Numerose Novità per quanto riguarda l'Hacking Xbox

postal85 · 5 Luglio 2003

Ci sono numerose novità questa settimana...
Molti sono gli hacking ed exploit pronti per essere eseguiti sulla vostra xbox...
Partiamo dalla modifica della dashboard originale.
Non tutti sanno che ora è possibile modificare la vostra dashboard M$ come più vi piace.
Per farlo seguite questo link

Non ho ancora personalmente provato... Il tempo è quello che è.
Se qualcuno avesse gia provato e volesse proporre una guida sapete dove contattarmi.

Per quanto riguarda gli exploit... beh ne sono usciti parecchi.
Abbiamo due metodologie basati comunque sugli exploit precendeti (ovvero 007 e mechassault).
Entrambi gli exploit risiedono nella dashboard originale...

Details:
Microsoft knows that a vulnerability within the XBOX dashboard could have serious impact. This is underlined by the fact that the dashboard checks most of its files against an internal stored SHA1 hash value before it uses them.

For an unknown reason this check is not performed on the audio (.wav) and font (.xtf) files. Unfourtunately for Microsoft there exists an exploitable integer underflow vulnerabilitiy within the font file loader which can be exploited with a malformed font file. When the XTF header is processed the dashboards reads a 4 byte blocksize field from the font file. This is expected to represent the size of some datablock including the 4 bytes of the size field itself. The blocksize is then allocated and the sizefield is copied into the beginning of the buffer. This is already a possible overflow bug when the field contains the values 0..3.
Due to memory alignment this is not exploitable. But then the blocksize is decreased by 4 because the dashboard wants to read the rest of the block into memory. Obviously values of 0..3 will underflow when decreased by 4 and this results in the dashboard wanting to read up to ~4 gigabytes of data from the font file in a f.e. 3 bytes buffer.

Because the XBOX malloc()/free() implementation is also storing control information inbound and is similiar to the Windows 2000/XP heap allocators this bug is exploitable and allows execution of arbitrary code. The attached proof of concept code shows that exploiting is possible with offsets that are equal on all dashboards and XBOX versions known.

BTW: the dashboard loads its font files directly after the XBOX start animation. This means the exploit does not need any user interaction and when the code is executed only part of the dashboard background is on screen.

Proof of Concept:
Attached you will find a proof of concept exploit which will start linux. To install it you have to rename the 2 XBOX font files within the font directory of the dashboard partition and then copy ernie.xtf and bert.xtf into this directory. (If you have an XBOX with an older dashboard the font directory does not exist and you must do the renaming and file adding work in the main directory). Once the new fonts are in place you copy the default.xbe (which is a copy of xbeboot) into the main directory and add your favourite linux to it.
Clicca per allargare...

se volete saperne di piu il link è questo.

L'altro exploit riguarda la fase di copia un cd musicale...

Installation
- ------------
* Use the 007 or Mechassault trick to log onto your XBOX
* Copy the file ST.DB into E:\TDATA\fffe0000\music\
* Copy the file linux.xbe into E:\
* Done!

Usage
- -----
* You can use your XBOX as usual, but don't play too much with the "custom
music playlist" options in games, as the bug is located here.

* When you want to run Linux, just boot the XBOX with an AUDIO CD inserted, and once the CD plays press slowly the following 8 keys : B, Down, A, Right, Right, A, A, A(or go into the "audio cd" menu, choose "copy", then "copy" again and then "new soundtrack", then "ok")
* Linux should be running!
Clicca per allargare...

Chi volesse stendere delle guide sa dove trovarmi...

Ivan · 5 Luglio 2003

Originally posted by Postal
Se qualcuno avesse gia provato e volesse proporre una guida sapete dove contattarmi.

Chi volesse stendere delle guide sa dove trovarmi...
Clicca per allargare...

Ue raga...se volete scrivere delle guide sapete dove contattarlo...
Muazz...scherzi a parte...si aprono nuovi scenari per l'hacking su xbox...se la microsoft avesse prodotto un booter come richiedevano questi gruppi hacker oltre a guadagnarci come simpatia (e pure economicamente) si sarebbe pure evitata sta figuraccia....e meno male che la XBox era a detta loro, a prova di hacker....

Entra o Registrati

BENVENUTO SU CONSOLE TRIBE

Numerose Novità per quanto riguarda l'Hacking Xbox

postal85 Tribe Member

Ivan Administrator