search

WithSecureLabs / needle

The iOS Security Testing Framework
https://mobiletools.mwrinfosecurity.com/
Other
1.33k stars 284 forks source link

Needle receives no results from any modules #141

Closed cobbr closed 7 years ago

cobbr commented 7 years ago

Issue

Upon executing any modules, Needle successfully connects via SSH and to the agent, but never returns any results from the modules.

Expected behaviour

I expect output from the modules.

Actual behaviour

Needle freezes. Ctrl+C works to stop the module, but no output is received. I have tried this on several modules.

Steps to reproduce

  1. Install needle
  2. Install NeedleAgent on device
  3. Start needle, set options
  4. Run module

needle error logs

[needle] > info
[needle] > set APP <removed>
APP => <removed>
[needle] > set PASSWORD <removed>
PASSWORD => ********
[needle] > set VERBOSE True
VERBOSE => True
[needle] > set DEBUG True
DEBUG => True
[needle] > set SETUP_DEVICE True
SETUP_DEVICE => True
[needle] > use binary/info/metadata
[needle][metadata] > run
[D] Setup local output folder: /root/.needle/output
[*] Checking connection with device...
[V] Connection not present, creating a new instance
[D] Setting up USB port forwarding on port 2222
[D] [LOCAL CMD] Local Subprocess Command: /opt/needle/needle/libs/usbmuxd/tcprelay.py -t 22:2222
[D] [AGENT] Setting up port forwarding on port 4444
[V] [AGENT] Connecting to agent (127.0.0.1:4444)...
[+] [AGENT] Successfully connected to agent (127.0.0.1:4444)...
[V] [SSH] Connecting (127.0.0.1:2222)...
[+] [SSH] Connected (127.0.0.1:2222)
[D] Creating temp folder: /var/root/needle/
[D] [REMOTE CMD] Remote Command: if [ -d /var/root/needle/ ]; then echo "yes"; else echo "no" ; fi
[D] [AGENT] Executing command: os_version
[D] [AGENT] Attempting to reading result

No output is ever returned.

Environment

Workstation Operating System

Kali 2 Rolling

Python Version

Python 2.7.13

Python Packages (pip freeze)

(needle) root@mobile:/opt/needle/needle# pip freeze
appdirs==1.4.0
argh==0.26.2
backports-abc==0.5
backports.ssl-match-hostname==3.5.0.1
biplist==1.0.1
blinker==1.4
brotlipy==0.6.0
certifi==2017.1.23
cffi==1.9.1
click==6.7
colorama==0.3.7
ConfigArgParse==0.11.0
construct==2.5.3
cryptography==1.7.2
cssutils==1.0.1
EditorConfig==0.12.1
enum34==1.1.6
Flask==0.11.1
frida==9.1.1
h2==2.4.3
hpack==2.3.0
html2text==2016.9.19
hyperframe==4.0.1
idna==2.2
ipaddress==1.0.18
itsdangerous==0.24
Jinja2==2.9.5
jsbeautifier==1.6.4
lxml==3.6.0
MarkupSafe==0.23
mitmproxy==0.18.3
packaging==16.8
paramiko==2.1.1
passlib==1.6.5
pathtools==0.1.2
Pillow==3.4.2
pkg-resources==0.0.0
prompt-toolkit==1.0.10
pyasn1==0.1.9
pycparser==2.17
Pygments==2.2.0
pyOpenSSL==16.2.0
pyparsing==2.1.10
pyperclip==1.5.27
PyYAML==3.12
readline==6.2.4.1
requests==2.11.1
singledispatch==3.4.0.3
six==1.10.0
sshtunnel==0.1.2
tornado==4.4.2
typing==3.5.2.2
urwid==1.3.1
watchdog==0.8.3
wcwidth==0.1.7
Werkzeug==0.11.15

Device iOS Version

iOS 10.2

marco-lancini commented 7 years ago

Hi @cobbr, can you confirm that the needle agent has been on the foreground (i.e., app visible on screen) for the entire time?

cobbr commented 7 years ago

Yes, the agent remained in the foreground. Has the agent been tested on 10.2?

marco-lancini commented 7 years ago

Yep, one of my devices runs 10.2

cobbr commented 7 years ago

Hmmm is there any other output I can provide that would help me debug this?

kryptoknight13 commented 7 years ago

Hi @marco-lancini : now needle freezes or don't what should I call it, while attempting to read the list of app installed on iDevice. attaching the screenshot!

screen shot 2017-03-21 at 11 20 29 am
marco-lancini commented 7 years ago

@cobbr: do you have access to Xcode? @kryptoknight13: are you still experiencing issue #137?

kryptoknight13 commented 7 years ago

yes i am still facing issue #137.

marco-lancini commented 7 years ago

mmmh, @kryptoknight13 the 2 issues are mutually exclusive. If you are facing this issue then the core is waiting an answer from the agent (without receiving a connection closed error). Could you provide more details?

kryptoknight13 commented 7 years ago

yes @marco-lancini that's what i experienced too. either i get "telnet connection closed" or "freezing of needle". please do let me know what details you would require. PS: these two errors are seen on two different environments with same needle release.

HenryHoggard commented 7 years ago

I also get this issue on iOS 9.1. Needle 1.0.1. It hangs on [D] [AGENT] Attempting to reading result . Only workaround I've found is to do git checkout tags/v0.1.1 and use last working version.

marco-lancini commented 7 years ago

@kryptoknight13, @cobbr: if you can attach the device to Xcode you can start debugging it by analyzing the system log and see what the agent is printing

kryptoknight13 commented 7 years ago

@marco-lancini is there any specific cpu type needed for needle agent app? I am asking this, as 1st error itself says ": MS:Error: binary does not support this cpu type".

PS: below are logs when i have just launched the needle agent app on device. note: needle framework hasn't started at this point of time.

logs from Xcode:

Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Error>: MS:Error: binary does not support this cpu type
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Error>: MS:Error: failure to check DVIAMethodTracer.dylib
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Notice>: MS:Notice: Loading: /Library/MobileSubstrate/DynamicLibraries/Flex.dylib
Mar 21 17:42:32 iPhone6 SpringBoard[97] <Warning>: processing error queue with 1 errors
Mar 21 17:42:32 iPhone6 SpringBoard[97] <Warning>: Error - level severe: internal msg: "couldn't erase extract command file /var/mobile/Documents/Flex/mwr.needle.agent.dump, error code: -1"
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Error>: MS:Error: binary does not support this cpu type
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Error>: MS:Error: failure to check SBSettings.dylib
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Error>: MS:Error: extension does not have filter
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Error>: MS:Error: failure to check SSLKillSwitch.dylib
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Error>: MS:Error: cannot parse PropertyList
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Error>: MS:Error: failure to check SnoopiTweak.dylib
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Notice>: MS:Notice: Loading: /Library/MobileSubstrate/DynamicLibraries/Veency.dylib
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Notice>: MS:Notice: Loading: /Library/MobileSubstrate/DynamicLibraries/WinterBoard.dylib
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: nil class argument for selector checkoutAccessoryImagesForIcon:location:
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: nil class argument for selector checkoutAccessoryImageForIcon:location:
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: nil class argument for selector checkoutBadgeImageForText:
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: nil class argument for selector generateIconImage:
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: message not found [UIStatusBarTimeItemView contentsImageForStyle:]
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: message not found [UIImage defaultDesktopImage]
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: nil class argument for selector _defaultDesktopImage
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: nil class argument for selector resetCurrentImageToWallpaper
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: nil class argument for selector init
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: nil class argument for selector setIconImageAlpha:
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: nil class argument for selector setIconLabelAlpha:
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: nil class argument for selector initWithDefaultSize
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: nil class argument for selector setAlpha:
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: nil class argument for selector updateNumberOfRootIconLists
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: nil class argument for selector layoutSubviews
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: nil class argument for selector renderedSizeOfNode:constrainedToWidth:
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: nil class argument for selector initWithFrame:delegate:
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: nil class argument for selector _canUseLayerBackedBalloon
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: nil class argument for selector layoutSubviews
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: nil class argument for selector addBalloonView:
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: nil class argument for selector setBackgroundColor:
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: nil class argument for selector initWithStyle:reuseIdentifier:
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: nil class argument for selector initWithStyle:reuseIdentifier:
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: nil class argument for selector initWithStyle:reuseIdentifier:
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: nil class argument for selector setSeparatorStyle:
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: nil class argument for selector initWithFrame:style:
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: nil class argument for selector loadView
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: nil class argument for selector initWithName:inBundle:
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: nil class argument for selector imageNamed:device:
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: MS:Warning: message not found [_UIAssetManager imageNamed:scale:idiom:subtype:cachingOptions:]
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Notice>: MS:Notice: Loading: /Library/MobileSubstrate/DynamicLibraries/hidspringboard.dylib
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Notice>: MS:Notice: Loading: /Library/MobileSubstrate/DynamicLibraries/introspy.dylib
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Warning>: Introspy - Profiling disabled for mwr.needle.agent
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Notice>: MS:Notice: Loading: /Library/MobileSubstrate/DynamicLibraries/libstatusbar.dylib
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Notice>: CoreFoundation = 1241.110000
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Notice>: Could not match CoreFoundation = 1241.110000
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Notice>: MS:Notice: Loading: /Library/MobileSubstrate/DynamicLibraries/xCon.dylib
Mar 21 17:42:32 iPhone6 NeedleAgent[1166] <Notice>: MS:Notice: Loading: /Library/MobileSubstrate/DynamicLibraries/|tsProtector.dylib
Mar 21 17:42:32 iPhone6 UserEventAgent[123] <Warning>: Tracking mwr.needle.agent (via activity)
kryptoknight13 commented 7 years ago

@marco-lancini : posting log from xcode again when needle framework is started and needle agent is launched ( in listening condition).

Log from Xcode:

Mar 21 17:48:12 iPhone6 NeedleAgent[1166] <Warning>: Handle Command: OS_VERSION, (
    )

I don't get any further log from needle agent in ASL(xcode).

let me know if anything else is needed!

marco-lancini commented 7 years ago

Hi, @cobbr, @kryptoknight13, and @HenryHoggard. Version 1.0.2 has just been released to fix issues #137 and #141:

Please upgrade the Agent from Cydia, and the Core from github. Then let me know if you're still experiencing this issue

cobbr commented 7 years ago

This appears to be fixed, thanks @marco-lancini ! However, I now appear to be experiencing another issue. This seems to be identical to #84 

[needle] > set DEBUG True
DEBUG => True
[needle] > set VERBOSE True
VERBOSE => True
[needle] > set SETUP_DEVICE True
SETUP_DEVICE => True
[needle] > use binary/info/metadata
[needle][metadata] > run
[*] Checking connection with device...
[+] Already connected to: 127.0.0.1
[D] Creating temp folder: /var/root/needle/
[D] [REMOTE CMD] Remote Command: if [ -d /var/root/needle/ ]; then echo "yes"; else echo "no" ; fi
[+] Target app: com.highaltitudehacks.dvia
[*] Retrieving app's metadata...
/private/var/containers/Bundle/Application/801DC9B4-CD5E-4A6B-BD00-B25A15BF0560/DamnVulnerableIOSApp.app/Info.plist
[D] Copying the plist to temp: /private/var/containers/Bundle/Application/801DC9B4-CD5E-4A6B-BD00-B25A15BF0560/DamnVulnerableIOSApp.app/Info.plist -> /root/.needle/tmp/plist
[*] Pulling: /private/var/containers/Bundle/Application/801DC9B4-CD5E-4A6B-BD00-B25A15BF0560/DamnVulnerableIOSApp.app/Info.plist -> /root/.needle/tmp/plist
[D] Downloading: "/private/var/containers/Bundle/Application/801DC9B4-CD5E-4A6B-BD00-B25A15BF0560/DamnVulnerableIOSApp.app/Info.plist" -> /root/.needle/tmp/plist
[D] [LOCAL CMD] Local Command: sshpass -p <removed> scp -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -P 2222 root@127.0.0.1:"/private/var/containers/Bundle/Application/801DC9B4-CD5E-4A6B-BD00-B25A15BF0560/DamnVulnerableIOSApp.app/Info.plist" /root/.needle/tmp/plist
[D] [REMOTE CMD] Remote Command: lipo -info /private/var/containers/Bundle/Application/801DC9B4-CD5E-4A6B-BD00-B25A15BF0560/DamnVulnerableIOSApp.app/DamnVulnerableIOSApp
------------------------------------------------------------
Traceback (most recent call last):
  File "/opt/needle/needle/core/framework/module.py", line 111, in do_run
    pre = self.module_pre()
  File "/opt/needle/needle/core/framework/module.py", line 147, in module_pre
    if self.app_check() is None: return None
  File "/opt/needle/needle/core/framework/framework.py", line 665, in app_check
    self.APP_METADATA = Framework.APP_METADATA = self.device.app.get_metadata(app)
  File "/opt/needle/needle/core/device/app.py", line 19, in get_metadata
    return self._retrieve_metadata()
  File "/opt/needle/needle/core/device/app.py", line 40, in _retrieve_metadata
    architectures = self.__detect_architectures(binary_path)
  File "/opt/needle/needle/core/device/app.py", line 111, in __detect_architectures
    out = self._device.remote_op.command_blocking(cmd, internal=True)
  File "/opt/needle/needle/core/device/remote_operations.py", line 94, in command_blocking
    out, err = self._device._exec_command_ssh(cmd, internal)
  File "/opt/needle/needle/core/device/device.py", line 128, in _exec_command_ssh
    raise Exception(err_str)
Exception: sh: lipo: command not found

------------------------------------------------------------
[!] Exception: sh: lipo: command not found.

Even with SETUP_DEVICE set to True, it doesn't appear to be automatically installed. Maybe this is intentional. #84 recommends to install lipo from: org.coolstar.cctools, which no longer appears to work.

marco-lancini commented 7 years ago

@cobbr: awesome! :D Regarding your last issue with a dependency, please post it on #84. As soon as @kryptoknight13 and @HenryHoggard confirm this has been fixed, I'll (hopefully) close this issue

null0x4d5a commented 7 years ago

@marco-lancini Issue: not able to get any output from modules I have set up as per given installation guide https://github.com/mwrlabs/needle/wiki/Installation-Guide

device : Jailbroken Ipad iOS 9.3.1 32 bit and agent needle v1.0.3 OS : kali Linux

Could someone help ios needle

null0x4d5a commented 7 years ago

@kryptoknight13 Could you help if you have done it

marco-lancini commented 7 years ago

Hi @dmred1: in order to debug this issue, we require more information.

Ensure VERBOSE and DEBUG mode are enabled, this will provide us with more detailed needle logs:

[needle] > set VERBOSE True
VERBOSE => True
[needle] > set DEBUG True
DEBUG => True

Once you have this information, please attach the log files (starting from when you type python needle.py) to this thread and we can assist further.

null0x4d5a commented 7 years ago

@marco-lancini Hi, please look at screenshots 1 img_0044 2 3 4 6 8