search

ptoomey3 / Keychain-Dumper

A tool to check which keychain items are available to an attacker once an iOS device has been jailbroken
BSD 3-Clause "New" or "Revised" License
1.35k stars 299 forks source link

Modified a lot of things tested on iOS 12.1 arm64. #38

Closed mechanico closed 5 years ago

mechanico commented 5 years ago

Tested on iOS 12.1 arm64 device.

ptoomey3 commented 5 years ago

✨ - I've kind of lost track of the jailbreak community and have no jailbroken device to test on. As a result, I haven't had lots of opportunity to fix some of the issues. It seems like you have done a fair bit of work to address most/all of the known issues. I'd love to get this updated for folks. Let me see when I can give this some :eyes: and I'll get back to you.

mechanico commented 5 years ago

You're welcome, I'm actively working with several jailbroken devices during my business hours. I thought it would be nice to extent the tool, as I use it during my work :)

0xln commented 5 years ago

I’ll try give this a test tomorrow

0xln commented 5 years ago

Works on ios 12, underc0ver jailbreak. Great work, saved me a bunch of time!

0xln commented 5 years ago

Probably worth mentioning that if you are pulling certificates, openssl will need to be installed on the test device 😎

mechanico commented 5 years ago

@0xln Thanks for the feedback, implemented a check if openssl exists in /usr/bin/, if not an error message is shown that the package should be installed using cydia.

ptoomey3 commented 5 years ago

This is looking good. Let me take a final look next week and I can merge it (and update the pre-built binary).

mechanico commented 5 years ago

This Morning I had an Segmentation fault 11 while retrieving the key values from the keychain. It turned out, that the key was somehow malformed. Anyway I think it would be nice to implement a try catch procedure in the program. Do you know if it's possible to catch a segmentation fault 11 in objective-c?

Entitlement Group: com.whatever.foo Label: (null) Accessible Attribute: kSecAttrAccessibleWhenUnlockedThisDeviceOnly, protection level 5 Application Label: <> Key Class: Public Key Size: 4208 Effective Key Size: 526 Segmentation fault: 11

A workaround could be comparing the Key Size with the Effective Key Size, if they differ the key value would not be presented.

0xln commented 5 years ago

I had this a few times when I was pulling data from the keychain, particularly with PKI keys stored in the keychain. I’m not sure on how you’d catch it. But I’d certainly love to see that implemented. Would help a lot

ptoomey3 commented 5 years ago

I'll likely get to this tomorrow for final review/merge 🙇

ptoomey3 commented 5 years ago

Looks good. I've removed the binary for now and will push up one I build/sign post-merge. Thanks!

mechanico commented 5 years ago

Would you consider adding me to the contributors? I'm looking forward to implement some more features.

ptoomey3 commented 5 years ago

For the time being I'd like to look over PRs as they are merged. But, I very much appreciate the contributions and would be happy to review upcoming proposed changes. Given I've now got everything re-setup to be able to build proposed changes, I should be able to review/merge things more quickly going forward.