Racoon String Format Overflow Exploit - Revision history

LeoI07: patch'd

2022-07-12T16:45:17Z

patch'd

IAdam1n at 17:12, 29 August 2013

2013-08-29T17:12:08Z

Http: config file content

2012-02-19T11:10:06Z

config file content

Http: initial page

2012-01-18T11:12:28Z

initial page

New page

Using a fuzzer, a format string vulnerability in the racoon configuration parsing code was found. racoon is the IPsec IKE daemon (http://ipsec-tools.sourceforge.net/). It comes by default with iOS and is started when you setup an IPsec connection.

The exploitation of the format string vulnerability is different than what was done in 2001.

For the jailbreak to be applied at boot, racoon is started by a [[launchd]] [[plist]] file, executing the command: <code>racoon -f racoon-exploit.conf</code>

racoon-exploit.conf is a large configuration file exploiting the format string bug to get the unsigned code started.

The format string bug is utilized to copy the ROP bootstrap payload to the memory and to execute it by overwriting a saved LR in the racoon stack by a stack pivot gadget.

The ROP bootstrap payload copies the ROP exploit payload from the payload file which is distributed with [[Corona]] then stack pivot to it. The idea is to escape from format strings as fast as possible, because they are CPU time consuming.

The ROP exploit payload triggers the kernel exploit (see [[HFS Heap Overflow]]).

==Credit==
*[[pod2g]] for finding this vulnerability and writing a working exploit

==References==
*[http://pod2g-ios.blogspot.com/2012/01/details-on-corona.html pod2g's blog]

{{stub}}
[[Category:Exploits]]

← Older revision		Revision as of 16:45, 12 July 2022
Line 24:		Line 24:

	The ROP exploit payload triggers the kernel exploit (see [[HFS Heap Overflow]]).		The ROP exploit payload triggers the kernel exploit (see [[HFS Heap Overflow]]).
		+
		+	The exploit wasn't patched until 13.3.1, with a CVE ID of [https://www.cve.org/CVERecord?id=CVE-2020-3840 CVE-2020-3840].

	==Credit==		==Credit==

@@ Line 3: / Line 3: @@
 The exploitation of the format string vulnerability is different than what was done in 2001.
-For the jailbreak to be applied at boot, racoon is started by a [[launchd]] [[plist]] file, executing the command: <code>racoon -f racoon-exploit.conf</code>
+For the jailbreak to be applied at boot, racoon is started by a [[launchd]] [[PList File Format|plist]] file, executing the command: <code>racoon -f racoon-exploit.conf</code>
 racoon-exploit.conf is a large (682KB) configuration file exploiting the format string bug to get the unsigned code started and looks like this:

@@ Line 5: / Line 5: @@
 For the jailbreak to be applied at boot, racoon is started by a [[launchd]] [[plist]] file, executing the command: <code>racoon -f racoon-exploit.conf</code>
-racoon-exploit.conf is a large configuration file exploiting the format string bug to get the unsigned code started.
+racoon-exploit.conf is a large (682KB) configuration file exploiting the format string bug to get the unsigned code started and looks like this:
 The format string bug is utilized to copy the ROP bootstrap payload to the memory and to execute it by overwriting a saved LR in the racoon stack by a stack pivot gadget.