2 bugs 1 safari https://github.com/Bo0oM/Safiler https://github.com/Bo0oM/CVE-2017-7089

1. 2 BUGS 1 SAFARI

2. Whoami
• @i_bo0om
• JBFC member
• Security researcher

3. Safari…

4. Part 1. Local
file reader

5. .DS_Store
In the Apple macOS operating system, .DS_Store is a file
that stores custom attributes of its containing folder, such
as the position of icons or the choice of a background
image. The name is an abbreviation of Desktop Services
Store, reflecting its purpose. It is created and maintained
by the Finder application in every folder, and has functions
similar to the file desktop.ini in Microsoft Windows.
Starting with a full stop (period) character, it is hidden in
Finder and many Unix utilities. Its internal structure is
proprietary

6. .DS_Store
• Service file .DS_Store is created automatically, when a directory is opened
• While, similar to Windows’ Thumbs.db .DS_Store keeps files’ thumbnails,
unlike Windows it also contains the names of files and directories

7. .DS_Store parser

9. /home/username/
backups
documents
pictures
2016
2017
source
sql
scan
emails

10. For example, applying this approach to the home directory
(~/.DS_Store), we could get back:
["Backups","Soft","Pictures",".ssh"...]
Then, following that up with ~/Backups/.DS_Store, we get:
["2017", "2016", "2015", …]
Next, we proceed to ~/Backups/2017/.DS_Store
["source", "sql", "static", …]

11. Potentially
dangerous files
~/.ssh/id_rsa;
~/.ssh/id_rsa.key;
~/.ssh/id_rsa.pub;
~/.ssh/known_hosts;
~/.ssh/authorized_keys;

12. Cookies
Safari cookies:
• ~/Library/Cookies/com.apple.Safari.cookies
Cookie of other programs:
• ~/Library/Cookies/Cookies.binarycookies
• ~/Library/Cookies/*

13. • Cookies.binarycookies
• HSTS.plist
• SafariNotificationAgent.binarycookies
• com.apple.Safari.SearchHelper.binarycookies
• com.apple.Safari.cookies
• com.apple.accountsd.binarycookies
• com.apple.appstore.cookies
• com.apple.iTunes.binarycookies
• com.apple.ibooks.cookies
• com.apple.spotlight.cookies
• com.apple.systempreferences.binarycookies
• com.apple.twitter.xpc.binarycookies
• com.feingeist.Shimo.binarycookies
• com.getdropbox.DropboxMetaInstaller.binarycookies
• com.hnc.Discord.binarycookies
• com.macpaw.CleanMyMac3.binarycookies
• com.parallels.desktop.console.binarycookies
• com.parallels.toolbox.binarycookies
• com.skype.skype.binarycookies
• ...

14. Accounts
Another good find is the information about the
system accounts:
• ~/Library/Accounts/Accounts4.sqlite
To top off the list, let’s also get the information
about other applications
• ~/Library/Application Support/

15. Chrome
~/Library/Application
Support/Google/Chrome/Default/Login
Data
~/Library/Application
Support/Google/Chrome/Default/Cookies
~/Library/Application
Support/Google/Chrome/Default/History

16. SO…

17. XHR to local files

18. …if a file is
local — you
get access!

19. How to find out
the user's
login?

20. /etc/passwd?
¯_(ツ)_/¯

21. /var/log/system.log
/var/log/install.log

22. Egrep log files

23. xhr.open('GET', 'file://'+file+', false);

24. xhr.open('GET', 'file://'+file+';/https:%2f%2fgoogle.com/', false);

26. OpenMe.html
Thx Wupco (https://www.wupco.cn/?p=4134)

29. PoC https://github.com/Bo0oM/Safiler

30. Part 2.
Parent-tab

34. WTF https://apple.com == parent-tab://apple.com

36. Local PoC exploit

38. https://bo0om.ru/parent-tab.html source:

39. Final exploit by Frans Rosén:

40. Exploitation 
1
Victim opens the link
2
PWN PWN PWN

41. CVE-2017-7089
Available for: Windows 7 and
later
Available for: OS X El Capitan
10.11.6, macOS Sierra 10.12.6,
and macOS High Sierra 10.13
Available for: iPhone 5s and
later, iPad Air and later, and
iPod touch 6th generation

43. Q?