iOS Extracting Entitlements From Compiled Application
Summary of the page https://mas.owasp.org/MASTG/tests/ios/MASVS-PLATFORM/MASTG-TEST-0069/#review-entitlements-embedded-in-the-compiled-app-binary
Extracting Entitlements and Mobile Provision Files
When dealing with an app's IPA or an installed app on a jailbroken device, finding .entitlements files or the embedded.mobileprovision file directly may not be possible. However, entitlements property lists can still be extracted from the app binary, following the procedures outlined in the "iOS Basic Security Testing" chapter, particularly the "Acquiring the App Binary" section.
Even with encrypted binaries, certain steps can be employed to extract these files. Should these steps fail, tools such as Clutch (if compatible with the iOS version), frida-ios-dump, or similar utilities may be required to decrypt and extract the app.
Extracting the Entitlements Plist from the App Binary
With the app binary accessible on a computer, binwalk can be utilized to extract all XML files. The command below demonstrates how to do so:
Alternatively, radare2 can be used to quietly run a command and exit, searching for all strings in the app binary that contain "PropertyList":
Both methods, binwalk and radare2, enable the extraction of plist files, with an inspection of the first one (0x0015d2a4) revealing a successful recovery of the original entitlements file from Telegram.
For app binaries accessed on jailbroken devices (e.g., via SSH), the grep command with the -a, --text flag can be used to treat all files as ASCII text:
Adjusting the -A num, --after-context=num flag allows for the display of more or fewer lines. This method is viable even for encrypted app binaries and has been verified against multiple App Store apps. Tools mentioned earlier may also be employed on jailbroken iOS devices for similar purposes.
Note: Direct use of the strings command is not recommended for this task due to its limitations in finding relevant information. Instead, employing grep with the -a flag on the binary or utilizing radare2 (izz)/rabin2 (-zz) is advisable for more effective results.
Last updated