{"id":37660,"date":"2022-11-20T14:23:00","date_gmt":"2022-11-20T19:23:00","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=37660"},"modified":"2022-11-20T14:23:00","modified_gmt":"2022-11-20T19:23:00","slug":"forcedentry-sandbox-escape-via-nsexpression","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2022\/11\/20\/forcedentry-sandbox-escape-via-nsexpression\/","title":{"rendered":"FORCEDENTRY Sandbox Escape via NSExpression"},"content":{"rendered":"<p><a href=\"https:\/\/googleprojectzero.blogspot.com\/2022\/03\/forcedentry-sandbox-escape.html\">Ian Beer and Samuel Gro&szlig;<\/a> (back in March):<\/p>\n<blockquote cite=\"https:\/\/googleprojectzero.blogspot.com\/2022\/03\/forcedentry-sandbox-escape.html\"><p>It&rsquo;s clearly a serialized <a href=\"https:\/\/developer.apple.com\/documentation\/foundation\/nskeyedarchiver?language=objc\">NSKeyedArchiver<\/a>. Definitely not what you&rsquo;d expect to see in a <code>JBIG2Bitmap<\/code> object. Running <code>strings<\/code> we see plenty of interesting things[&#8230;]<\/p><p>[&#8230;]<\/p><p><code>NSPredicates<\/code> using the <code>FUNCTION<\/code> keyword are effectively Objective-C scripts. With some tricks it&rsquo;s possible to build nested function calls which can do almost anything you could do in procedural Objective-C. Figuring out some of those tricks was the key to the 2019 <a href=\"https:\/\/realworldctf.com\/\">Real World CTF<\/a><a href=\"https:\/\/github.com\/ChiChou\/DezhouInstrumenz\/\">DezhouInstrumenz<\/a> challenge, which would evaluate an attacker supplied <code>NSExpression<\/code> format string. The <a href=\"https:\/\/blog.chichou.me\/2021\/01\/16\/see-no-eval-runtime-code-execution-objc\/\">writeup by the challenge author<\/a> is a great introduction to these ideas[&#8230;]<\/p><p>[&#8230;]<\/p><p>Prior to iOS 14.5 the isa field of an Objective-C object was not protected by Pointer Authentication Codes (PAC), so the JBIG2 machine builds a fake Objective-C object with a fake isa such that the invocation of the <code>dealloc<\/code> selector causes the deserialization and evaluation of the <code>NSFunctionExpression<\/code>. This is very similar to the technique used by <a href=\"https:\/\/googleprojectzero.blogspot.com\/2020\/01\/remote-iphone-exploitation-part-3.html\">Samuel in the 2020 SLOP post<\/a>.<\/p><p>[&#8230;]<\/p><p>Perhaps the most striking takeaway is the depth of the attack surface reachable from what would hopefully be a fairly constrained sandbox.<\/p><\/blockquote>\n\n<p>Previously:<\/p>\n<ul>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2021\/12\/17\/forcedentry-imessage-zero-click-remote-code-execution\/\">FORCEDENTRY iMessage Zero-click Remote Code Execution<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2019\/08\/23\/imessage-nskeyedarchiver-and-_nsdatafilebackedfuture\/\">iMessage, NSKeyedArchiver, and _NSDataFileBackedFuture<\/a><\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"<p>Ian Beer and Samuel Gro&szlig; (back in March): It&rsquo;s clearly a serialized NSKeyedArchiver. Definitely not what you&rsquo;d expect to see in a JBIG2Bitmap object. Running strings we see plenty of interesting things[&#8230;][&#8230;]NSPredicates using the FUNCTION keyword are effectively Objective-C scripts. With some tricks it&rsquo;s possible to build nested function calls which can do almost anything [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"apple_news_api_created_at":"2022-11-20T19:23:02Z","apple_news_api_id":"6b68dd5d-fd85-4de1-9e97-58e4d1fe21b9","apple_news_api_modified_at":"2022-11-20T19:23:02Z","apple_news_api_revision":"AAAAAAAAAAD\/\/\/\/\/\/\/\/\/\/w==","apple_news_api_share_url":"https:\/\/apple.news\/Aa2jdXf2FTeGel1jk0f4huQ","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_is_hidden":false,"apple_news_is_paid":false,"apple_news_is_preview":false,"apple_news_is_sponsored":false,"apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":"\"\"","apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"footnotes":""},"categories":[4],"tags":[69,2095,54,71,48,1473],"class_list":["post-37660","post","type-post","status-publish","format-standard","hentry","category-programming-category","tag-cocoa","tag-exploit","tag-objective-c","tag-programming","tag-security","tag-xpc"],"apple_news_notices":[],"_links":{"self":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/37660","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/comments?post=37660"}],"version-history":[{"count":1,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/37660\/revisions"}],"predecessor-version":[{"id":37661,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/37660\/revisions\/37661"}],"wp:attachment":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/media?parent=37660"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/categories?post=37660"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/tags?post=37660"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}