800+ IT
News
als RSS Feed abonnieren📚 Haxx - Untethered + Unsandboxed Code Execution Haxx As Root On iOS 14 - iOS 14.8.1
💡 Newskategorie: IT Security Nachrichten
🔗 Quelle: kitploit.com
Untethered + Unsandboxed code execution haxx as root on iOS 14 - iOS 14.8.1.
Based on CoreTrustDemo, also please note that certificates are not copyrightable.
Usage
Note: requires macOS + existing jailbreak
Get up and running
- On your mac import dev_certificate.p12 into the keychain, and the password is
password. - Modify haxx.c to include your own code (if you need it).
- Run
maketo build - On the device, Copy
/System/Library/PrivateFrameworks/CoreAnalytics.framework/Support/analyticsdto/System/Library/PrivateFrameworks/CoreAnalytics.framework/Support/analyticsd.back - Then replace
/System/Library/PrivateFrameworks/CoreAnalytics.framework/Support/analyticsdwith/usr/bin/fileproviderctl - Create the
/private/var/haxxdirectory, mode should be 0777 - Copy
fileproviderctl_internalandhaxxgenerated from the build to/usr/local/binon the device, mode should be 0755. - Profit.
Fixing fileproviderctl
After doing the above steps, fileproviderctl will be broken, to fix it do the following steps
- Grab a copy of
/usr/bin/fileproviderctlon your device to your mac - Patch the binary with GNU sed:
gsed -i 's|/usr/local/bin/fileproviderctl_internal|/usr/local/bin/fileproviderctl_XXXXXXXX|g' fileproviderctl - Resign it:
codesign -s "Worth Doing Badly iPhone OS Application Signing" --preserve-metadata=entitlements --force fileproviderctl - Put the fixed binary back onto your device.
Removal
To remove the installation, do the following steps
- Copy
/System/Library/PrivateFrameworks/CoreAnalytics.framework/Support/analyticsdto/usr/bin/fileproviderctl - Move
/System/Library/PrivateFrameworks/CoreAnalytics.framework/Support/analyticsd.backto/System/Library/PrivateFrameworks/CoreAnalytics.framework/Support/analyticsd - Delete
/var/haxx,/usr/local/bin/fileproviderctl_internalas well as/usr/local/bin/haxx
...