)
|
|
-Compile the provided version of hostapd
|
|
-Modify the "interface" setting under "hostapd-2.6/hostapd/hostapd.conf" to match your interface's name
|
|
-Configure the following settings under "exploit/conf.py":
|
|
-HOSTAPD_DIR - The directory of the hostapd binary compiled above
|
|
-TARGET_MAC - The MAC address of the device being exploited
|
|
-AP_MAC - The MAC address of your wireless dongle
|
|
-INTERFACE - The name of the wireless dongle's interface
|
|
-Assemble the backdoor shellcode by running "exploit/assemble_backdoor.sh"
|
|
-Run hostapd with the configuration file provided above, broadcasting a Wi-Fi network ("test80211k")
|
|
-Connect the target device to the network
|
|
-Run "exploit/attack.py"
|
|
|
|
Following the steps above should result in installation of a simple backdoor allowing read/write access to the firmware. You can interact with the backdoor to gain R/W access to the firmware by calling the "read_dword" and "write_dword" functions, respectively.
|
|
|
|
|
|
Proof of Concept:
|
|
|
|
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/42784.zip |