ios-exploit

name	iOS Exploit
description	iOS vulnerability hunting and exploitation — IPA analysis, kernel exploits, sandbox escape
tags	["ios","iphone","ipad","exploit","mobile","mach-o","kernel"]

Task: iOS Vulnerability Hunting and Exploitation. Analyze IPAs, find vulnerabilities, develop exploits.

Approach

iOS security requires: Mach-O binary analysis, Objective-C/Swift reverse engineering, kernel exploitation, sandbox escape.

Phase 1: IPA Analysis

IPA Decryption

Encrypted apps: App Store apps are encrypted

Decryption tools:
- clutch: Decrypt App Store apps
- CrackerXI+: Alternative decryption
- frida-ios-dump: Dynamic dump

Process:
1. Install app on jailbroken device
2. Decrypt: clutch -f com.victim.app
3. Extract decrypted IPA
4. Analyze binaries

Binary Extraction

IPA structure:
Payload/
├── MyApp.app/
│   ├── MyApp (Mach-O binary)
│   ├── Info.plist
│   ├── Frameworks/
│   └── *.dylib

Extraction:
1. Unzip: unzip app.ipa
2. Locate: Payload/*.app/
3. Extract: Mach-O binary
4. Identify: Architecture (arm64, armv7)

Class Dump

Objective-C runtime:
- class-dump: Dump class headers
- class-dump-dyld: For dyld_shared_cache
- hsd: Modern alternative

Usage:
class-dump MyApp

Output:
@interface MyClass : NSObject {
    NSString *_privateKey;
    BOOL _isVulnerable;
}
- (void)vulnerableMethod:(NSString *)input;
- (void)exploitMe;
@end

Phase 2: Mach-O Binary Analysis

Mach-O Structure

Mach-O format:
- Mach header: Magic, architecture, flags
- Load commands: Segments, dylibs, encryption
- Sections: __TEXT, __DATA, __OBJC
- Symbols: Functions, classes, methods

Analysis tools:
- otool: Object file displaying
- nm: Symbol display
- lipo: Multi-architecture binaries
- Hopper/IDA/Ghidra: Disassembly

Objective-C Runtime Analysis

Key structures:
- __objc_classlist: Class definitions
- __objc_protolist: Protocol definitions
- __objc_selrefs: Selector references
- __objc_classrefs: Class references
- __objc_superrefs: Superclass references

Reverse engineering:
1. Find classes in __objc_classlist
2. Analyze method implementations
3. Identify vulnerable methods
4. Trace call graphs
5. Find exploit primitives

Swift Runtime Analysis

Swift metadata:
- __swift5_typeref: Type references
- __swift5_protos: Protocol conformances
- __swift5_fieldmd: Field metadata
- __swift5_types: Type metadata

Analysis:
1. Locate Swift metadata sections
2. Parse type information
3. Identify Swift classes
4. Analyze method tables
5. Find vulnerability patterns

Phase 3: Application-Level Vulnerabilities

Keychain Data Extraction

Vulnerability: Insecure keychain access

Attack:
1. Identify keychain items
2. Extract with Security framework
3. Decrypt if accessible
4. Extract credentials, tokens

Code:
#include <Security/Security.h>

NSDictionary* query = @{
    (id)kSecClass: (id)kSecClassGenericPassword,
    (id)kSecReturnData: (id)kCFBooleanTrue,
    (id)kSecMatchLimit: (id)kSecMatchLimitAll
};
CFTypeRef result = NULL;
SecItemCopyMatching((__bridge CFDictionaryRef)query, &result);

UserDefaults Extraction

Vulnerability: Sensitive data in UserDefaults

Attack:
1. Identify app's plist file
2. Extract: /var/mobile/Containers/Data/Application/{UUID}/Library/Preferences/*.plist
3. Parse plist data
4. Extract sensitive information

Tools:
- plutil: Parse plist files
- defaults: Read/write defaults
- Frida: Hook NSUserDefaults

Pasteboard Monitoring

Vulnerability: Apps read pasteboard without permission

Attack:
1. Monitor UIPasteboard changes
2. Extract copied data
2. Steal passwords, tokens
3. Background monitoring

Frida script:
UIPasteboard.generalBoard.string.watch(function(value) {
    console.log("Pasteboard: " + value);
});

URL Scheme Hijacking

Vulnerability: Insecure URL scheme handling

Attack:
1. Identify URL schemes
2. Craft malicious URLs
3. Trigger from Safari/other app
4. Exploit vulnerable handlers

Example:
myapp://exploit?param=<script>alert(1)</script>
myapp://file:///etc/passwd
myapp://x-callback-url?action=delete

Phase 4: IPC Vulnerabilities

XPC Exploitation

XPC (Cross-Process Communication):
- Inter-process communication
- Privileged helper services
- System daemons

Vulnerabilities:
- Missing entitlement checks
- Weak validation
- Memory corruption in XPC messages
- Privilege escalation

Attack:
1. Identify exposed XPC services
2. Analyze message handlers
3. Craft malicious XPC messages
4. Trigger vulnerabilities
5. Gain elevated privileges

SpringBoard Exploitation

SpringBoard vulnerabilities:
- Icon handling (CVE-2019-8645)
- Widget vulnerabilities
- Notification center bugs
- Lock screen bypass

Exploitation:
1. Trigger from sandboxed app
2. Exploit SpringBoard bug
3. Escape sandbox
4. Gain system access
5. Persistent access

Pasteboard/Jailbreak Detection

Bypass techniques:
1. Hook detection functions
2. Patch checks
3. Manipulate environment
4. Hide jailbreak files

Frida bypass:
// Hook jailbreak detection
if (ObjC.available) {
    const JailbreakDetection = ObjC.classes.JailbreakDetection;
    Interceptor.attach(JailbreakDetection["- isJailbroken"].implementation, {
        onLeave: function(retval) {
            retval.replace(0x0); // Return false
        }
    });
}

Phase 5: Memory Corruption

Heap Overflow

Targets:
- Foundation classes (NSArray, NSDictionary)
- UI components (UILabel, UIView)
- Custom objects
- C++ objects (std::vector, std::string)

Exploitation:
1. Identify overflow vulnerability
2. Control object allocation
3. Overflow adjacent objects
4. Corrupt object pointers
5. Control program flow
6. Bypass ASLR/DEP

Stack Buffer Overflow

Targets:
- C string functions (strcpy, sprintf)
- Objective-C methods
- Swift unsafe pointers
- Core Foundation APIs

Exploitation:
1. Trigger stack overflow
2. Overwrite return address
3. Build ROP chain
4. Bypass stack canaries
5. Execute shellcode

Use-After-Free

Targets:
- Objective-C objects (use after release)
- C++ objects (dangling pointers)
- Core Foundation objects
- UI components

Exploitation:
1. Trigger object free
2. Realloc with controlled data
3. Call virtual function on freed object
4. Execute controlled function pointer
5. Gain code execution

Integer Overflow

Targets:
- Array allocations
- Buffer size calculations
- Reference counting
- Length parameters

Exploitation:
1. Trigger integer overflow
2. Allocate small buffer
3. Copy large data
4. Overflow buffer
5. Corrupt adjacent memory

Phase 6: Kernel Exploitation

IOSurface Vulnerabilities

IOSurface: Fast user-kernel shared memory

Vulnerabilities:
- CVE-2019-8795: Use-after-free
- CVE-2020-3876: Buffer overflow
- CVE-2020-27950: Race condition

Exploitation:
1. Create IOSurface objects
2. Trigger kernel vulnerability
3. Gain kernel memory read/write
4. Disable code signing
5. Escape sandbox
6. Gain root access

Mach Message Vulnerabilities

Mach ports: IPC mechanism

Vulnerabilities:
- CVE-2018-4407: Use-after-free
- CVE-2019-8645: Stack overflow
- CVE-2020-27932: Type confusion

Exploitation:
1. Craft malicious mach messages
2. Trigger kernel bug
3. Gain kernel R/W
4. Patch kernel memory
5. Disable security checks

XPC Kernel Exploitation

XPC in kernel:
- Privileged operations
- System services

Vulnerabilities:
- Missing validation
- Memory corruption
- Race conditions

Exploitation:
1. Identify vulnerable XPC service
2. Craft malicious XPC message
3. Trigger kernel vulnerability
4. Gain kernel code execution
5. Disable sandbox/Code Signing

Phase 7: Sandbox Escape

Sandbox Vulnerabilities

Sandbox: Profile-based access control

Vulnerabilities:
- Profile bypass
- Missing rules
- Race conditions
- Logic errors

Exploitation:
1. Analyze sandbox profile
2. Find bypass techniques
3. Escape sandbox
4. Access system resources
5. Access other apps' data

Code Signing Bypass

Code signing: Enforces executable signing

Bypass techniques:
1. Kernel exploit → Disable signing
2. Patch amfid
3. Substitute certificates
4. JIT write (via kernel exploit)

Impact:
- Execute unsigned code
- Bypass App Store
- Run arbitrary binaries
- Inject code into processes

AMEF / Codesign Bypass

AMEF (Apple Mobile File Integrity):
- Enforces code signing
- Validates executable pages

Bypass:
1. Kernel exploit → Disable AMEF
2. Patch amfid
3. Substitute with fake amfid
4. Disable signature checks

Result:
- Run unsigned code
- Inject code into apps
- Bypass all security checks

Phase 8: Exploit Development

Tweak Development (Theos)

Theos: iOS tweak development framework

Example exploit:
#include <theos/theos.h>

%hook ClassName
- (void)vulnerableMethod:(NSString *)input {
    %orig;
    // Exploit code here
    NSLog(@"Exploited with input: %@", input);
}
%end

Compile:
make package install

Cydia Substrate

Substrate: Runtime hooking framework

Hook example:
MSHookMessageEx(
    objc_getClass("ClassName"),
    @selector(vulnerableMethod:),
    (IMP)&exploitMethod,
    NULL
);

void exploitMethod(id self, SEL _cmd, NSString *input) {
    // Exploit code
    _log(input);
}

Frida Dynamic Instrumentation

Frida: JavaScript instrumentation

Hook example:
if (ObjC.available) {
    var className = ObjC.classes.ClassName;
    var method = className["- vulnerableMethod:"];
    
    Interceptor.attach(method.implementation, {
        onEnter: function(args) {
            var input = ObjC.Object(args[2]);
            console.log("Input: " + input.toString());
        },
        onLeave: function(retval) {
            console.log("Return: " + retval);
        }
    });
}

Phase 9: Testing and Validation

Device Testing

Requirements:
- Jailbroken device (checkra1n, unc0ver)
- SSH access (alpine password)
- Frida server
- Debugging tools

Setup:
1. Jailbreak device
2. Install OpenSSH
3. Install Frida
4. Install Frida-server on device
5. Connect via SSH
6. Deploy exploits

Simulator Testing

iOS Simulator:
- Easier debugging
- No jailbreak needed
- Limited kernel access

Setup:
1. Install Xcode
2. Create iOS simulator
3. Deploy test app
4. Test vulnerabilities
5. Debug with LLDB

Final Report

[VULNERABILITY] iOS Keychain Disclosure
App: com.victim.app (v3.1.2)
Severity: HIGH (credential theft)
CVE: N/A (0-day)

[Bug Details]
Component: Keychain access
Vulnerability: No access control on keychain items
Location: KeychainManager.m:89
Code: No kSecAttrAccessGroup specified

[Exploitation]
1. Malicious app accesses keychain
2. Queries with null access group
3. Extracts all keychain items
4. Retrieves: passwords, tokens, certificates

[POC Tweak]
#import <theos/theos.h>

%hook KeychainManager
- (BOOL)saveItem:(NSDictionary *)item {
    // Log keychain data
    NSLog(@"Keychain save: %@", item);
    return %orig;
}
%end

[POC App]
- Entitlements: None required
- Attack: Read all keychain items
- Impact: Extract 1000+ user credentials

Fix: Specify kSecAttrAccessGroup in queries

Tools

Analysis:

• class-dump, Hopper, IDA Pro, Ghidra
• Frida, Cycript
• otool, nm, lipo

Exploitation:

• Theos, Cydia Substrate
• Frida
• Custom apps

Testing:

• Jailbroken devices
• iOS Simulator
• LLDB debugger

Target Versions

• iOS 10 - 17
• arm64, arm64e
• iPhone, iPad, iPod Touch
• Device-specific exploits