search

WithSecureLabs / needle

The iOS Security Testing Framework
https://mobiletools.mwrinfosecurity.com/
Other
1.33k stars 283 forks source link

SCP install seems to kill OpenSSH #173

Closed tghosth closed 7 years ago

tghosth commented 7 years ago

Issue

Whilst using device/dependency_installer, it tries to install SCP, fails and somehow uninstalls OpenSSH at the same time.

Expected behaviour

Is SCP even needed if this is iOS9?

Actual behaviour

See the log below After this has been done, the saurik OpenSSH package is showing as not installed in Cydia.

Steps to reproduce

See log below

needle error logs

Ensure verbose and debug mode are enabled:

root@kali:~/Work# python ./needle/needle/needle.py -r ./XXXXXX/pass_config.txt  
             __   _ _______ _______ ______         _______
             | \  | |______ |______ |     \ |      |______
             |  \_| |______ |______ |_____/ |_____ |______

                   Needle v1.2.0 [mwr.to/needle]                  
  [MWR InfoSecurity (@MWRLabs) - Marco Lancini (@LanciniMarco)]   

[*] Loading commands from resource file
[needle] > set IP localhost
IP => localhost
[needle] > set PORT 2222
PORT => 2222
[needle] > set DEBUG True
DEBUG => True
[needle] > set VERBOSE True
VERBOSE => True
[needle] > set OUTPUT_FOLDER /root/Work/XXXXXX/needle_out
OUTPUT_FOLDER => /root/Work/XXXXXX/needle_out
[D] Output folder changed, reloading modules
[needle] > EOF
[+] Resource file successfully loaded
[needle] > use device/dependency_installer
[needle][dependency_installer] > info

      Name: Dependency Installer
      Path: modules/device/dependency_installer.py
    Author: @LanciniMarco (@MWRLabs)

Description:
  Automatically checks if all the dependencies needed are already present on the device, otherwise it
  will install them

Comments:
  * These are requirements that needs to be already installed on the device: APT 0.7 Strict, dpkg

Options:
  Name             Current Value  Required  Description
  ---------------  -------------  --------  -----------
  ALL              False          yes       Set to True to install all listed tools.
  CLASS-DUMP       False          yes       Set to True to install: CLASS-DUMP.
  CLUTCH           False          yes       Set to True to install: CLUTCH.
  COREUTILS        False          yes       Set to True to install: COREUTILS.
  CURL             False          yes       Set to True to install: CURL.
  CYCRIPT          False          yes       Set to True to install: CYCRIPT.
  DARWINTOOLS      False          yes       Set to True to install: DARWINTOOLS.
  FILEDP           False          yes       Set to True to install: FILEDP.
  FRIDA            False          yes       Set to True to install: FRIDA.
  FRIDA32BIT       False          yes       Set to True to install: FRIDA32BIT.
  FSMON            False          yes       Set to True to install: FSMON.
  GAWK             False          yes       Set to True to install: GAWK.
  GDB              False          yes       Set to True to install: GDB.
  KEYCHAIN_DUMP    False          yes       Set to True to install: KEYCHAIN_DUMP.
  ONDEVICECONSOLE  False          yes       Set to True to install: ONDEVICECONSOLE.
  OPEN             False          yes       Set to True to install: OPEN.
  PBWATCHER        False          yes       Set to True to install: PBWATCHER.
  PERL             False          yes       Set to True to install: PERL.
  PLUTIL           False          yes       Set to True to install: PLUTIL.
  SCP              False          yes       Set to True to install: SCP.
  THEOS            False          yes       Set to True to install: THEOS.
  UNZIP            False          yes       Set to True to install: UNZIP.

[needle][dependency_installer] > set SCP True
SCP => True
[needle][dependency_installer] > run
[D] Setup local output folder: /root/Work/XXXXXX/needle_out
[?] Attention! The folder chosen to store local output is not empty: /root/Work/XXXXXX/needle_out
[?] Do you want to back it up first?
[?] Y: the content will be archived in a different location, then the folder will be emptied
[?] N: no action will be taken (destination files might be overwritten in case of filename clash)
[y/n]: 
[D] Setting up issue's database...
[D] [DB] QUERY: CREATE TABLE IF NOT EXISTS issues (app TEXT, module TEXT, name TEXT, content TEXT, confidence TEXT, outfile TEXT)
[*] Checking connection with device...
[V] Connection not present, creating a new instance
[D] Setting up USB port forwarding on port 2222
[D] [LOCAL CMD] Local Subprocess Command: python /mnt/hgfs/Work/needle/needle/libs/usbmuxd/tcprelay.py -t 22:2222
[D] [AGENT] Setting up port forwarding on port 4444
[V] [AGENT] Connecting to agent (localhost:4444)...
[+] [AGENT] Successfully connected to agent (localhost:4444)...
[D] [AGENT] Executing command: os_version
[D] [AGENT] Parsing result (are you sure the agent is in the foreground?)
[V] [SSH] Connecting (localhost:2222)...
[+] [SSH] Connected (localhost:2222)
[D] Creating temp folder: /var/root/needle/
[D] [REMOTE CMD] Remote Command: if [ -d /var/root/needle/ ]; then echo "yes"; else echo "no" ; fi
[D] [AGENT] Executing command: os_version
[D] [AGENT] Parsing result (are you sure the agent is in the foreground?)
[*] Checking prerequisites...
[D] [REMOTE CMD] Remote Command: which apt-get
[D] [REMOTE CMD] Remote Command: which dpkg
[V] [INSTALL] Installing COREUTILS via apt-get.
[D] [REMOTE CMD] Remote Command: apt-get install -y --force-yes coreutils
[V] [INSTALL] Installing COREUTILS via apt-get.
[D] [REMOTE CMD] Remote Command: apt-get install -y --force-yes coreutils-bin
[D] [REMOTE CMD] Remote Command: apt-get update
[!] W: GPG error: http://repo.nesolabs.de ./ Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY F5266226F1ADFFA2
W: Ignoring Provides line with DepCompareOp for package libstatusbar
W: Ignoring Provides line with DepCompareOp for package libmoorecon

[V] [SSH] Disconnecting...
[V] [AGENT] Disconnecting from agent...
[D] Stopping USB port forwarding
[D] [LOCAL CMD] Stopping Local Subprocess Command [pid: 2433]
[D] [AGENT] Stopping port forwarding
[?] Resetting connection to device...
[D] Setting up USB port forwarding on port 2222
[D] [LOCAL CMD] Local Subprocess Command: python /mnt/hgfs/Work/needle/needle/libs/usbmuxd/tcprelay.py -t 22:2222
[D] [AGENT] Setting up port forwarding on port 4444
[V] [AGENT] Connecting to agent (localhost:4444)...
[+] [AGENT] Successfully connected to agent (localhost:4444)...
[D] [AGENT] Executing command: os_version
[D] [AGENT] Parsing result (are you sure the agent is in the foreground?)
[V] [SSH] Connecting (localhost:2222)...
[+] [SSH] Connected (localhost:2222)
[?] Rerunning last command...
[!] W: GPG error: http://repo.nesolabs.de ./ Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY F5266226F1ADFFA2
W: Ignoring Provides line with DepCompareOp for package libstatusbar
W: Ignoring Provides line with DepCompareOp for package libmoorecon

[V] [SSH] Disconnecting...
[V] [AGENT] Disconnecting from agent...
[D] Stopping USB port forwarding
[D] [LOCAL CMD] Stopping Local Subprocess Command [pid: 2444]
[D] [AGENT] Stopping port forwarding
[?] Resetting connection to device...
[D] Setting up USB port forwarding on port 2222
[D] [LOCAL CMD] Local Subprocess Command: python /mnt/hgfs/Work/needle/needle/libs/usbmuxd/tcprelay.py -t 22:2222
[D] [AGENT] Setting up port forwarding on port 4444
[V] [AGENT] Connecting to agent (localhost:4444)...
[+] [AGENT] Successfully connected to agent (localhost:4444)...
[D] [AGENT] Executing command: os_version
[D] [AGENT] Parsing result (are you sure the agent is in the foreground?)
[V] [SSH] Connecting (localhost:2222)...
[+] [SSH] Connected (localhost:2222)
[?] Rerunning last command...
[!] W: GPG error: http://repo.nesolabs.de ./ Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY F5266226F1ADFFA2
W: Ignoring Provides line with DepCompareOp for package libstatusbar
W: Ignoring Provides line with DepCompareOp for package libmoorecon

[V] [SSH] Disconnecting...
[V] [AGENT] Disconnecting from agent...
[D] Stopping USB port forwarding
[D] [LOCAL CMD] Stopping Local Subprocess Command [pid: 2455]
[D] [AGENT] Stopping port forwarding
[?] Resetting connection to device...
[D] Setting up USB port forwarding on port 2222
[D] [LOCAL CMD] Local Subprocess Command: python /mnt/hgfs/Work/needle/needle/libs/usbmuxd/tcprelay.py -t 22:2222
[D] [AGENT] Setting up port forwarding on port 4444
[V] [AGENT] Connecting to agent (localhost:4444)...
[+] [AGENT] Successfully connected to agent (localhost:4444)...
[D] [AGENT] Executing command: os_version
[D] [AGENT] Parsing result (are you sure the agent is in the foreground?)
[V] [SSH] Connecting (localhost:2222)...
[+] [SSH] Connected (localhost:2222)
[?] Rerunning last command...
[?] Error occurred during apt-get update: An error occurred and it was not possible to restore it (3 attempts failed)
[?] Trying to continue anyway...
[*] Refreshing package list...
[D] [REMOTE CMD] Remote Command: dpkg --get-selections | grep -v "deinstall" | cut -f1
[D] [REMOTE CMD] Remote Command: apt-get update
[!] W: GPG error: http://repo.nesolabs.de ./ Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY F5266226F1ADFFA2
W: Ignoring Provides line with DepCompareOp for package libstatusbar
W: Ignoring Provides line with DepCompareOp for package libmoorecon

[V] [SSH] Disconnecting...
[V] [AGENT] Disconnecting from agent...
[D] Stopping USB port forwarding
[D] [LOCAL CMD] Stopping Local Subprocess Command [pid: 2466]
[D] [AGENT] Stopping port forwarding
[?] Resetting connection to device...
[D] Setting up USB port forwarding on port 2222
[D] [LOCAL CMD] Local Subprocess Command: python /mnt/hgfs/Work/needle/needle/libs/usbmuxd/tcprelay.py -t 22:2222
[D] [AGENT] Setting up port forwarding on port 4444
[V] [AGENT] Connecting to agent (localhost:4444)...
[+] [AGENT] Successfully connected to agent (localhost:4444)...
[D] [AGENT] Executing command: os_version
[D] [AGENT] Parsing result (are you sure the agent is in the foreground?)
[V] [SSH] Connecting (localhost:2222)...
[+] [SSH] Connected (localhost:2222)
[?] Rerunning last command...
[!] W: GPG error: http://repo.nesolabs.de ./ Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY F5266226F1ADFFA2
W: Ignoring Provides line with DepCompareOp for package libstatusbar
W: Ignoring Provides line with DepCompareOp for package libmoorecon

[V] [SSH] Disconnecting...
[V] [AGENT] Disconnecting from agent...
[D] Stopping USB port forwarding
[D] [LOCAL CMD] Stopping Local Subprocess Command [pid: 2477]
[D] [AGENT] Stopping port forwarding
[?] Resetting connection to device...
[D] Setting up USB port forwarding on port 2222
[D] [LOCAL CMD] Local Subprocess Command: python /mnt/hgfs/Work/needle/needle/libs/usbmuxd/tcprelay.py -t 22:2222
[D] [AGENT] Setting up port forwarding on port 4444
[V] [AGENT] Connecting to agent (localhost:4444)...
[+] [AGENT] Successfully connected to agent (localhost:4444)...
[D] [AGENT] Executing command: os_version
[D] [AGENT] Parsing result (are you sure the agent is in the foreground?)
[V] [SSH] Connecting (localhost:2222)...
[+] [SSH] Connected (localhost:2222)
[?] Rerunning last command...
[!] W: GPG error: http://repo.nesolabs.de ./ Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY F5266226F1ADFFA2
W: Ignoring Provides line with DepCompareOp for package libstatusbar
W: Ignoring Provides line with DepCompareOp for package libmoorecon

[V] [SSH] Disconnecting...
[V] [AGENT] Disconnecting from agent...
[D] Stopping USB port forwarding
[D] [LOCAL CMD] Stopping Local Subprocess Command [pid: 2488]
[D] [AGENT] Stopping port forwarding
[?] Resetting connection to device...
[D] Setting up USB port forwarding on port 2222
[D] [LOCAL CMD] Local Subprocess Command: python /mnt/hgfs/Work/needle/needle/libs/usbmuxd/tcprelay.py -t 22:2222
[D] [AGENT] Setting up port forwarding on port 4444
[V] [AGENT] Connecting to agent (localhost:4444)...
[+] [AGENT] Successfully connected to agent (localhost:4444)...
[D] [AGENT] Executing command: os_version
[D] [AGENT] Parsing result (are you sure the agent is in the foreground?)
[V] [SSH] Connecting (localhost:2222)...
[+] [SSH] Connected (localhost:2222)
[?] Rerunning last command...
[?] Error occurred during apt-get update: An error occurred and it was not possible to restore it (3 attempts failed)
[?] Trying to continue anyway...
[D] [REMOTE CMD] Remote Command: cat /etc/apt/sources.list.d/cydia.list
[*] The following tools are going to be installed: ['SCP']
[>][QUESTION] Do you want to continue? [y/N]: y
[V] [INSTALL] Installing SCP via apt-get.
[D] Adding repo to cydia.list: https://coolstar.org/publicrepo/
[D] [REMOTE CMD] Remote Command: echo "deb https://coolstar.org/publicrepo/ ./" >> /etc/apt/sources.list.d/cydia.list
[D] [REMOTE CMD] Remote Command: apt-get update
[!] W: GPG error: http://repo.nesolabs.de ./ Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY F5266226F1ADFFA2
W: Ignoring Provides line with DepCompareOp for package libstatusbar
W: Ignoring Provides line with DepCompareOp for package libmoorecon
W: Duplicate sources.list entry https://coolstar.org ./ Packages (/var/lib/apt/lists/coolstar.org_publicrepo_._Packages)

[V] [SSH] Disconnecting...
[V] [AGENT] Disconnecting from agent...
[D] Stopping USB port forwarding
[D] [LOCAL CMD] Stopping Local Subprocess Command [pid: 2499]
[D] [AGENT] Stopping port forwarding
[?] Resetting connection to device...
[D] Setting up USB port forwarding on port 2222
[D] [LOCAL CMD] Local Subprocess Command: python /mnt/hgfs/Work/needle/needle/libs/usbmuxd/tcprelay.py -t 22:2222
[D] [AGENT] Setting up port forwarding on port 4444
[V] [AGENT] Connecting to agent (localhost:4444)...
[+] [AGENT] Successfully connected to agent (localhost:4444)...
[D] [AGENT] Executing command: os_version
[D] [AGENT] Parsing result (are you sure the agent is in the foreground?)
[V] [SSH] Connecting (localhost:2222)...
[+] [SSH] Connected (localhost:2222)
[?] Rerunning last command...
[!] W: GPG error: http://repo.nesolabs.de ./ Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY F5266226F1ADFFA2
W: Ignoring Provides line with DepCompareOp for package libstatusbar
W: Ignoring Provides line with DepCompareOp for package libmoorecon
W: Duplicate sources.list entry https://coolstar.org ./ Packages (/var/lib/apt/lists/coolstar.org_publicrepo_._Packages)

[V] [SSH] Disconnecting...
[V] [AGENT] Disconnecting from agent...
[D] Stopping USB port forwarding
[D] [LOCAL CMD] Stopping Local Subprocess Command [pid: 2510]
[D] [AGENT] Stopping port forwarding
[?] Resetting connection to device...
[D] Setting up USB port forwarding on port 2222
[D] [LOCAL CMD] Local Subprocess Command: python /mnt/hgfs/Work/needle/needle/libs/usbmuxd/tcprelay.py -t 22:2222
[D] [AGENT] Setting up port forwarding on port 4444
[V] [AGENT] Connecting to agent (localhost:4444)...
[+] [AGENT] Successfully connected to agent (localhost:4444)...
[D] [AGENT] Executing command: os_version
[D] [AGENT] Parsing result (are you sure the agent is in the foreground?)
[V] [SSH] Connecting (localhost:2222)...
[+] [SSH] Connected (localhost:2222)
[?] Rerunning last command...
[!] W: GPG error: http://repo.nesolabs.de ./ Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY F5266226F1ADFFA2
W: Ignoring Provides line with DepCompareOp for package libstatusbar
W: Ignoring Provides line with DepCompareOp for package libmoorecon
W: Duplicate sources.list entry https://coolstar.org ./ Packages (/var/lib/apt/lists/coolstar.org_publicrepo_._Packages)

[V] [SSH] Disconnecting...
[V] [AGENT] Disconnecting from agent...
[D] Stopping USB port forwarding
[D] [LOCAL CMD] Stopping Local Subprocess Command [pid: 2521]
[D] [AGENT] Stopping port forwarding
[?] Resetting connection to device...
[D] Setting up USB port forwarding on port 2222
[D] [LOCAL CMD] Local Subprocess Command: python /mnt/hgfs/Work/needle/needle/libs/usbmuxd/tcprelay.py -t 22:2222
[D] [AGENT] Setting up port forwarding on port 4444
[V] [AGENT] Connecting to agent (localhost:4444)...
[+] [AGENT] Successfully connected to agent (localhost:4444)...
[D] [AGENT] Executing command: os_version
[D] [AGENT] Parsing result (are you sure the agent is in the foreground?)
[V] [SSH] Connecting (localhost:2222)...
[+] [SSH] Connected (localhost:2222)
[?] Rerunning last command...
[?] Error occurred during apt-get update: An error occurred and it was not possible to restore it (3 attempts failed)
[?] Trying to continue anyway...
[D] [REMOTE CMD] Remote Command: apt-get install -y --force-yes org.coolstar.scp-sftp-dropbear
[!] dpkg: warning: while removing openssh, directory '/etc/ssh' not empty so not removed

[V] [SSH] Disconnecting...
[V] [AGENT] Disconnecting from agent...
[D] Stopping USB port forwarding
[D] [LOCAL CMD] Stopping Local Subprocess Command [pid: 2533]
[D] [AGENT] Stopping port forwarding
[?] Resetting connection to device...
[D] Setting up USB port forwarding on port 2222
[D] [LOCAL CMD] Local Subprocess Command: python /mnt/hgfs/Work/needle/needle/libs/usbmuxd/tcprelay.py -t 22:2222
[D] [AGENT] Setting up port forwarding on port 4444
2017-05-25 13:29:15,662| ERROR   | Exception: Error reading SSH protocol banner
2017-05-25 13:29:15,663| ERROR   | Traceback (most recent call last):
2017-05-25 13:29:15,665| ERROR   |   File "/usr/lib/python2.7/dist-packages/paramiko/transport.py", line 1723, in run
2017-05-25 13:29:15,665| ERROR   |     self._check_banner()
2017-05-25 13:29:15,666| ERROR   |   File "/usr/lib/python2.7/dist-packages/paramiko/transport.py", line 1871, in _check_banner
2017-05-25 13:29:15,666| ERROR   |     raise SSHException('Error reading SSH protocol banner' + str(e))
2017-05-25 13:29:15,666| ERROR   | SSHException: Error reading SSH protocol banner
2017-05-25 13:29:15,666| ERROR   | 
2017-05-25 13:29:15,673| ERROR   | Could not connect to gateway localhost:2222 : Error reading SSH protocol banner
[?] Error occurred during installation of tools: 
[?] Trying to continue anyway...
[needle][dependency_installer] >

Environment

Needle Version

Workstation Operating System

Kali

Device iOS Version

iPad 9.2.1

marco-lancini commented 7 years ago

Hi @tghosth, scp is needed for devices running iOS 10 as it is not included by default in the dropbear binary dropped by the jailbreak (#136)

tghosth commented 7 years ago

Hi @marco-lancini, I understand that but this is an iOS 9 device where dropbear is not included so it needs OpenSSH.