[iOS11] list_apps fails #242

GrahamM · 2018-03-14T17:07:12Z

Issue

Expected behaviour

Target app wizard returns apps to be targeted

Actual behaviour

Target app wizard returns nothing.

Steps to reproduce

Run a module, and allow the target app wizard to run.

needle error logs

[needle][strings] > run
[D] Setup local output folder: /root/.needle/output
[D] Setting up issues database...
[D] [DB] QUERY: CREATE TABLE IF NOT EXISTS issues (app TEXT, module TEXT, name TEXT, content TEXT, confidence TEXT, outfile TEXT)
[*] Checking connection with device...
[V] Connection not present, creating a new instance
[V] [AGENT] Connecting to agent (192.168.250.218:4444)...
[+] [AGENT] Successfully connected to agent (192.168.250.218:4444)...
[D] [AGENT] Executing command: os_version
[V] [SSH] Connecting (192.168.250.218:22)...
[+] [SSH] Connected (192.168.250.218:22)
[D] Creating temp folder: /var/root/needle/
[D] [REMOTE CMD] Remote Command: if [ -d /var/root/needle/ ]; then echo "yes"; else echo "no" ; fi
[D] [REMOTE CMD] Remote Command: mkdir /var/root/needle/
[D] [AGENT] Executing command: os_version
[*] Target app not selected. Launching wizard...
[D] [AGENT] Executing command: list_apps
[+] Apps found:
[>][QUESTION] Please select a number:

Environment

Needle Version

Framework (on your machine): 1.3.2
Agent (on your device): 1.0.5

Workstation Operating System

Kali 2018.1

Python Version

2.7.14+

Python Packages (`pip freeze`)

see https://gist.github.com/GrahamM/2738a6f312380fefef1d38f3596737bc

Device iOS Version

11.2

The text was updated successfully, but these errors were encountered:

whoot · 2018-03-21T08:29:34Z

Cant reproduce. Works fine for me on iOS 11.0.3.
With "HIDE_SYSTEM_APPS = True" I get:

[needle][list_apps] > run
[*] Checking connection with device...
[+] Already connected to: 192.168.1.120
[D] Creating temp folder: /var/root/needle/
[D] [REMOTE CMD] Remote Command: if [ -d /var/root/needle/ ]; then echo "yes"; else echo "no" ; fi
[*] Looking for apps...
[D] [AGENT] Executing command: list_apps
[+] Apps found:
		0 - org.coolstar.electra
		1 - com.highaltitudehacks.dvia

EDIT: Uhm... stupid question since you are using iOS 11.2: I dont think your device is jailbroken, isn´t it?
=> "The only requirement in order to run Needle effectively is a jailbroken device."

FernandoQuintero · 2018-04-12T06:35:02Z

Got the same problem, no Apps found, running
iDevice: IPAD 11.0.2
Host: MacOSX 10.13.3

Python 2.7.14
needle 1.3.2
needle agent: 1.0.5

Jailbreak with Electra, and all the stuff APT Strict installed.

Some idea?

klmitchell2 · 2018-04-21T19:36:31Z

On iOS 11.1 (with Electra 1.0.4 jailbreak) list_apps returns no applications as well. Setting APP to a known bundle identifier returns [!] KeyError: 'com.Example.App'.

klmitchell2 · 2018-04-23T00:35:44Z

Update: Enabling tweaks in Electra 1.0.4 results in list_apps working as expected.

whoot · 2018-04-24T14:47:45Z

Close and resolved?

peterfillmore · 2018-06-27T05:36:18Z

Worked out a fix for iOS 11.
iOS 11 has added an entitlement for list databases:
com.apple.private.coreservices.canmaplsdatabase

This needs to be added to the entitlements for the NeedleAgent

my fix was to resign the application with that entitlement
Heres the updated entitlement:

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>application-identifier</key>
	<string>U38MMB3T7J.mwr.needle.agent</string>
	<key>com.apple.developer.team-identifier</key>
	<string>U38MMB3T7J</string>
	<key>get-task-allow</key>
	<true/>
	<key>com.apple.private.coreservices.canmaplsdatabase</key>
	<true/>	
	<key>keychain-access-groups</key>
	<array>
		<string>U38MMB3T7J.mwr.needle.agent</string>
	</array>
</dict>
</plist>

Steps to fix

Install jtool onto the device.
dump the current entitlements
/Applications/NeedleAgent.app root# jtool.liberios -arch arm64 --ent ./NeedleAgent > ./NeedleAgent.ent
Thin the binary to arm64
jtool -e arch -arch arm64 ./NeedleAgent64
Resign the thinned binary
jtool.liberios --sign --ent NeedleAgent.ent --inplace ./NeedleAgent.arch_arm64
Backup old agent file
mv /Applications/NeedleAgent.app/NeedleAgent /Applications/NeedleAgent.app/NeedleAgent.backup
Remove current agent
rm -R /Applications/NeedleAgent.app/NeedleAgent
Refresh the uicache
uicache
Copy resigned app over
cp /Applications/NeedleAgent.app/NeedleAgent.arch_arm64 /Applications/NeedleAgent.app/NeedleAgent
refresh cache again
uicache

meetinthemiddle-be · 2018-07-24T16:38:19Z

I'm having the exact same issue; /device/list_apps module returns an empty list, but still asks for a number to input. manually setting APP to com.publisher.appname results in a KeyError (to be expected as you're trying to access an index in an empty list). Enabling Tweaks in Electra does not solve the issue as it did for @klmitchell2.

Version info in my setup:

on iPhone 6+
iOS: 11.1.2
Electra: 11.0-11.1.2
Needle Agent: 1.0.5

On Kali 2018.2
Python 2.7.15
Needle : 1.3.2

Any suggestions besides using the jtool workaround? In any event if the transition from iOS 10 to 11 would be the culprit, it seems strange that some people on iOS 11 can get the list without resigning? @peterfillmore : I'd like to get your input on this as why this is an issue for some iOS11 users but not all.

I started researching into the jtool workaround, but seem to run into a dead end there as well. "1. Install jtool onto the device" is already causing more questions than I can answer atm.

marco-lancini · 2018-07-26T16:34:43Z

@peterfillmore: resigning manually is not a viable option to consider. If that entitlement is really needed, we will have to release a new version of the Agent.

@peterfillmore, @meetinthemiddle-be: have you tried what proposed by @klmitchell2?

Update: Enabling tweaks in Electra 1.0.4 results in list_apps working as expected.

peterfillmore · 2018-07-26T21:33:36Z

Yes - tried to disable tweaks in electron jailbreak and that didn’t fix the issue. Checking the error logs indicated it was an entitlements issue with my particular device at least (iOS 11.0 - electron jailbreak) My understanding is that at some stage iOS added an entitlement to be able to read SQLite databases outside of an apps container (i think - I can’t seem to locate much info on this) Since in iOS 10 the app list lives in one of these dbs it needs that entitlement to then read that SQLite dB. Signing The needle agent with the appropriate entitlement seemed to fix the issue for me at least. Can anyone give us a root cause as to why disabling tweaks fixes the issue? As it’d make sense to see what clashes with needle in the tweaks. Thanks! Peter

…

On 27 Jul 2018, at 2:34 am, Marco Lancini ***@***.***> wrote: @peterfillmore: resigning manually is not a viable option to consider. If that entitlement is really needed, we will have to release a new version of the Agent. @peterfillmore, @meetinthemiddle-be: have you tried what proposed by @klmitchell2? Update: Enabling tweaks in Electra 1.0.4 results in list_apps working as expected. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

marco-lancini · 2018-07-26T21:36:05Z

@Yogehi: are you able to reproduce the issue/fix?

meetinthemiddle-be · 2018-07-27T06:08:37Z

Like @peterfillmore , for me toggling Electra "tweaks" didn't produce different results for Needle.

Aside from this issue, it might be an idea to catch this condition (zero length app list).

Also, if one knows the UUID of the app, which one could figure out manually through SSH, would there be a way of using that string in the APP variable directly if the app list is unavailable, rather than using it as a key for that list that might not be there?

Above there also seems to be some confusion about whether it's the enabling or disabling of the tweaks feature that would fix the issue; for me it's neither.

Yogehi · 2018-08-03T13:43:27Z

Update on this.

I'm still looking into how to resolve this. I agree that the additional entitlement should work. My issue right now is getting Xcode to allow me to compile Needle with the new entitlement.

I'll update this when I can.

Yogehi · 2018-08-07T23:00:36Z

Sooooooooo more bad news.

The ‘com.apple.private.coreservices.canmaplsdatabase‘ entitlement does work on iOS 11.0-11.2.

It does NOT work on iOS 11.3.1.

meetinthemiddle-be · 2018-08-08T17:05:06Z

If this is a limitation of Needle and it's documented, that's the way it is.

Is there still a possibility of just using the UUID in the APP variable directly without using the app list as a mapper between the two? This would be a workaround for the problem as this can be found out through SSH. We're already working with a rooted device to begin with so getting that value manually as a "plan B" seems acceptable to me.

poldenais · 2018-08-17T12:16:17Z

HI this is an issue for me as well, I have electra jailbreak on iOS 11.3.1 and list apps returns nothing when I attempt to run modules.

peterfillmore · 2018-08-17T14:28:10Z

Cheers. So can anyone throw a debug log here for 11.3.? Would have a look myself but don’t have one that fits the profile.

…

Sent from my iPhone

On 17 Aug 2018, at 10:16 pm, poldenais ***@***.***> wrote: HI this is an issue for me as well, I have electra jailbreak on iOS 11.3.1 and list apps returns nothing when I attempt to run modules. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

poldenais · 2018-08-20T08:45:27Z

Device iOS Version with Electra JB

11.3.1

Expected behaviour

Target app wizard returns apps to be targeted

Actual behaviour

Target app wizard returns nothing.

Steps to reproduce

Run a module, and allow the target app wizard to run.
needle error logs

[needle] > use binary/info/metadata
[needle][metadata] > run
[D] Setup local output folder: /Users/paulnash/.needle/output
[?] Attention! The folder chosen to store local output is not empty: /Users/paulnash/.needle/output
[?] Do you want to back it up first?
[?] Y: the content will be archived in a different location, then the folder will be emptied
[?] N: no action will be taken (destination files might be overwritten in case of filename clash)
[y/n]: y
[V] Archiving local output folder: /Users/paulnash/.needle/output --> /Users/paulnash/.needle/backup/needle-output_2018-08-20-09:35:28
[D] Copying: /Users/paulnash/.needle/output -> /Users/paulnash/.needle/backup/needle-output_2018-08-20-09:35:28
[D] Deleting: /Users/paulnash/.needle/output
[D] Creating local output folder: /Users/paulnash/.needle/output
[D] Setting up issues database...
[D] [DB] QUERY: CREATE TABLE IF NOT EXISTS issues (app TEXT, module TEXT, name TEXT, content TEXT, confidence TEXT, outfile TEXT)
[D] Setting up issues database...
[D] [DB] QUERY: CREATE TABLE IF NOT EXISTS issues (app TEXT, module TEXT, name TEXT, content TEXT, confidence TEXT, outfile TEXT)
[*] Checking connection with device...
[V] Connection not present, creating a new instance
[D] Setting up USB port forwarding on port 2222
[D] [LOCAL CMD] Local Subprocess Command: /Users/paulnash/Downloads/needle-master/needle/libs/usbmuxd/tcprelay.py -t 22:2222
[D] [AGENT] Setting up port forwarding on port 4444
[V] [AGENT] Connecting to agent (127.0.0.1:4444)...
[+] [AGENT] Successfully connected to agent (127.0.0.1:4444)...
[D] [AGENT] Executing command: os_version
[V] [SSH] Connecting (127.0.0.1:2222)...
[+] [SSH] Connected (127.0.0.1:2222)
[D] Creating temp folder: /var/root/needle/
[D] [REMOTE CMD] Remote Command: if [ -d /var/root/needle/ ]; then echo "yes"; else echo "no" ; fi
[D] [AGENT] Executing command: os_version
[*] Target app not selected. Launching wizard...
[D] [AGENT] Executing command: list_apps
[+] Apps found:
[>][QUESTION] Please select a number:

Needle Version

Framework (on MacBook): 1.3.2
Agent (on iPad device): 1.0.5

Python Version

2.7

poldenais · 2018-08-27T14:13:01Z

Hi Is anything else needed above? thanks,

Yogehi · 2018-09-21T21:41:37Z

hi everyone,

i had time to look into this today and i discovered that my ios 11.3.1 device randomly started using the device/list_apps module just fine.

i took some other ios 11 devices i had around me, played with them with different configurations, and came up with the following workaround to get needle working on ios:

restart device and enter your passcode to unlock the device
wait 5 minutes
run electra with tweaks ON
if device/list_apps != work {
	restart device and enter your passcode to unlock the device
	wait 5 minutes
	run electra with tweaks OFF
	restart device and enter your passcode to unlock the device
	wait 5 minutes
	run elextra with tweaks ON
}

i can confirm this worked for the following:

iphone 7s running ios 11.3.1
iphone 6s running ios 11.1.1
iphone 6 running ios 11.3.1

could other people who are still having issues try this for me please?

poldenais · 2018-10-10T13:36:23Z

Hi @Yogehi,
I had the list apps problem but now it is working and the apps on the device are being listed. But when
The apps are listing but when I choose an option, I get the following below now.

Device iOS Version with Electra JB

11.3.1

[?] Resetting connection to device...
[V] [AGENT] Connecting to agent (127.0.0.1:4444)...
[+] [AGENT] Successfully connected to agent (127.0.0.1:4444)...
[V] [SSH] Connecting (127.0.0.1:2222)...
[+] [SSH] Connected (127.0.0.1:2222)
[?] Rerunning last command...
[!] sh: lipo: command not found

marco-lancini · 2018-10-10T16:50:25Z

@poldenais, from your error I can say that lipo has not been installed on your device

poldenais · 2018-10-11T17:28:43Z

@marco-lancini thanks Marco, I got that sorted now and installed Darwin CC again. My jailbreak wasn't right. still getting [!] sh: open: command not found on some commands though

milo991 · 2019-05-21T16:34:15Z

I'm having the same issue with list_apps coming back blank on IOS 11.2.1 with Electra, I've tried disabling / re-enabling tweaks on Electra but still not working.

Can get a shell through needle but can't run many modules at all

HenryHoggard added the bug label Mar 19, 2018

gerimisc mentioned this issue Jul 18, 2018

LIST_APPS crashes NeedleAgent 1.0.5 (Terminating app due to uncaught exception 'NSInvalidArgumentException'...) #256

Closed

marco-lancini added waiting_feedback loc-agent labels Jul 26, 2018

marco-lancini added the feature/enhancement label Aug 5, 2018

Yogehi mentioned this issue Jun 4, 2019

Support for iOS 11 planned? #212

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[iOS11] list_apps fails #242

[iOS11] list_apps fails #242

GrahamM commented Mar 14, 2018

whoot commented Mar 21, 2018 •

edited

Loading

FernandoQuintero commented Apr 12, 2018 •

edited

Loading

klmitchell2 commented Apr 21, 2018 •

edited

Loading

klmitchell2 commented Apr 23, 2018

whoot commented Apr 24, 2018

peterfillmore commented Jun 27, 2018

meetinthemiddle-be commented Jul 24, 2018 •

edited

Loading

marco-lancini commented Jul 26, 2018

peterfillmore commented Jul 26, 2018 via email

marco-lancini commented Jul 26, 2018

meetinthemiddle-be commented Jul 27, 2018

Yogehi commented Aug 3, 2018

Yogehi commented Aug 7, 2018

meetinthemiddle-be commented Aug 8, 2018

poldenais commented Aug 17, 2018

peterfillmore commented Aug 17, 2018 via email

poldenais commented Aug 20, 2018

poldenais commented Aug 27, 2018

Yogehi commented Sep 21, 2018 •

edited

Loading

poldenais commented Oct 10, 2018

marco-lancini commented Oct 10, 2018

poldenais commented Oct 11, 2018 •

edited

Loading

milo991 commented May 21, 2019

[iOS11] list_apps fails #242

[iOS11] list_apps fails #242

Comments

GrahamM commented Mar 14, 2018

Issue

Expected behaviour

Actual behaviour

Steps to reproduce

needle error logs

Environment

Needle Version

Workstation Operating System

Python Version

Python Packages (pip freeze)

Device iOS Version

whoot commented Mar 21, 2018 • edited Loading

FernandoQuintero commented Apr 12, 2018 • edited Loading

klmitchell2 commented Apr 21, 2018 • edited Loading

klmitchell2 commented Apr 23, 2018

whoot commented Apr 24, 2018

peterfillmore commented Jun 27, 2018

meetinthemiddle-be commented Jul 24, 2018 • edited Loading

marco-lancini commented Jul 26, 2018

peterfillmore commented Jul 26, 2018 via email

marco-lancini commented Jul 26, 2018

meetinthemiddle-be commented Jul 27, 2018

Yogehi commented Aug 3, 2018

Yogehi commented Aug 7, 2018

meetinthemiddle-be commented Aug 8, 2018

poldenais commented Aug 17, 2018

peterfillmore commented Aug 17, 2018 via email

poldenais commented Aug 20, 2018

poldenais commented Aug 27, 2018

Yogehi commented Sep 21, 2018 • edited Loading

poldenais commented Oct 10, 2018

marco-lancini commented Oct 10, 2018

poldenais commented Oct 11, 2018 • edited Loading

milo991 commented May 21, 2019

Python Packages (`pip freeze`)

whoot commented Mar 21, 2018 •

edited

Loading

FernandoQuintero commented Apr 12, 2018 •

edited

Loading

klmitchell2 commented Apr 21, 2018 •

edited

Loading

meetinthemiddle-be commented Jul 24, 2018 •

edited

Loading

Yogehi commented Sep 21, 2018 •

edited

Loading

poldenais commented Oct 11, 2018 •

edited

Loading