iOS App Penetration Testing
Ok, I’ve lagged with this article…time to get on with it!
So once the iOS device is setup and ready for analysis, the next step is to get to know the app. The following steps will be taken for this purpose:
- Connect to the device
- Identify the path on the iOS device where the app sits
- Decrypt the binary (App Store apps)
- Identify supporting files of interest in the folder (data files etc)
For this, I connect to the device using SSH, and have root level access to the file system.
The path of the app depends on whether the app being analyzed is a native app, or one downloaded from the App Store. All native apps (apps shipped with the device) can be found under the root directory in the /Applications folder, and are unencrypted. All apps downloaded from the App Store will be located under the /private/var/mobile/Applications folder and will be encrypted. The easiest way to find the path is to convert the com.apple.mobile.installation.plist file to a human readable XML format and identify the app/path. This can be done with ‘plutil’ from Erica Utilities (available via Cydia).
- Copy the file to your home directory:
ios:~ root# cp /private/var/mobile/Library/Caches/com.apple.mobile.installation.plist . - Run plutil with the ‘-convert xml1‘ option
ios:~ root# plutil -convert xml1 com.apple.mobile.installation.plist
Converted 1 files to XML format
ios:~ root# - Search the converted XML file for the app
ios:~ root# cat com.apple.mobile.installation.plist | grep myapp
com.t myapp.com.myapp
myapp
myapp
com.myapp.com.MyApp
MyApp
com.TargetApp.usa.TargetApp
123ABC456C.com.myapp.com.MyApp
/private/var/mobile/Applications/0D5E8824-4598-4F96-AA0E-E8ED4D907B00/MyApp.app
The last line in this output shows the path we want: /private/var/mobile/Applications/0D5E8824-4598-4F96-AA0E-E8ED4D907B00/MyApp.app. This is a folder that contains the binary we want.
We can now use Clutch (available from GitHub) to decrypt the binary. Copy it to the iOS device, and run it to display the apps available for decryption:
On my computer:
0x414141:dldir adamkliarsky$ scp Clutch-1.4.3 root@192.168.1.139:/var/root/.
root@192.168.1.139’s password:
Clutch-1.4.3 100% 834KB 833.7KB/s 00:00
0x414141:dldir adamkliarsky$
On the iOS device:
ios:~ root# chmod 755 Clutch
ios:~ root# ./Clutch-1.4.3
Clutch 1.4.3
———————————
1) Twitter
2) Facebook
3) Pandora
4) MyApp
We see that the app we want (“MyApp”)is shown by Clutch as option #4. Run Clutch again, passing the ‘4’ as an argument.
ios:~ root# ./Clutch-1.4.3 4
Clutch 1.4.3
———————————
Cracking MyApp…
Creating working directory…
Performing initial analysis…
dumping binary: analyzing load commands
dumping binary: obtaining ptrace handle
dumping binary: forking to begin tracing
dumping binary: successfully forked
—– —————-
This produces a zipped .ipa file containing the unencrypted binary under a directory called ‘Payload’. Unzip this to access the files for analysis:
ios:~ root# unzip MyApp-v1.1.4-ak-\(Clutch-1.4.3\).ipa
Archive: MyApp-v1.1.4-ak-(Clutch-1.4.3).ipa
creating: Payload/MyApp.app/
extracting: Payload/MyApp.app/114.png
extracting: Payload/MyApp.app/120.png
extracting: Payload/MyApp.app/29.png
extracting: Payload/MyApp.app/50.png
—– —————-
At this point we can start poking around in the directories to find files of interest (runtime activities might find more) such as database files (.db, .sqlite), log files, property list files (.plist) etc.
Leave a Reply