ios-hooking-with-objection.md (13563B)
1 --- 2 title: "iOS Hooking with Objection" 3 section: "Mobile" 4 sectionSlug: "mobile-pentesting" 5 sourcePath: "src/mobile-pentesting/ios-pentesting/ios-hooking-with-objection.md" 6 sourceUrl: "https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/mobile-pentesting/ios-pentesting/ios-hooking-with-objection.md" 7 sha: "188de82beb54e70956b2952367a0af91d26758b8" 8 isIndex: false 9 modified: true 10 license: "CC-BY-NC-4.0" 11 --- 12 13 # iOS Hooking with Objection 14 15 For this section the tool [**Objection**](https://github.com/sensepost/objection) is going to be used.<sup>[[1]](#references)</sup>\ 16 Start by getting an objection's session executing something like: 17 18 ```bash 19 objection -d --gadget "iGoat-Swift" explore 20 objection -d --gadget "OWASP.iGoat-Swift" explore 21 ``` 22 23 You can execute also `frida-ps -Uia` to check the running processes of the phone. 24 25 ## Basic Enumeration of the app 26 27 ### Local App Paths 28 29 - `env`: Find the paths where the application is stored inside the device 30 31 ```bash 32 env 33 34 Name Path 35 ----------------- ----------------------------------------------------------------------------------------------- 36 BundlePath /private/var/containers/Bundle/Application/179A6E8B-E7A8-476E-BBE3-B9300F546068/iGoat-Swift.app 37 CachesDirectory /var/mobile/Containers/Data/Application/A079DF84-726C-4AEA-A194-805B97B3684A/Library/Caches 38 DocumentDirectory /var/mobile/Containers/Data/Application/A079DF84-726C-4AEA-A194-805B97B3684A/Documents 39 LibraryDirectory /var/mobile/Containers/Data/Application/A079DF84-726C-4AEA-A194-805B97B3684A/Library 40 ``` 41 42 ### List Bundles, frameworks and libraries 43 44 - `ios bundles list_bundles`: List bundles of the application 45 46 ```bash 47 ios bundles list_bundles 48 Executable Bundle Version Path 49 ------------ -------------------- --------- ------------------------------------------- 50 iGoat-Swift OWASP.iGoat-Swift 1.0 ...8-476E-BBE3-B9300F546068/iGoat-Swift.app 51 AGXMetalA9 com.apple.AGXMetalA9 172.18.4 ...tem/Library/Extensions/AGXMetalA9.bundle 52 ``` 53 54 - `ios bundles list_frameworks`: List external frameworks used by the application 55 56 ```bash 57 ios bundles list_frameworks 58 Executable Bundle Version Path 59 ------------------------------ -------------------------------------------- ---------- ------------------------------------------- 60 ReactCommon org.cocoapods.ReactCommon 0.61.5 ...tle.app/Frameworks/ReactCommon.framework 61 ...vateFrameworks/CoreDuetContext.framework 62 FBReactNativeSpec org.cocoapods.FBReactNativeSpec 0.61.5 ...p/Frameworks/FBReactNativeSpec.framework 63 ...ystem/Library/Frameworks/IOKit.framework 64 RCTAnimation org.cocoapods.RCTAnimation 0.61.5 ...le.app/Frameworks/RCTAnimation.framework 65 jsinspector org.cocoapods.jsinspector 0.61.5 ...tle.app/Frameworks/jsinspector.framework 66 DoubleConversion org.cocoapods.DoubleConversion 1.1.6 ...pp/Frameworks/DoubleConversion.framework 67 react_native_config org.cocoapods.react-native-config 0.12.0 ...Frameworks/react_native_config.framework 68 react_native_netinfo org.cocoapods.react-native-netinfo 4.4.0 ...rameworks/react_native_netinfo.framework 69 PureLayout org.cocoapods.PureLayout 3.1.5 ...ttle.app/Frameworks/PureLayout.framework 70 GoogleUtilities org.cocoapods.GoogleUtilities 6.6.0 ...app/Frameworks/GoogleUtilities.framework 71 RCTNetwork org.cocoapods.RCTNetwork 0.61.5 ...ttle.app/Frameworks/RCTNetwork.framework 72 RCTActionSheet org.cocoapods.RCTActionSheet 0.61.5 ....app/Frameworks/RCTActionSheet.framework 73 react_native_image_editor org.cocoapods.react-native-image-editor 2.1.0 ...orks/react_native_image_editor.framework 74 CoreModules org.cocoapods.CoreModules 0.61.5 ...tle.app/Frameworks/CoreModules.framework 75 RCTVibration org.cocoapods.RCTVibration 0.61.5 ...le.app/Frameworks/RCTVibration.framework 76 RNGestureHandler org.cocoapods.RNGestureHandler 1.6.1 ...pp/Frameworks/RNGestureHandler.framework 77 RNCClipboard org.cocoapods.RNCClipboard 1.5.1 ...le.app/Frameworks/RNCClipboard.framework 78 react_native_image_picker org.cocoapods.react-native-image-picker 2.3.4 ...orks/react_native_image_picker.framework 79 [..] 80 ``` 81 82 - `memory list modules`: List loaded modules in memory 83 84 ```bash 85 memory list modules 86 Name Base Size Path 87 ----------------------------------- ----------- ------------------- ------------------------------------------------------------------------------ 88 iGoat-Swift 0x104ffc000 2326528 (2.2 MiB) /private/var/containers/Bundle/Application/179A6E8B-E7A8-476E-BBE3-B9300F54... 89 SubstrateBootstrap.dylib 0x105354000 16384 (16.0 KiB) /usr/lib/substrate/SubstrateBootstrap.dylib 90 SystemConfiguration 0x1aa842000 495616 (484.0 KiB) /System/Library/Frameworks/SystemConfiguration.framework/SystemConfiguratio... 91 libc++.1.dylib 0x1bdcfd000 368640 (360.0 KiB) /usr/lib/libc++.1.dylib 92 libz.1.dylib 0x1efd3c000 73728 (72.0 KiB) /usr/lib/libz.1.dylib 93 libsqlite3.dylib 0x1c267f000 1585152 (1.5 MiB) /usr/lib/libsqlite3.dylib 94 Foundation 0x1ab550000 2732032 (2.6 MiB) /System/Library/Frameworks/Foundation.framework/Foundation 95 libobjc.A.dylib 0x1bdc64000 233472 (228.0 KiB) /usr/lib/libobjc.A.dylib 96 [...] 97 ``` 98 99 - `memory list exports <module_name>`: Exports of a loaded module 100 101 ```bash 102 memory list exports iGoat-Swift 103 Type Name Address 104 -------- -------------------------------------------------------------------------------------------------------------------------------------- ----------- 105 variable _mh_execute_header 0x104ffc000 106 function _mdictof 0x10516cb88 107 function _ZN9couchbase6differ10BaseDifferD2Ev 0x10516486c 108 function _ZN9couchbase6differ10BaseDifferD1Ev 0x1051648f4 109 function _ZN9couchbase6differ10BaseDifferD0Ev 0x1051648f8 110 function _ZN9couchbase6differ10BaseDiffer5setupEmm 0x10516490c 111 function _ZN9couchbase6differ10BaseDiffer11allocStripeEmm 0x105164a20 112 function _ZN9couchbase6differ10BaseDiffer7computeEmmj 0x105164ad8 113 function _ZN9couchbase6differ10BaseDiffer7changesEv 0x105164de4 114 function _ZN9couchbase6differ10BaseDiffer9addChangeENS0_6ChangeE 0x105164fa8 115 function _ZN9couchbase6differlsERNSt3__113basic_ostreamIcNS1_11char_traitsIcEEEERKNS0_6ChangeE 0x1051651d8 116 function _ZN9couchbase6differlsERNSt3__113basic_ostreamIcNS1_11char_traitsIcEEEERKNS1_6vectorINS0_6ChangeENS1_9allocatorIS8_EEEE 0x105165280 117 variable _ZTSN9couchbase6differ10BaseDifferE 0x1051d94f0 118 variable _ZTVN9couchbase6differ10BaseDifferE 0x10523c0a0 119 variable _ZTIN9couchbase6differ10BaseDifferE 0x10523c0f8 120 [..] 121 ``` 122 123 ### List classes of an APP 124 125 - `ios hooking list classes`: List classes of the app 126 127 ```bash 128 ios hooking list classes 129 130 AAAbsintheContext 131 AAAbsintheSigner 132 AAAbsintheSignerContextCache 133 AAAcceptedTermsController 134 AAAccount 135 AAAccountManagementUIResponse 136 AAAccountManager 137 AAAddEmailUIRequest 138 AAAppleIDSettingsRequest 139 AAAppleTVRequest 140 AAAttestationSigner 141 [...] 142 ``` 143 144 - `ios hooking search classes <search_term>`: Search a class that contains a string. You can **search some uniq term that is related to the main app package** name to find the main classes of the app like in the example: 145 146 ```bash 147 ios hooking search classes iGoat 148 iGoat_Swift.CoreDataHelper 149 iGoat_Swift.RCreditInfo 150 iGoat_Swift.SideContainmentSegue 151 iGoat_Swift.CenterContainmentSegue 152 iGoat_Swift.KeyStorageServerSideVC 153 iGoat_Swift.HintVC 154 iGoat_Swift.BinaryCookiesExerciseVC 155 iGoat_Swift.ExerciseDemoVC 156 iGoat_Swift.PlistStorageExerciseViewController 157 iGoat_Swift.CouchBaseExerciseVC 158 iGoat_Swift.MemoryManagementVC 159 [...] 160 ``` 161 162 ### List class methods 163 164 - `ios hooking list class_methods`: List methods of a specific class 165 166 ```bash 167 ios hooking list class_methods iGoat_Swift.RCreditInfo 168 - cvv 169 - setCvv: 170 - setName: 171 - .cxx_destruct 172 - name 173 - cardNumber 174 - init 175 - initWithValue: 176 - setCardNumber: 177 ``` 178 179 - `ios hooking search methods <search_term>`: Search a method that contains a string 180 181 ```bash 182 ios hooking search methods cvv 183 [AMSFinanceVerifyPurchaseResponse + _dialogRequestForCVVFromPayload:verifyType:] 184 [AMSFinanceVerifyPurchaseResponse - _handleCVVDialogResult:shouldReattempt:] 185 [AMSFinanceVerifyPurchaseResponse - _runCVVRequestForCode:error:] 186 [iGoat_Swift.RCreditInfo - cvv] 187 [iGoat_Swift.RCreditInfo - setCvv:] 188 [iGoat_Swift.RealmExerciseVC - creditCVVTextField] 189 [iGoat_Swift.RealmExerciseVC - setCreditCVVTextField:] 190 [iGoat_Swift.DeviceLogsExerciseVC - cvvTextField] 191 [iGoat_Swift.DeviceLogsExerciseVC - setCvvTextField:] 192 [iGoat_Swift.CloudMisconfigurationExerciseVC - cvvTxtField] 193 [iGoat_Swift.CloudMisconfigurationExerciseVC - setCvvTxtField:] 194 ``` 195 196 ## Basic Hooking 197 198 Now that you have **enumerated the classes and modules** used by the application you may have found some **interesting class and method names**. 199 200 ### Hook all methods of a class 201 202 - `ios hooking watch class <class_name>`: Hook all the methods of a class, dump all the initial parameters and returns 203 204 ```bash 205 ios hooking watch class iGoat_Swift.PlistStorageExerciseViewController 206 ``` 207 208 ### Hook a single method 209 210 - `ios hooking watch method "-[<class_name> <method_name>]" --dump-args --dump-return --dump-backtrace`: Hook a specific class method and dump its arguments, return value, and backtrace each time it is called 211 212 ```bash 213 ios hooking watch method "-[iGoat_Swift.BinaryCookiesExerciseVC verifyItemPressed]" --dump-args --dump-backtrace --dump-return 214 ``` 215 216 ### Change Boolean Return 217 218 - `ios hooking set return_value "-[<class_name> <method_name>]" false`: This will make the selected method return the indicated boolean 219 220 ```bash 221 ios hooking set return_value "-[iGoat_Swift.BinaryCookiesExerciseVC verifyItemPressed]" false 222 ``` 223 224 ### Generate hooking template 225 226 - `ios hooking generate simple <class_name>`: 227 228 ```bash 229 ios hooking generate simple iGoat_Swift.RCreditInfo 230 231 var target = ObjC.classes.iGoat_Swift.RCreditInfo; 232 233 Interceptor.attach(target['+ sharedSchema'].implementation, { 234 onEnter: function (args) { 235 console.log('Entering + sharedSchema!'); 236 }, 237 onLeave: function (retval) { 238 console.log('Leaving + sharedSchema'); 239 }, 240 }); 241 242 243 Interceptor.attach(target['+ className'].implementation, { 244 onEnter: function (args) { 245 console.log('Entering + className!'); 246 }, 247 onLeave: function (retval) { 248 console.log('Leaving + className'); 249 }, 250 }); 251 252 253 Interceptor.attach(target['- cvv'].implementation, { 254 onEnter: function (args) { 255 console.log('Entering - cvv!'); 256 }, 257 onLeave: function (retval) { 258 console.log('Leaving - cvv'); 259 }, 260 }); 261 262 263 Interceptor.attach(target['- setCvv:'].implementation, { 264 onEnter: function (args) { 265 console.log('Entering - setCvv:!'); 266 }, 267 onLeave: function (retval) { 268 console.log('Leaving - setCvv:'); 269 }, 270 }); 271 ``` 272 273 ## References 274 275 - [1] [Objection - Runtime Mobile Exploration](https://github.com/sensepost/objection)