Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- - (IBAction)jelbrek {
- [dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_HIGH, 0ul), ^{
- dispatch_async(dispatch_get_main_queue(), ^{
- self.status.text = @"Exploit: 1/9";
- });
- // MARK: EXPLOIT
- runExploit((__bridge void *)(self));
- escapeSandbox();
- dispatch_async(dispatch_get_main_queue(), ^{
- self.status.text = @"Exploit: 2/9";
- });
- init_with_kbase(tfp0, kernel_base);
- dispatch_async(dispatch_get_main_queue(), ^{
- self.status.text = @"Exploit: 3/9";
- });
- rootify(getpid());
- dispatch_async(dispatch_get_main_queue(), ^{
- self.status.text = @"Exploit: 4/9";
- });
- setHSP4();
- dispatch_async(dispatch_get_main_queue(), ^{
- self.status.text = @"Exploit: 5/9";
- });
- setcsflags(getpid()); // set some csflags
- dispatch_async(dispatch_get_main_queue(), ^{
- self.status.text = @"Exploit: 6/9";
- });
- platformize(getpid()); // set TF_PLATFORM
- dispatch_async(dispatch_get_main_queue(), ^{
- self.status.text = @"Exploit: 7/9";
- });
- UnlockNVRAM();
- dispatch_async(dispatch_get_main_queue(), ^{
- self.status.text = @"Exploit: 8/9";
- });
- dispatch_async(dispatch_get_main_queue(), ^{
- self.status.text = @"Exploit: 9/9";
- });
- self.status.text = @"Activating SSH";
- chdir("/var/containers/Bundle/");
- removeFile("/var/containers/Bundle/iosbinpack64/usr/local/bin/dropbear");
- removeFile("/var/containers/Bundle/iosbinpack64/usr/bin/scp");
- FILE *fixed_dropbear = fopen((char*)in_bundle("tars/dropbear.v2018.76.tar"), "r");
- untar(fixed_dropbear, "/var/containers/Bundle/");
- fclose(fixed_dropbear);
- prepare_payload(); // this will chmod 777 everything
- // MARK: SETUP
- //----- setup SSH -----//
- mkdir("/var/dropbear", 0777);
- removeFile("/var/profile");
- removeFile("/var/motd");
- chmod("/var/profile", 0777);
- chmod("/var/motd", 0777);
- copyFile("/var/containers/Bundle/iosbinpack64/etc/profile", "/var/profile");
- copyFile("/var/containers/Bundle/iosbinpack64/etc/motd", "/var/motd");
- // kill it if running
- launch("/var/containers/Bundle/iosbinpack64/usr/bin/killall", "-SEGV", "dropbear", NULL, NULL, NULL, NULL, NULL);
- failIf(launchAsPlatform("/var/containers/Bundle/iosbinpack64/usr/local/bin/dropbear", "-R", "-E", NULL, NULL, NULL, NULL, NULL), "[-] Failed to launch dropbear");
- pid_t dpd = pid_of_procName("dropbear");
- usleep(1000);
- if (!dpd) failIf(launchAsPlatform("/var/containers/Bundle/iosbinpack64/usr/local/bin/dropbear", "-R", "-E", NULL, NULL, NULL, NULL, NULL), "[-] Failed to launch dropbear");
- //------------- launch daeamons -------------//
- //-- you can drop any daemon plist in iosbinpack64/LaunchDaemons and it will be loaded automatically --//
- plists = [[NSFileManager defaultManager] contentsOfDirectoryAtPath:@"/var/containers/Bundle/iosbinpack64/LaunchDaemons" error:nil];
- dispatch_async(dispatch_get_main_queue(), ^{
- self.status.text = @"done!";
- });
- LOG("[+] Really jailbroken!");
- term_jelbrek();
- // bye bye
- //kill(bb, 9);
- //launch("/var/containers/Bundle/iosbinpack64/bin/bash", "-c", "/var/containers/Bundle/iosbinpack64/usr/bin/nohup /var/containers/Bundle/iosbinpack64/bin/bash -c \"/var/containers/Bundle/iosbinpack64/bin/launchctl unload /System/Library/LaunchDaemons/com.apple.backboardd.plist && /var/containers/Bundle/iosbinpack64/usr/bin/ldrestart; /var/containers/Bundle/iosbinpack64/bin/launchctl load /System/Library/LaunchDaemons/com.apple.backboardd.plist\" 2>&1 >/dev/null &", NULL, NULL, NULL, NULL, NULL);
- exit(0);
- }
- });
- int system_(char *cmd) {
- return launch("/var/bin/bash", "-c", cmd, NULL, NULL, NULL, NULL, NULL);
- }
- NSError *error = NULL;
- NSArray *plists;
- - (int)extracted {
- return setHSP4();
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement