sensepost / sensepost/objection

Apps using iCloud Keychain fail on dumping keychain

Open
#229 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

🐛bug
Dominant language
Python
Stars
9.4k
Forks
1k
Avg merge
14d 5h
Merged PRs (30d)
1

Description

Describe the bug
If an app is using iCloud Keychain, running ios keychain dump causes an error.

I'm not sure if this is due to using iCloud Keychain, or if it's exposing a bug in another piece of functionality.

To Reproduce
Steps to reproduce the behavior:

  1. Connect to an app utilizing iCloud Keychain
  2. Run command ios keychain dump

Expected behavior
Dumping the keychain contents (if iCloud Keychain secrets aren't supported, print other secrets on the device).

Evidence / Logs / Screenshots

> objection --debug --network --host 10.11.12.13 --gadget "com.corp.app" explore
[debug] Agent path is: c:\python37\lib\site-packages\objection\agent.js
[debug] Injecting agent...
Using networked device @`10.11.12.13:27042`
[debug] Attempting to attach to process: `com.corp.app`
[debug] Unable to find process: `com.corp.app`, attempting spawn
[debug] PID `726` spawned, attaching...
[debug] Resuming PID `726`
Agent injected and responds ok!

     _     _         _   _
 ___| |_  |_|___ ___| |_|_|___ ___
| . | . | | | -_|  _|  _| | . |   |
|___|___|_| |___|___|_| |_|___|_|_|
        |___|(object)inject(ion) v1.6.3

     Runtime Mobile Exploration
        by: @leonjza from @sensepost

[tab] for command suggestions
com.corp.app on (iPad: 11.4) [net] # ios keychain dump
Note: You may be asked to authenticate using the devices passcode or TouchID
Save the output by adding `--json keychain.json` to this command
Dumping the iOS keychain...
A Frida agent exception has occurred.
TypeError: undefined not callable (property 'keyEnumerator' of [object Object])
    at [anon] (duk_js_call.c:2870)
    at src/ios/keychain.ts:190
    at src/ios/keychain.ts:112
    at map (native)
    at src/ios/keychain.ts:140
    at frida/runtime/message-dispatcher.js:45
    at o (frida/runtime/message-dispatcher.js:25)

Python stack trace: Traceback (most recent call last):
  File "c:\python37\lib\site-packages\objection\console\repl.py", line 371, in start_repl
    self.run_command(document)
  File "c:\python37\lib\site-packages\objection\console\repl.py", line 185, in run_command
    exec_method(arguments)
  File "c:\python37\lib\site-packages\objection\commands\ios\keychain.py", line 65, in dump
    keychain = api.ios_keychain_list()
  File "c:\python37\lib\site-packages\frida\core.py", line 322, in method
    return script._rpc_request('call', js_name, args)
  File "c:\python37\lib\site-packages\frida\core.py", line 250, in _rpc_request
    raise result[2]
frida.core.RPCException: TypeError: undefined not callable (property 'keyEnumerator' of [object Object])
    at [anon] (duk_js_call.c:2870)
    at src/ios/keychain.ts:190
    at src/ios/keychain.ts:112
    at map (native)
    at src/ios/keychain.ts:140
    at frida/runtime/message-dispatcher.js:45
    at o (frida/runtime/message-dispatcher.js:25)

Environment (please complete the following information):

  • Device: iPad 6th gen
  • OS: iOS 11.4, Windows host
  • Frida Version 12.6.4 (frida-server)
  • Objection Version: 1.6.3

Additional context
Other apps using the Keychain seem to work fine.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with src/ios/keychain.ts at the reported lines 112, 140, and 190, then reproduce the failure with ios keychain dump against an app using iCloud Keychain. Trace why keyEnumerator is unavailable and verify that the command no longer raises the reported exception, while dumping supported keychain contents or handling unsupported secrets gracefully.

Written by the indexing model from the issue text.

Assessment

Tech stack
ios, python
Domain
mobile-dev, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.