iPwn for your iPhone

Late last year there was wide-spread exploitation of a default SSH password on jail broken iPhone devices. This resulted in the creation of an SSH worm by IkeeeX and numerous other exploits and malicious applications. At the time I was talking with some friends and we thought it would be cool if a rogue AP performed the default SSH authentication and automatically obtained the information out of a vulnerable phone for penetration testing purposes. I wrote a tool back then which did just that, as there is now wide-spread understanding of the dangers of running a jailbroken iPhone with the default password and the risk largely mitigated I decided I would share the code. I used BackTrack4, an Alfa AWUS036H USB WiFi device and wrote a set of scripts with a libssh2 C application to automatically configure a malicious access point for the purposes of hacking iPhone's with an insecure SSH password. I used airbase-ng to create an access point that appears to be a "Wi-Fi Zone - The Cloud". This type of accespoint is free for O2 iPhone users in the UK so many are setup to automatically join an accesspoint that matches this SSID. Once a phone has joined, DHCP is provided and a python script waits for a UDP packet on port 53 to signal a device is attempting to use the network. Once a new device has been identified a libssh2 application attempts to authenticate to the phone and if successful, downloads the Address Book, SMS database and all photos taken with the iPhone's camera and stores them in a local directory. The code is in a functioning state and has been tested without problems, you need only to boot backtrack4 and run the accesspoint.sh script to do all of the configuration and compiling work for you. I would like to expand the functionality of the attack code and perhaps create a Karmetasploit module for this issue but I have no time for this project anymore so this is left as an exercise for the reader. Enjoy the code which you can download here!