WithSecureLabs / needle

The iOS Security Testing Framework
https://mobiletools.mwrinfosecurity.com/
Other
1.32k stars 283 forks source link

list_apps module failing #61

Closed ndoell closed 7 years ago

ndoell commented 7 years ago

Issue

Hi I am running the module list_apps however it is failing at plutil does not exist. I'm wondering if plutil should be running as a local command and not on the Apple device?

Expected behaviour

List of applications on the connected iPAD should be displayed.

Actual behaviour

needle] > use various/list_apps [needle][listapps] > run [] Checking connection with device... [V] Connection not present, creating a new instance [V] Setting up USB port forwarding on port 2222 [V] Setting up SSH connection... [+] Connected to: 127.0.0.1 [V] Creating temp folder: /var/root/needle/ [_] Looking for apps... [V] Refreshing list of installed apps... [!] Exception: sh: plutil: command not found.

Steps to reproduce

  1. bin/python needle/needle.py -r needle/config.txt [needle] > set SETUP_DEVICE False SETUP_DEVICE => False [needle] > [needle] > set VERBOSE True VERBOSE => True [needle] > set DEBUG True DEBUG => True [needle] > EOF [+] Resource file successfully loaded
  2. [needle] > use various/list_apps
  3. [needle][listapps] > run [D] Setup local output folder: /Users/user/.needle/output [] Checking connection with device... [V] Connection not present, creating a new instance [V] Setting up USB port forwarding on port 2222 [D] [LOCAL CMD] Local Subprocess Command: /Users/user/Virtualenvs/needle/needle/libs/usbmuxd/tcprelay.py -t 22:2222 [V] Setting up SSH connection... [+] Connected to: 127.0.0.1 [V] Creating temp folder: /var/root/needle/ [D] [REMOTE CMD] Remote Command: if [ -d /var/root/needle/ ]; then echo "yes"; else echo "no" ; fi [_] Looking for apps... [D] [REMOTE CMD] Remote Command: if [ -f /var/mobile/Library/MobileInstallation/LastLaunchServicesMap.plist ]; then echo "yes"; else echo "no" ; fi [D] [REMOTE CMD] Remote Command: if [ -f /private/var/installd/Library/MobileInstallation/LastLaunchServicesMap.plist ]; then echo "yes"; else echo "no" ; fi [V] Refreshing list of installed apps... [D] [REMOTE CMD] Remote Command: /bin/su mobile -c /usr/bin/uicache [D] [REMOTE CMD] Remote Command: cp /private/var/installd/Library/MobileInstallation/LastLaunchServicesMap.plist /var/root/needle/LastLaunchServicesMap.plist [D] [REMOTE CMD] Remote Command: plutil -convert xml1 /var/root/needle/LastLaunchServicesMap.plist

    Traceback (most recent call last): File "/Users/user/Virtualenvs/needle/needle/core/framework/module.py", line 114, in do_run self.module_run() File "/Users/user/Virtualenvs/needle/needle/modules/various/list_apps.py", line 25, in module_run self.device._list_apps() File "/Users/user/Virtualenvs/needle/needle/core/device/device.py", line 195, in _list_apps elif self._is_iOS9: list_iOS_89(Constants.DEVICE_PATH_APPLIST_iOS9) File "/Users/user/Virtualenvs/needle/needle/core/device/device.py", line 189, in list_iOS_89 pl = self.remote_op.parse_plist(applist) File "/Users/user/Virtualenvs/needle/needle/core/device/remote_operations.py", line 214, in parse_plist self.command_blocking(cmd, internal=True) File "/Users/user/Virtualenvs/needle/needle/core/device/remote_operations.py", line 88, in command_blocking out, err = self._device._exec_command_ssh(cmd, internal) File "/Users/user/Virtualenvs/needle/needle/core/device/device.py", line 120, in _exec_command_ssh raise Exception(err_str) Exception: sh: plutil: command not found


[!] Exception: sh: plutil: command not found.

needle error logs ---> Set in config.txt

Ensure verbose and debug mode are enabled:

[needle] > set VERBOSE True
VERBOSE => True
[needle] > set DEBUG True
DEBUG => True

Environment

Workstation Operating System

Mac OS X El Capitain

Python Version

Python 2.7.12

Python Packages (pip freeze)

cffi==1.8.3 colorama==0.3.7 cryptography==1.5.2 enum34==1.1.6 frida==8.1.1 idna==2.1 ipaddress==1.0.17 paramiko==2.0.2 prompt-toolkit==1.0.7 pyasn1==0.1.9 pycparser==2.14 Pygments==2.1.3 readline==6.2.4.1 six==1.10.0 sshtunnel==0.1.1 wcwidth==0.1.7

Device iOS Version

9.3.3

tghosth commented 7 years ago

Hi @ndoell, have you previously run an operation with set SETUP_DEVICE True which installs the relevant tools on the device? If so, did it execute without errors? Maybe post the log of running list_apps with set SETUP_DEVICE True.

ndoell commented 7 years ago

@tghosth it failed to install the tools.

[_] Loading commands from resource file [needle] > # If SETUP_DEVICE is set to True, [needle] > # Needle will automatically install all the required tools on the device [needle] > set SETUP_DEVICE True SETUP_DEVICE => True [needle] > EOF [+] Resource file successfully loaded [needle] > [needle] > [needle] > use various/list_apps [needle][listapps] > run [] Checking connection with device... [V] Connection not present, creating a new instance [V] Setting up USB port forwarding on port 2222 [V] Setting up SSH connection... [+] Connected to: 127.0.0.1 [V] Creating temp folder: /var/root/needle/ [] Configuring device... [] Pushing: /Users/user/Virtualenvs/needle/needle/libs/devicetools/FileDP -> /usr/bin/FileDP [*] Pushing: /Users/user/Virtualenvs/needle/needle/libs/devicetools/fsmon -> /usr/bin/fsmon [?] Error occurred during installation of tools: E: Couldn't find package ondeviceconsole [?] Trying to continue anyway... [?] Error occurred during apt-get update: W: Failed to fetch http://apt.thebigboss.org/repofiles/cydia/./Packages.gz HTTP/1.1 404 Not Found

E: Some index files failed to download, they have been ignored, or old ones used instead. [?] Trying to continue anyway... [?] Error occurred during installation of tools: dpkg: error processing /var/cache/apt/archives/git_2.8.1-5_iphoneos-arm.deb (--unpack): failed in buffer_write(fd) (7, ret=-1): backend dpkg-deb during ./usr/libexec/git-core/git-remote-http': No space left on device dpkg-deb: subprocess paste killed by signal (Broken pipe: 13) dpkg: error processing /var/cache/apt/archives/vim_7.1-3p_iphoneos-arm.deb (--unpack): failed in buffer_write(fd) (7, ret=-1): backend dpkg-deb during./usr/bin/vim': No space left on device dpkg-deb: subprocess paste killed by signal (Broken pipe: 13) dpkg: error processing /var/cache/apt/archives/com.ericasadun.utilities_1%3a0.4.2_iphoneos-arm.deb (--unpack): failed in buffer_write(fd) (7, ret=-1): backend dpkg-deb during `./usr/bin/faker': No space left on device Errors were encountered while processing: /var/cache/apt/archives/git_2.8.1-5_iphoneos-arm.deb /var/cache/apt/archives/vim_7.1-3p_iphoneos-arm.deb /var/cache/apt/archives/com.ericasadun.utilities_1%3a0.4.2iphoneos-arm.deb E: Sub-process /usr/bin/dpkg returned an error code (1) [?] Trying to continue anyway... [] Pushing: /Users/user/Virtualenvs/needle/needle/libs/devicetools/keychaineditor -> /usr/bin/keychaineditor [?] Error occurred during installation of tools: E: Unmet dependencies. Try 'apt-get -f install' with no packages (or specify a solution). [?] Trying to continue anyway... [?] Error occurred during installation of tools: E: Unmet dependencies. Try 'apt-get -f install' with no packages (or specify a solution). [?] Trying to continue anyway... [_] Pushing: /Users/user/Virtualenvs/needle/needle/libs/devicetools/pbwatcher -> /usr/bin/pbwatcher [?] Error occurred during installation of tools: E: Unmet dependencies. Try 'apt-get -f install' with no packages (or specify a solution). [?] Trying to continue anyway... [?] Error occurred during installation of tools: E: Unmet dependencies. Try 'apt-get -f install' with no packages (or specify a solution). [?] Trying to continue anyway... [?] Error occurred during apt-get update: W: Failed to fetch http://apt.thebigboss.org/repofiles/cydia/./Packages.gz HTTP/1.1 404 Not Found

E: Some index files failed to download, they have been ignored, or old ones used instead. [?] Trying to continue anyway... [?] Error occurred during installation of tools: E: Unmet dependencies. Try 'apt-get -f install' with no packages (or specify a solution). [?] Trying to continue anyway... [?] Error occurred during apt-get update: W: Failed to fetch http://apt.thebigboss.org/repofiles/cydia/./Packages.gz HTTP/1.1 404 Not Found

E: Some index files failed to download, they have been ignored, or old ones used instead. [?] Trying to continue anyway... [?] Error occurred during installation of tools: E: Unmet dependencies. Try 'apt-get -f install' with no packages (or specify a solution). [?] Trying to continue anyway... [*] Looking for apps... [V] Refreshing list of installed apps... [!] Exception: sh: plutil: command not found.

marco-lancini commented 7 years ago

Hi @ndoell, as you can see from the error log you posted above:

failed in buffer_write(fd) (7, ret=-1): backend dpkg-deb during `./usr/bin/faker': No space left on device

the device you are using has no space left on disk. If you want to install other tools you'll have to free up some space first.

ndoell commented 7 years ago

Strange it says 9.9GB free.

marco-lancini commented 7 years ago

In what partition?

ndoell commented 7 years ago

Ah sorry I checked on Storage & iCloud Usage which was wrong. My root and /dev is full.

root# df -h Filesystem Size Used Avail Use% Mounted on /dev/disk0s1s1 2.9G 2.9G 0 100% / devfs 53K 53K 0 100% /dev /dev/disk0s1s2 12G 1.8G 11G 16% /private/var /dev/disk0s1s3 10M 2.0M 8.0M 20% /private/var/wireless/baseband_data

tghosth commented 7 years ago

Full up disk appears to be a known issue after jailbreaking. Do some googling but on my device I had to install "stashing". Don't have the explanatory link handy.

ndoell commented 7 years ago

I was able to clear some space and needle installed the necessary tools. Finally list_apps was able to execute successfully.

Thank you for the help @tghosth

marco-lancini commented 7 years ago

@tghosth : where you following this?

https://www.reddit.com/r/jailbreak/comments/4ugzui/release_stashing_for_92933_get_more_space_on_your/

tghosth commented 7 years ago

@marco-lancini, yeah thats the solution I am using...

ndoell commented 7 years ago

@marco-lancini and @tghosth

Stashing install actually failed for me with this error: "failed in buffer_write(fd) (8, ret=-1)" . I had to rename /.cydia_no_stash to /.cydia_no_stash- and restart cydia. Installing stashing then worked.

http://www.redmondpie.com/fix-failed-in-buffer_writefd-8-ret-1-cydia-error-after-ios-9.3.3-jailbreak-heres-how/

marco-lancini commented 7 years ago

thanks both! :)

marco-lancini commented 7 years ago

I wrote a small writeup on the topic: http://www.marcolancini.it//2016/blog-ios9-jailbreak/

theSha1chemist commented 7 years ago

@marco-lancini thanks for the writeup. The sim linking command fails though. removing the trailing slashes works:

iPhone:~ root# ln -s /private/var/Fonts/ /System/Library/Fonts/ ln: target `/System/Library/Fonts/' is not a directory: No such file or directory iPhone:~ root# ln -s /private/var/Fonts System/Library/Fonts