Hacking New dev mode privilege escalation exploit published

carizard

carizard

Well-Known Member
OP
Member
Level 7
Joined
Dec 4, 2018
Messages
127
Trophies
0
Age
34
XP
1,193
Country
Antarctica
@XVMM has published a new privilege escalation exploit on his discord.

The executables were published in a zip file named system os utilities, along with read me which contains a small tutorial

this allows you to use the tool XRF to read the contents of nand.

SUPERFUN

Requirement:
- USB
- xboxunattend script

Place a superfun.xboxunattend, or any *.xboxunattend script of your choice, on a USB and plug it into your console.
After you place it onto console, connect over SSH and navigate to where you extracted
the utilities and then run superfun.

Note:
The script provided will start a fun little telnet session.

Enjoy :)

// B

sorry for any mistakes in this post I am quite exhausted.
 

Attachments

  • SystemOS_Utilities.zip
    123.1 KB · Views: 911
  • Like
Reactions: Deleted User, OneForAll, stanleyopar2000 and 12 others
S

Seelbreaker

Well-Known Member
Member
Level 4
Joined
Mar 22, 2010
Messages
199
Trophies
0
XP
495
Country
Gambia, The
Hmmm so the XBOX One seems to be having something Windows-PE like running?... (i don't have a XBox One and don't have any clue about it).

Atleast on Windows you can use sc stop, sc start and so on to control services... you can also use "sc query type= service type=" to get all services... Would be interesting to know how Xbox One differs from a current Windows 10 Installation ;-)

Windows-PCs or the installation media also have an unattend.xml file which is used to predefine Setup-Options and Disk Format Stuff, Region and so on.
You can actually create your own unattend.xml file - put it into the root of an usb-stick (the one with which you install windows) and start the windows setup without moving a finger after letting it load it up.

Now i'm wondering, if with those unattend.xml files you can do other stuff if the XBox One has an reinstall feature, because you might be able to call a local cmd from within the setup and get access to the filesystem...

Now i'm kinda curios and wanna buy an Xbox One myself :P

Is this exploit working on all versions?
 
  • Like
Reactions: Deleted User
D

Deleted User

Guest
Seelbreaker said:
Hmmm so the XBOX One seems to be having something Windows-PE like running?... (i don't have a XBox One and don't have any clue about it).

Atleast on Windows you can use sc stop, sc start and so on to control services... you can also use "sc query type= service type=" to get all services... Would be interesting to know how Xbox One differs from a current Windows 10 Installation ;-)

Windows-PCs or the installation media also have an unattend.xml file which is used to predefine Setup-Options and Disk Format Stuff, Region and so on.
You can actually create your own unattend.xml file - put it into the root of an usb-stick (the one with which you install windows) and start the windows setup without moving a finger after letting it load it up.

Now i'm wondering, if with those unattend.xml files you can do other stuff if the XBox One has an reinstall feature, because you might be able to call a local cmd from within the setup and get access to the filesystem...

Now i'm kinda curios and wanna buy an Xbox One myself :P

Is this exploit working on all versions?
Click to expand...
The tool will support any version past mid-late 2017. It's also not really possible to run the standard windows setup, it's not that simple. It's a very different beast but you can run a standard win32 console app and also, through hooking and all, attach and render standard programs.
leon315 said:
i think the most interested thing is ''when can we play X1 games for free''??
Click to expand...
I don't intend to ever enable privacy. And it's not happening soon.
 
  • Like
Reactions: Seelbreaker
C

Carltrek

Active Member
Newcomer
Level 2
Joined
Jun 15, 2019
Messages
32
Trophies
0
Age
27
XP
202
Country
China
Seems the Telnet session is not created successfully... both SSH and Telnet cannot connect to the console. Do you need to put *.xboxunattend in an empty USB drive, or any USB drive that Xbox One recognize is okay ?
Edit: Okay, I made a mistake while putting the file and now SSH is on. But SSH session is asking for a password. What's the default password for this SSH session ? Leaving it empty and press enter doesn't work.
 
Last edited by Carltrek,
D

Deleted User

Guest
Carltrek said:
Seems the Telnet session is not created successfully... both SSH and Telnet cannot connect to the console. Do you need to put *.xboxunattend in an empty USB drive, or any USB drive that Xbox One recognize is okay ?
Edit: Okay, I made a mistake while putting the file and now SSH is on. But SSH session is asking for a password. What's the default password for this SSH session ? Leaving it empty and press enter doesn't work.
Click to expand...
The password to DevToolsUser is available in the Windows Device Portal. You can access that through https://xboxone:11443 (replace xboxone with your IP). However, if you've formatted your USB as NTFS and put the script on the root of it then run superfun it'll be fine.
 
  • Like
Reactions: Carltrek
D

Deleted User

Guest
Additional note: the password for "DevToolsUser" might be the pin from the Visual Studio pin. I can't recall but in Dev Home hit Show Visual Studio Pin and use that for password.
 
  • Like
Reactions: DefaultAccount
C

Carltrek

Active Member
Newcomer
Level 2
Joined
Jun 15, 2019
Messages
32
Trophies
0
Age
27
XP
202
Country
China
XVMM said:
The password to DevToolsUser is available in the Windows Device Portal.
Click to expand...
Doesn't mean to sound funny here, but after fiddling in the Xbox remote access webpage for a while, I still can't find the DevToolsUser password. I checked Microsoft's help webpage, and they didn't noticed this either. Visual Studio pairing key in Xbox Dev Home is not working.
 
Last edited by Carltrek,
D

Deleted User

Guest
Carltrek said:
Doesn't mean to sound funny here, but after fiddling in the Xbox remote access webpage for a while, I still can't find the DevToolsUser password. I checked Microsoft's help webpage, and they didn't noticed this either. Visual Studio pairing key in Xbox Dev Home is not working.
Click to expand...
I'll double check for you. The pairing key should be working.

--------------------- MERGED ---------------------------

jammybudga777 said:
what benefits are there to this?
Click to expand...
Running as an elevated user allows the read and write functionality of flash, the ability to interact with pipes/drivers, read/write process memory and more. It's useful for many things if you're interested in digging around. It's been useful for a couple findings.
 
  • Like
Reactions: jammybudga777
D

Deleted User

Guest
Carltrek said:
Doesn't mean to sound funny here, but after fiddling in the Xbox remote access webpage for a while, I still can't find the DevToolsUser password. I checked Microsoft's help webpage, and they didn't noticed this either. Visual Studio pairing key in Xbox Dev Home is not working.
Click to expand...
I just logged in to DevToolsUser using the pairing key. Have you entered it correctly? There's a chance that it may have reset before you entered but I just did it again.
 

Site & Scene News

Go to forum More news

Popular threads in this forum

XBOX One S Power On and then Off Q9F2

General chit-chat
Help Users
    I @ idonthave: :)