Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
<str<strong>on</strong>g>Analysis</str<strong>on</strong>g> <str<strong>on</strong>g>of</str<strong>on</strong>g> <str<strong>on</strong>g>Pegasus</str<strong>on</strong>g> KASLR Exploit<br />
The sec<strong>on</strong>d stage, Stage 2, is resp<strong>on</strong>sible for escalating privileges <strong>on</strong> <str<strong>on</strong>g>the</str<strong>on</strong>g> victim’s iPh<strong>on</strong>e and<br />
establishing an envir<strong>on</strong>ment where jailbreaking <str<strong>on</strong>g>the</str<strong>on</strong>g> victim’s device is possible. The Stage 2<br />
binary is used in two distinct c<strong>on</strong>texts within <str<strong>on</strong>g>Pegasus</str<strong>on</strong>g>. By default, Stage 2 c<strong>on</strong>stitutes a<br />
complete <strong>iOS</strong> kernel exploit. Alternatively, <str<strong>on</strong>g>the</str<strong>on</strong>g> Stage 2 binary attempts to detect <strong>iOS</strong> devices<br />
that have already been jailbroken and, in cases where an existing jailbreak is detected (and has<br />
installed a known backdoor), uses <str<strong>on</strong>g>the</str<strong>on</strong>g> pre-existing backdoor mechanisms to install <str<strong>on</strong>g>Pegasus</str<strong>on</strong>g><br />
specific kernel patches.<br />
In order to perform <str<strong>on</strong>g>the</str<strong>on</strong>g>se tasks, Stage 2 must first determine <str<strong>on</strong>g>the</str<strong>on</strong>g> locati<strong>on</strong> <str<strong>on</strong>g>of</str<strong>on</strong>g> <str<strong>on</strong>g>the</str<strong>on</strong>g> kernel in<br />
memory, escalate its own privileges, disable safeguards, and <str<strong>on</strong>g>the</str<strong>on</strong>g>n install <str<strong>on</strong>g>the</str<strong>on</strong>g> necessary tools for<br />
jailbreaking a device. In order to accommodate multiple iPh<strong>on</strong>e versi<strong>on</strong>s, Stage 2 comes in two<br />
flavors, 32-bit and 64-bit. Toge<str<strong>on</strong>g>the</str<strong>on</strong>g>r, <str<strong>on</strong>g>the</str<strong>on</strong>g> two versi<strong>on</strong>s <str<strong>on</strong>g>of</str<strong>on</strong>g> <str<strong>on</strong>g>the</str<strong>on</strong>g> Stage 2 binary target a total <str<strong>on</strong>g>of</str<strong>on</strong>g> 199<br />
iPh<strong>on</strong>e combinati<strong>on</strong>s.<br />
The Stage 2 variants share a lot <str<strong>on</strong>g>of</str<strong>on</strong>g> design similarities, but deviate enough in <str<strong>on</strong>g>the</str<strong>on</strong>g>ir approach that<br />
it is best to look at each variant in relative isolati<strong>on</strong>. The subsecti<strong>on</strong>s that follow will walk through<br />
<str<strong>on</strong>g>the</str<strong>on</strong>g> steps involved in each <str<strong>on</strong>g>of</str<strong>on</strong>g> <str<strong>on</strong>g>the</str<strong>on</strong>g> Stage 2 variants while pointing out areas <str<strong>on</strong>g>of</str<strong>on</strong>g> similarity between<br />
<str<strong>on</strong>g>the</str<strong>on</strong>g> variants when <str<strong>on</strong>g>the</str<strong>on</strong>g>y arise.<br />
Differences Between 32 and 64-Bit Binaries<br />
The 32-bit Stage 2 binary (or simply “32Stage2”) operates <strong>on</strong> <str<strong>on</strong>g>the</str<strong>on</strong>g> older iPh<strong>on</strong>e models (iPh<strong>on</strong>e<br />
4S through iPh<strong>on</strong>e 5c) and targets <strong>iOS</strong> 9.0 through <strong>iOS</strong> 9.3.3. The 64-bit Stage 2 binary (or<br />
simply “64Stage2”) operates <strong>on</strong> <str<strong>on</strong>g>the</str<strong>on</strong>g> newer iPh<strong>on</strong>e models (iPh<strong>on</strong>e 5S and later) and targets <strong>iOS</strong><br />
9.0 through <strong>iOS</strong> 9.3.3. Both binaries perform <str<strong>on</strong>g>the</str<strong>on</strong>g> same general steps and exploit <str<strong>on</strong>g>the</str<strong>on</strong>g> same<br />
underlying vulnerabilities. However, <str<strong>on</strong>g>the</str<strong>on</strong>g> exploitati<strong>on</strong> <str<strong>on</strong>g>of</str<strong>on</strong>g> <str<strong>on</strong>g>the</str<strong>on</strong>g>se vulnerabilities varies between<br />
versi<strong>on</strong>s. In areas where <str<strong>on</strong>g>the</str<strong>on</strong>g> mechanisms differ substantially <str<strong>on</strong>g>the</str<strong>on</strong>g> differences will be specifically<br />
noted or discussed separately.<br />
API Loading<br />
Stage 2 requires a number <str<strong>on</strong>g>of</str<strong>on</strong>g> API functi<strong>on</strong>s to be present in order to succeed. In order to ensure<br />
<str<strong>on</strong>g>the</str<strong>on</strong>g> functi<strong>on</strong>s are available, Stage 2 dynamically loads <str<strong>on</strong>g>the</str<strong>on</strong>g> necessary API functi<strong>on</strong> addresses via<br />
dlsym calls. While dynamically resolving API functi<strong>on</strong> addresses is by no means a novel<br />
technique for malware, what is interesting about Stage 2’s API loading is <str<strong>on</strong>g>the</str<strong>on</strong>g> fact that <str<strong>on</strong>g>the</str<strong>on</strong>g><br />
authors <str<strong>on</strong>g>of</str<strong>on</strong>g> <str<strong>on</strong>g>the</str<strong>on</strong>g> binary reload many <str<strong>on</strong>g>of</str<strong>on</strong>g> <str<strong>on</strong>g>the</str<strong>on</strong>g> API functi<strong>on</strong>s multiple times. In <str<strong>on</strong>g>the</str<strong>on</strong>g> main functi<strong>on</strong><br />
al<strong>on</strong>e, a large number <str<strong>on</strong>g>of</str<strong>on</strong>g> API functi<strong>on</strong> addresses are loaded with <strong>on</strong>ly a small subset <str<strong>on</strong>g>of</str<strong>on</strong>g> those<br />
functi<strong>on</strong>s ever finding <str<strong>on</strong>g>the</str<strong>on</strong>g>mselves used during <str<strong>on</strong>g>the</str<strong>on</strong>g> course <str<strong>on</strong>g>of</str<strong>on</strong>g> Stage 2’s executi<strong>on</strong> (for example,<br />
<str<strong>on</strong>g>the</str<strong>on</strong>g> address <str<strong>on</strong>g>of</str<strong>on</strong>g> socket is loaded into memory but is never called). After loading <str<strong>on</strong>g>the</str<strong>on</strong>g> initial set <str<strong>on</strong>g>of</str<strong>on</strong>g><br />
Page 12