Reverse - Mac uses OpenSSH to connect remotely to jailbreak iPhone

Mac uses OpenSSH to connect remotely to jailbreak iPhone

1. Introduction

SSH (Secure Shell), which means "Secure Shell Protocol", is a protocol that can provide security for remote login. Using SSH, all transmitted data can be encrypted, making "man-in-the-middle" attacks impossible. Prevent DNS spoofing and IP spoofing.
OpenSSH is a free and open source implementation of the SSH protocol, which allows Mac to remotely log in to iPhone through OpenSSH.

2. WiFi connection

SSH communicates through the TCP protocol, so make sure your Mac and iPhone are on the same LAN, such as connected to the same WiFi.
In the Mac terminal enter:

ssh 账户名@服务器主机地址
比如ssh root@10.1.1.168(这里的服务器是手机)
OpenSSH初始密码:alpine (可在手机Cydia-->已安装-->OpenSSH-->OpenSSH Access HowTo 查看)

连接后退出命令:exit

Insert image description here
Insert image description here
Please refer to the reverse environment construction information for details.

3. USB connection

Download the usbmuxd tool package (download the v1.0.8 version, mainly using a python script inside: tcprelay.py )
https://cgit.sukimashita.com/usbmuxd.git/snapshot/usbmuxd-1.0.8.tar.gz

1. Port mapping:
Map the iPhone's 22 port (SSH port) to the Mac's local 10010 port (not necessarily 10010 port, as long as it is not a reserved port)端口就是设备对外提供服务的窗口,每个端口都有个端口号(范围是0~65535,共2^16个)
有些端口号是保留的,已经规定了用途,比如
21端口提供FTP服务
80端口提供HTTP服务
22端口提供SSH服务(可以查看/etc/ssh/sshd_config的Port字段)
更多保留端口号: https://baike.baidu.com/item/端口号/10883658#4_3

cd 到tcprelay.py所在文件目录下
python tcprelay.py -t 22:10010 #iPhone 22 端口映射到本地10010端口
加上-t参数是为了能够同时支持多个SSH连接

After success, it will be as shown in the figure. Note: Do not close it. You can press Ctr+t to restart a new page for operation.
Insert image description here
2. Log in
. After the port mapping is completed, if you want to communicate with the iPhone's port 22 in the future, you can directly communicate with the local Mac port 10010. Open
a new terminal interface and log in to the Mac's local port 10010 via SSH (choose 1 of the following two methods)

ssh root@localhost -p 10010
ssh root@127.0.0.1 -p 10010

localhost is a domain name, the IP address pointed to is 127.0.0.1, the IP address of the local virtual network card

4. OpenSSH password-free authentication

It can be found that you need to enter a password every time you connect, which is very anti-locking. We can achieve password-free authentication login by appending the public key to the authorization file bit.

SSH-2 provides 2 commonly used client authentication methods
: password-based client authentication (authentication using account and password, key-based client authentication)
password-free authentication (the most secure authentication method)

By default, SSH-2 will try "key authentication" first. If authentication fails, "password authentication" will be tried.

The steps are as follows
. Method 1: (I implemented it the same way here, but the operation failed, so I used method 2)
ssh-copy-id root@服务器主机地址
ssh-copy-id will automatically append the content of the client ~/.ssh/id_rsa.pub to the server's ~/ .ssh/authorized_keys tail
Method 2:
1. Copy the client (Mac) public key to the server (iPhone)
1. Connect to the server using password ssh root@localhost -p 10010
2. Create a .ssh folder on the server mkdir .ssh
3. cp ~/.ssh/id_rsa.pub /Users/baidu/DesktopCopy the public key to the desktop
4. Then open iFunBox, copy the public key to the .ssh file
5. Append the public key content to the end of the authorization file: cat ~/id_rsa.pub >> ~/.ssh/authorized_keys
6. Delete the public key:rm ~/id_rsa.pub

Solved the problem of SSH connection failure after iPhone10.3.X jailbreak

ssh root@localhost -p 10010 -v #查看连接详情信息

Insert image description here
As shown in the picture, the process has been stuck. Insert image description here
I don’t know why. Try the following solutions:
1. Uninstall OpengSSH on the phone;
2. Add the source http://cydia.ichitaso.com;
3. Search and install dropbear;
4. Then install OpenSSH.
After the above solution steps are completed, the USB connection can be used, but the WiFi connection method still does not work. This may be related to the fact that my phone is not perfectly jailbroken, so I will use USB connection for the time being. Record it here so you can learn from it later.

Guess you like

Origin blog.csdn.net/haifangnihao/article/details/99450084