https://www.theiphonewiki.com/w/index.php?action=history&feed=atom&title=MobileBackup_Copy_Exploit 2026-05-08T15:07:09Z Revision history for this page on the wiki MediaWiki 1.31.14 https://www.theiphonewiki.com/w/index.php?title=MobileBackup_Copy_Exploit&diff=11013&oldid=prev 2010-10-23T02:04:03Z

<p>Put it in the same format as most exploit pages.</p> <table class="diff diff-contentalign-left" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="en"> <td colspan="2" style="background-color: #fff; color: #222; text-align: center;">← Older revision</td> <td colspan="2" style="background-color: #fff; color: #222; text-align: center;">Revision as of 02:04, 23 October 2010</td> </tr><tr> <td colspan="2" class="diff-lineno">Line 1:</td> <td colspan="2" class="diff-lineno">Line 1:</td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>This is a vulnerability utilized by [[Spirit]].</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>==Credit==</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>[[User:Comex|comex]]</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>==Details==</div></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>BackupAgent normally restricts files to be restored to a specific set of directories ("domains"). It even has a check to ensure that ".." isn't in the path:</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>BackupAgent normally restricts files to be restored to a specific set of directories ("domains"). It even has a check to ensure that ".." isn't in the path:</div></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td colspan="2" class="diff-lineno">Line 8:</td> <td colspan="2" class="diff-lineno">Line 14:</td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>This was fixed in iOS 3.2.1 and 4.0.</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>This was fixed in iOS 3.2.1 and 4.0.</div></td> </tr> <tr> <td class="diff-marker">−</td> <td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"></td> <td colspan="2" class="diff-empty">&#160;</td> </tr> <tr> <td class="diff-marker">−</td> <td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>Used in [[comex]]'s [[Spirit]] Jailbreak.</div></td> <td colspan="2" class="diff-empty">&#160;</td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>[[Category:Exploits]]</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>[[Category:Exploits]]</div></td> </tr> <!-- diff cache key theiphon_wikidb:diff:wikidiff2:1.12:old-10997:rev-11013:1.7.2:0 --> </table>

Dialexio https://www.theiphonewiki.com/w/index.php?title=MobileBackup_Copy_Exploit&diff=10997&oldid=prev 2010-10-22T21:32:19Z

<p></p> <table class="diff diff-contentalign-left" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="en"> <td colspan="2" style="background-color: #fff; color: #222; text-align: center;">← Older revision</td> <td colspan="2" style="background-color: #fff; color: #222; text-align: center;">Revision as of 21:32, 22 October 2010</td> </tr><tr> <td colspan="2" class="diff-lineno">Line 8:</td> <td colspan="2" class="diff-lineno">Line 8:</td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>This was fixed in iOS 3.2.1 and 4.0.</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>This was fixed in iOS 3.2.1 and 4.0.</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Used in [[comex]]'s [[Spirit]] Jailbreak.</div></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>[[Category:Exploits]]</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>[[Category:Exploits]]</div></td> </tr> <!-- diff cache key theiphon_wikidb:diff:wikidiff2:1.12:old-7389:rev-10997:1.7.2:0 --> </table>

Jack https://www.theiphonewiki.com/w/index.php?title=MobileBackup_Copy_Exploit&diff=7389&oldid=prev 2010-07-23T18:14:27Z

<p></p> <table class="diff diff-contentalign-left" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="en"> <td colspan="2" style="background-color: #fff; color: #222; text-align: center;">← Older revision</td> <td colspan="2" style="background-color: #fff; color: #222; text-align: center;">Revision as of 18:14, 23 July 2010</td> </tr><tr> <td colspan="2" class="diff-lineno">Line 6:</td> <td colspan="2" class="diff-lineno">Line 6:</td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div> Library/Preferences/SystemConfiguration/../../../../../var/db/launchd.db/com.apple.launchd/overrides.plist</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div> Library/Preferences/SystemConfiguration/../../../../../var/db/launchd.db/com.apple.launchd/overrides.plist</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>This was fixed in iOS 3.2.1 and 4.0.</div></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>[[Category:Exploits]]</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>[[Category:Exploits]]</div></td> </tr> <!-- diff cache key theiphon_wikidb:diff:wikidiff2:1.12:old-7003:rev-7389:1.7.2:0 --> </table>

Comex https://www.theiphonewiki.com/w/index.php?title=MobileBackup_Copy_Exploit&diff=7003&oldid=prev 2010-07-15T02:58:54Z

<p>Added to &quot;Exploits&quot; category.</p> <table class="diff diff-contentalign-left" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="en"> <td colspan="2" style="background-color: #fff; color: #222; text-align: center;">← Older revision</td> <td colspan="2" style="background-color: #fff; color: #222; text-align: center;">Revision as of 02:58, 15 July 2010</td> </tr><tr> <td colspan="2" class="diff-lineno">Line 6:</td> <td colspan="2" class="diff-lineno">Line 6:</td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div> Library/Preferences/SystemConfiguration/../../../../../var/db/launchd.db/com.apple.launchd/overrides.plist</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f8f9fa; color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div> Library/Preferences/SystemConfiguration/../../../../../var/db/launchd.db/com.apple.launchd/overrides.plist</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color: #222; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>[[Category:Exploits]]</div></td> </tr> <!-- diff cache key theiphon_wikidb:diff:wikidiff2:1.12:old-6387:rev-7003:1.7.2:0 --> </table>

Dialexio https://www.theiphonewiki.com/w/index.php?title=MobileBackup_Copy_Exploit&diff=6387&oldid=prev 2010-05-14T23:11:34Z

<p>New page: BackupAgent normally restricts files to be restored to a specific set of directories (&quot;domains&quot;). It even has a check to ensure that &quot;..&quot; isn&#039;t in the path: Path contains sneaky dots...</p> <p><b>New page</b></p><div>BackupAgent normally restricts files to be restored to a specific set of directories (&quot;domains&quot;). It even has a check to ensure that &quot;..&quot; isn't in the path:<br /> <br /> Path contains sneaky dots to traverse up outside of the domain: %@<br /> <br /> However, for some reason, this check isn't applied when taking alternate code paths for special handling of certain files. For example, a restore to HomeDomain with a path starting with Library/Preferences/SystemConfiguration/ is migrated to the new directory for system configuration, /var/preferences/SystemConfiguration. This bypasses the sneaky dots check, so spirit is able to restore to this path:<br /> <br /> Library/Preferences/SystemConfiguration/../../../../../var/db/launchd.db/com.apple.launchd/overrides.plist</div>

Comex