search

WithSecureLabs / needle

The iOS Security Testing Framework
https://mobiletools.mwrinfosecurity.com/
Other
1.33k stars 283 forks source link

error on [REMOTE CMD] Remote Command: /bin/su mobile -c /usr/bin/uicache in IOS8 #78

Closed javixeneize closed 7 years ago

javixeneize commented 7 years ago

Hi

I am having an error when running binary/strings function in an IOS8 device from a Mac

[D] [REMOTE CMD] Remote Command: /bin/su mobile -c /usr/bin/uicache

File "/Users/javi/needle/core/device/device.py", line 120, in _exec_command_ssh raise Exception(err_str) Exception: sh: /bin/su: No such file or directory

[!] Exception: sh: /bin/su: No such file or directory.

Checking the py, this is the line creating the issue

  self.remote_op.command_blocking('/bin/su mobile -c /usr/bin/uicache', internal=True)

What is the porpouse of that line of code? By removing it, everything works fine

Thanks

marco-lancini commented 7 years ago

Hi @javixeneize, that line comes from this line block:

def list_iOS_89(applist):
            # Refresh UICache in case an app was installed after the last reboot
            self.printer.verbose("Refreshing list of installed apps...")
            self.remote_op.command_blocking('/bin/su mobile -c /usr/bin/uicache', internal=True)
            # Parse plist file
            pl = self.remote_op.parse_plist(applist)
            self._applist = pl["User"]

Which refresh the cache containing the list of installed apps on device. I've never occurred into that error. Can you provide more details? (what module where you trying to load, iOS version, full log with set DEBUG True enabled, etc)

javixeneize commented 7 years ago

Hi Marco

Yes, i understand, but i cant see why it is needed to run that module

As requested, i am running needle from a macosx (el capitan) in an ios8 device jailbroken with taig. I am using binary strings module, but i think the same call is done in every method

The debug error is as attached. The path for the su binary doesnt exist

Thanks

El El sáb, 12 nov 2016 a las 21:26, Marco Lancini notifications@github.com escribió:

Hi @javixeneize https://github.com/javixeneize, that line comes from this line block:

def list_iOS_89(applist):

Refresh UICache in case an app was installed after the last reboot

        self.printer.verbose("Refreshing list of installed apps...")
        self.remote_op.command_blocking('/bin/su mobile -c /usr/bin/uicache', internal=True)
        # Parse plist file
        pl = self.remote_op.parse_plist(applist)
        self._applist = pl["User"]

Which refresh the cache containing the list of installed apps on device. I've never occurred into that error. Can you provide more details? (what module where you trying to load, iOS version, full log with set DEBUG True enabled, etc)

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/mwrlabs/needle/issues/78#issuecomment-260149403, or mute the thread https://github.com/notifications/unsubscribe-auth/AMK55nKRmrFJKDtueuNpJD5S239UcY02ks5q9i78gaJpZM4KvxQr .

marco-lancini commented 7 years ago

The command: /bin/su mobile -c /usr/bin/uicache is used by Needle to refresh the device's list of installed apps. Are you sure you don't have a su binary in the /bin folder?

javixeneize commented 7 years ago

Not in el capitan

El El sáb, 19 nov 2016 a las 18:01, Marco Lancini notifications@github.com escribió:

The command: /bin/su mobile -c /usr/bin/uicache is used by Needle to refresh the device's list of installed apps. Are you sure you don't have a su binary in the /bin folder?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/mwrlabs/needle/issues/78#issuecomment-261729212, or mute the thread https://github.com/notifications/unsubscribe-auth/AMK55n0WvJHn45tJrBNcOORPnXjWruu1ks5q_zlfgaJpZM4KvxQr .

marco-lancini commented 7 years ago

I was referring to your device: the /bin/su binary should be present on your jailbroken device

javixeneize commented 7 years ago

Ah right. Let me check on monday

El El sáb, 19 nov 2016 a las 18:05, Marco Lancini notifications@github.com escribió:

I was referring on your device: the '/bin/su' binary should be present on your jailbroken device

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/mwrlabs/needle/issues/78#issuecomment-261729488, or mute the thread https://github.com/notifications/unsubscribe-auth/AMK55lw1Amx8Kb_wLybqjTqfMIKgmDU2ks5q_zpOgaJpZM4KvxQr .

javixeneize commented 7 years ago

Nevermind.... i see what is the problem now ;) I forgot i renamed the su binary to bypass jailbreak detection

Thanks