|
|
New Exploit from Free-X out! |
|
New Exploit from Free-X out! |
XBOX Security
-= Security Advisory =-
Advisory: XBOX Dashboard local vulnerability
Release Date: 2003/07/04
Last Modified: 2003/07/04
Author: Stefan Esser [se nopiracy.de]
Application: Microsoft XBOX Dashboard (up to today)
Severity: A vulnerability within the XBOX Dashboard allows to
totally compromise the security features of the XBOX.
Risk: Critical
Vendor Status: Vendor is not willing to talk about XBOX vulnerabilities.
Overview:
The XBOX Dashboard is what appears when you turn the XBOX on without a
disc in the DVD drive. It will let you adjust system settings, manage your save games, play and rip audio CDs and configure your XBOX Live
account. It is the heart of the XBOX and its most vulnerable point, because it lacks several security restrictions which are enforced on games. This includes the lack of the reboot-on-eject-button "feature", which is obligatory for all games.
The existance of an exploitable vulnerability within the dashboard could totally compromises the XBOX security system. It will make the box independent from Microsoft signed code and therefore this information is released to the public now on the 4th of July 2003, the day of the XBOX Independence.
Details:
Microsoft knows that a vulnerability within the XBOX dashboard could have serious impact. This is underlined by the fact that the dashboard checks most of its files against an internal stored SHA1 hash value before it uses them.
For an unknown reason this check is not performed on the audio (.wav) and font (.xtf) files. Unfourtunately for Microsoft there exists an
exploitable integer underflow vulnerabilitiy within the font file loader which can be exploited with a malformed font file. When the XTF header
is processed the dashboards reads a 4 byte blocksize field from the font file. This is expected to represent the size of some datablock including
the 4 bytes of the size field itself. The blocksize is then allocated and the sizefield is copied into the beginning of the buffer. This is already a possible overflow bug when the field contains the values 0..3. Due to memory alignment this is not exploitable. But then the blocksize is decreased by 4 because the dashboard wants to read the rest of the block into memory. Obviously values of 0..3 will underflow when decreased by 4 and this results in the dashboard wanting to read up to ~4 gigabytes of data from the font file in a f.e. 3 bytes buffer.
Because the XBOX malloc()/free() implementation is also storing control information inbound and is similiar to the Windows 2000/XP heap allocators this bug is exploitable and allows execution of arbitrary code. The attached proof of concept code shows that exploiting is possible with offsets that are equal on all dashboards and XBOX versions
known.
BTW: the dashboard loads its font files directly after the XBOX start animation. This means the exploit does not need any user interaction and when the code is executed only part of the
dashboard background is on screen.
Proof of Concept:
Attached you will find a proof of concept exploit which will start linux. To install it you have to rename the 2 XBOX font files within the font directory of the dashboard partition and then copy ernie.xtf and bert.xtf into this directory. (If you have an XBOX with an older dashboard the font directory does not exist and you must do the renaming and file adding work in the main directory). Once the new fonts are in place you copy the default.xbe (which is a copy of xbeboot) into the main directory and add your favourite linux to it.
Anticipated Questions:
Q1: How do I get the files onto the harddisk?
A1: There are several ways. You could f.e. install the files with the Mechassault or 007 hacks. This requires one of the games and the files on a memorycard. The other way is to open the box and do the harddisk swap trick which is described all over the net.
Q2: This vulnerability is in the dashboard, isn't it?
So Microsoft can simply update the dashboard with XBOX Live or with the help of new games.
A2: Yes Microsoft could try to upgrade the dashboard and fix the vulnerability with such an update, but keep in mind that this vulnerability is like a "local root" hole. You can do nearly
everything with it and this includes redirecting reads and writes to the xboxdash.xbe file. Additionally people who do not play games on
their box will not be reachable with such updates. And groups who pirate games can always disable the update feature.
Q3: Well but MS can make the kernel block the vulnerable dashboard.
A3: Indeed they can. But until boxes with new kernels reach the market we will have the end of this year (You can still get 1.0 boxes in shops over here) and they can only fix the bugs they know about.
Q4: Is it possible to play "backed-up" games with this?
A4: Yes it is possible to play pirated games by using this vulnerability but my proof of concept code will not allow this. You have to change
the exploit to patch the kernel in memory. This is not very hard and I am not going to help you with this.
Q5: Can I go "Live" with this hack?
A5: You have full control over the box with this vulnerability. You can modify the exploit to allow XBOX Live playing but this will only start a cat & mouse game with Microsoft.
Q6: I have read that I can solder my mainboard with this hack...
A6: This exploit has nothing to do with soldering, It will just run everything you want on unmodded (and even unopened) XBOXes. Infact when this hack is installed you do not need to solder anything to get your homebrew or whatever applications to run.
To read more or to download the uu-file, check out:
http://lists.netsys.com/
or http://article.gmane.org/
News-Source: http://www.maxconsole.com
| |
|
|
|
Related Stories |
|
|
Most Popular |
|
|
|
Rate this Article |
|
| | |
| Xbox Download Stats | | | Site Statistics
| |
HQ Online Statistics Members: 1 | Guests: 1,176 | Xbox Live Tags: 4,376
| | | |
Forums Active Users: 810
| News Active Users: 104
| Your Account Active Users: 75
| Xbox Games Active Users: 34
| Home Active Users: 31
| Private Messages Active Users: 28
| Downloads Active Users: 19
| Profile Active Users: 16
| Xbox Homebrew Active Users: 15
| Xbox Tutorials Active Users: 13
|
| View More Detailed Statistics |
| Popular Xbox Games | |
Full Throttle: Hell on Wheels Page Views: 305,336 Full Throttle, one of the most loved classic adventures from LucasArts Entertainment Company LLC, returns in a long awaited action packed sequel for next generation consoles and PC in 2003. The follow.. | | More Xbox Games | | HQ Network Affiliates | |
| Xbox-Hq.Com - Archived News | |
| Wednesday, April 24 | | Die by the Blade Slashes Its Way onto PC in M published by: BigJ | Page Views: 16 | Comments: 0 |
Tuesday, April 23 | | Umbraclaw hits Xbox, PlayStation, Switch & PC published by: BigJ | Page Views: 18 | Comments: 0 |
Monday, April 22 | | Mars 2120 launches out of Early Access onto a published by: BigJ | Page Views: 42 | Comments: 0 |
Thursday, April 18 | | GIC’24 Early Bird Tickets Now Available published by: BigJ | Page Views: 45 | Comments: 0 |
Wednesday, April 17 | | Killer Klowns From Outer Space: The Game laun published by: BigJ | Page Views: 50 | Comments: 0 |
| Epic Fantasy RPG 'Dungeons of Hinterberg' is published by: BigJ | Page Views: 48 | Comments: 0 |
Tuesday, April 16 | | Sleight of Hand launches Day One on Xbox Game published by: BigJ | Page Views: 65 | Comments: 0 |
Monday, April 15 | | Dune: Awakening Shows Off Stunning Unreal Eng published by: BigJ | Page Views: 97 | Comments: 0 |
| INDIE Live Expo Reveals First 2024 Showcase, published by: BigJ | Page Views: 79 | Comments: 0 |
Friday, April 12 | | Build Your Empire: 'Rise of Industry 2' Comin published by: BigJ | Page Views: 78 | Comments: 0 |
Thursday, April 11 | | Perennial Order is set to bloom on Xbox Serie published by: BigJ | Page Views: 76 | Comments: 0 |
| Metro Simulator 2 is coming soon for Xbox and published by: BigJ | Page Views: 79 | Comments: 0 |
Wednesday, April 10 | | Terminator: Survivors announced for Xbox Seri published by: BigJ | Page Views: 94 | Comments: 0 |
Tuesday, April 09 | | TMNT: Wrath of the Mutants Hits XBOX, PlaySta published by: BigJ | Page Views: 72 | Comments: 0 |
| devcom announces new venue, call for speakers published by: BigJ | Page Views: 83 | Comments: 0 |
Monday, April 08 | | Space Invaders Deck Commander - The Board Gam published by: BigJ | Page Views: 81 | Comments: 0 |
| Demolish & Build 3 is coming to Xbox, PlaySta published by: BigJ | Page Views: 88 | Comments: 0 |
Tuesday, March 26 | | Rugrats: Adventures in Gameland coming soon f published by: BigJ | Page Views: 116 | Comments: 0 |
Monday, March 25 | | Sci-fi adventure 'Sky of Tides' announced for published by: BigJ | Page Views: 129 | Comments: 0 |
Friday, March 22 | | Planet Zoo: Console Edition arrives on March published by: BigJ | Page Views: 138 | Comments: 0 |
Thursday, March 21 | | Taxi Life: A City Driving Simulator Out Now o published by: BigJ | Page Views: 100 | Comments: 0 |
| Terra Memoria is set to launch on Xbox Series published by: BigJ | Page Views: 138 | Comments: 0 |
Wednesday, March 20 | | MLB The Show 24 launches on Xbox Game Pass published by: BigJ | Page Views: 129 | Comments: 0 |
Tuesday, March 19 | | Discover the Sound of Life in The Lullaby of published by: BigJ | Page Views: 156 | Comments: 0 |
Monday, March 18 | | FLIPGO: A portable dual monitor that you can published by: BigJ | Page Views: 168 | Comments: 0 |
Thursday, March 14 | | Highwater launches this week on Xbox X|S, XB1 published by: BigJ | Page Views: 137 | Comments: 0 |
| JSAUX’S Black MODCASE for the ROG Ally Is Ava published by: BigJ | Page Views: 161 | Comments: 0 |
Wednesday, March 13 | | Paper Ghost Stories: Third Eye Open coming to published by: BigJ | Page Views: 142 | Comments: 0 |
Tuesday, March 12 | | Night Slashers: Remake confirmed for XBOX, Pl published by: BigJ | Page Views: 163 | Comments: 0 |
| RuneScape developer Jagex joins CVC Capital P published by: BigJ | Page Views: 159 | Comments: 0 |
Monday, March 11 | | Dark JRPG Graphic Adventure 'Neon Blood' debu published by: BigJ | Page Views: 156 | Comments: 0 |
Friday, March 08 | | WWII-based strategy epic Classified: France ' published by: BigJ | Page Views: 184 | Comments: 0 |
| Sonic X Shadow Generations hits Xbox One, Xbo published by: BigJ | Page Views: 189 | Comments: 0 |
Thursday, March 07 | | Explore the World of Ink Painting in Realm of published by: BigJ | Page Views: 135 | Comments: 0 |
Wednesday, March 06 | | Barton Lynch Pro Surfing Update v1.07 is LIVE published by: BigJ | Page Views: 134 | Comments: 0 |
| FALLEN LEAF Teams Up with STUDIOS EXTRAORDINA published by: BigJ | Page Views: 159 | Comments: 0 |
Tuesday, March 05 | | Goons: Legends & Mayhem: Meet the Cat Goon an published by: BigJ | Page Views: 136 | Comments: 0 |
Monday, March 04 | | Hauntii hits Xbox Game Pass for console and P published by: BigJ | Page Views: 175 | Comments: 0 |
| REVEIL launches this week on Xbox Series, PS5 published by: BigJ | Page Views: 143 | Comments: 0 |
Friday, March 01 | | Dark Atlas: Infernum launching on Xbox, PlayS published by: BigJ | Page Views: 180 | Comments: 0 |
News Archive
| |
|
|