Advertisement
Guest User

wtf

a guest
Nov 15th, 2019
183
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. - (IBAction)jelbrek {
  2.    
  3.    
  4.     [dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_HIGH, 0ul), ^{
  5.        
  6.         dispatch_async(dispatch_get_main_queue(), ^{
  7.             self.status.text = @"Exploit: 1/9";
  8.            
  9.         });
  10.        
  11.         // MARK: EXPLOIT
  12.         runExploit((__bridge void *)(self));
  13.        
  14.         escapeSandbox();
  15.        
  16.        
  17.         dispatch_async(dispatch_get_main_queue(), ^{
  18.             self.status.text = @"Exploit: 2/9";
  19.            
  20.         });
  21.        
  22.        
  23.         init_with_kbase(tfp0, kernel_base);
  24.        
  25.         dispatch_async(dispatch_get_main_queue(), ^{
  26.             self.status.text = @"Exploit: 3/9";
  27.            
  28.         });
  29.        
  30.         rootify(getpid());
  31.         dispatch_async(dispatch_get_main_queue(), ^{
  32.             self.status.text = @"Exploit: 4/9";
  33.            
  34.         });
  35.        
  36.        
  37.         setHSP4();
  38.         dispatch_async(dispatch_get_main_queue(), ^{
  39.             self.status.text = @"Exploit: 5/9";
  40.            
  41.         });
  42.        
  43.        
  44.         setcsflags(getpid()); // set some csflags
  45.         dispatch_async(dispatch_get_main_queue(), ^{
  46.             self.status.text = @"Exploit: 6/9";
  47.            
  48.         });
  49.        
  50.        
  51.         platformize(getpid()); // set TF_PLATFORM
  52.        
  53.         dispatch_async(dispatch_get_main_queue(), ^{
  54.             self.status.text = @"Exploit: 7/9";
  55.            
  56.         });
  57.        
  58.        
  59.         UnlockNVRAM();
  60.         dispatch_async(dispatch_get_main_queue(), ^{
  61.             self.status.text = @"Exploit: 8/9";
  62.            
  63.         });
  64.        
  65.         dispatch_async(dispatch_get_main_queue(), ^{
  66.             self.status.text = @"Exploit: 9/9";
  67.            
  68.         });
  69.        
  70.         self.status.text = @"Activating SSH";
  71.         chdir("/var/containers/Bundle/");
  72.        
  73.         removeFile("/var/containers/Bundle/iosbinpack64/usr/local/bin/dropbear");
  74.         removeFile("/var/containers/Bundle/iosbinpack64/usr/bin/scp");
  75.        
  76.         FILE *fixed_dropbear = fopen((char*)in_bundle("tars/dropbear.v2018.76.tar"), "r");
  77.         untar(fixed_dropbear, "/var/containers/Bundle/");
  78.         fclose(fixed_dropbear);
  79.        
  80.         prepare_payload(); // this will chmod 777 everything
  81.        
  82.         // MARK: SETUP
  83.         //----- setup SSH -----//
  84.         mkdir("/var/dropbear", 0777);
  85.         removeFile("/var/profile");
  86.         removeFile("/var/motd");
  87.         chmod("/var/profile", 0777);
  88.         chmod("/var/motd", 0777);
  89.        
  90.         copyFile("/var/containers/Bundle/iosbinpack64/etc/profile", "/var/profile");
  91.         copyFile("/var/containers/Bundle/iosbinpack64/etc/motd", "/var/motd");
  92.        
  93.         // kill it if running
  94.         launch("/var/containers/Bundle/iosbinpack64/usr/bin/killall", "-SEGV", "dropbear", NULL, NULL, NULL, NULL, NULL);
  95.         failIf(launchAsPlatform("/var/containers/Bundle/iosbinpack64/usr/local/bin/dropbear", "-R", "-E", NULL, NULL, NULL, NULL, NULL), "[-] Failed to launch dropbear");
  96.         pid_t dpd = pid_of_procName("dropbear");
  97.         usleep(1000);
  98.         if (!dpd) failIf(launchAsPlatform("/var/containers/Bundle/iosbinpack64/usr/local/bin/dropbear", "-R", "-E", NULL, NULL, NULL, NULL, NULL), "[-] Failed to launch dropbear");
  99.        
  100.        
  101.         //------------- launch daeamons -------------//
  102.         //-- you can drop any daemon plist in iosbinpack64/LaunchDaemons and it will be loaded automatically --//
  103.        
  104.         plists = [[NSFileManager defaultManager] contentsOfDirectoryAtPath:@"/var/containers/Bundle/iosbinpack64/LaunchDaemons" error:nil];
  105.        
  106.                 dispatch_async(dispatch_get_main_queue(), ^{
  107.                     self.status.text = @"done!";
  108.                    
  109.                 });
  110.                
  111.                
  112.                 LOG("[+] Really jailbroken!");
  113.                 term_jelbrek();
  114.                
  115.                 // bye bye
  116.                 //kill(bb, 9);
  117.                 //launch("/var/containers/Bundle/iosbinpack64/bin/bash", "-c", "/var/containers/Bundle/iosbinpack64/usr/bin/nohup /var/containers/Bundle/iosbinpack64/bin/bash -c \"/var/containers/Bundle/iosbinpack64/bin/launchctl unload /System/Library/LaunchDaemons/com.apple.backboardd.plist && /var/containers/Bundle/iosbinpack64/usr/bin/ldrestart; /var/containers/Bundle/iosbinpack64/bin/launchctl load /System/Library/LaunchDaemons/com.apple.backboardd.plist\" 2>&1 >/dev/null &", NULL, NULL, NULL, NULL, NULL);
  118.                 exit(0);
  119.                
  120.                
  121.                
  122.             }
  123.            
  124.            
  125.            
  126.                     });
  127.      
  128.  
  129.      
  130.      int system_(char *cmd) {
  131.          return launch("/var/bin/bash", "-c", cmd, NULL, NULL, NULL, NULL, NULL);
  132.      }
  133.  
  134.  
  135.      NSError *error = NULL;
  136.      NSArray *plists;
  137.  
  138.  
  139.  
  140.      - (int)extracted {
  141.          return setHSP4();
  142.      
  143.      }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement