Hacking Crash WiiU via browser. Exploitable?

[ChrisX930]

btw. I uploaded a Screenshot with all informations about the file and the encoding of the file.

Spoiler

Edit:
Should I upload the Video File so you can download it?
This Video (Anime or whatever) is not licensed in germany (and america as well, i think), so it's not illegal to download/upload it

 

[rumblpak]

btw. I uploaded a Screenshot with all informations about the file and the encoding of the file.

Spoiler

Edit:
Should I upload the Video File so you can download it?
This Video (Anime or whatever) is not licensed in germany (and america as well, i think), so it's not illegal to download/upload it

Wouldn't matter, I was right, the video is out of spec. More than likely you have plex set to play without conversion on mp4 based video (which is the default unless it has changed), and the Wii U doesn't handle the 5.1 profile (spec is to 4.0). That, among other problem areas in here, makes me definitely think it is a video problem. I'll find a video here that I have and try and replicate it.

[edit] Do me a favor and check that its not plex failing to transcode because I've gotten every video (from spec to way out of spec) to play without fault. I think it might be an unhandled plex crash. Obviously if I can't replicate the crash, I can't tell you exactly what it is but I have a feeling about what it probably is.

 

[filfat]

btw. I uploaded a Screenshot with all informations about the file and the encoding of the file.

Spoiler

Edit:
Should I upload the Video File so you can download it?
This Video (Anime or whatever) is not licensed in germany (and america as well, i think), so it's not illegal to download/upload it

If you are 100% sure it isn't licensed go for it
(still haven't been able to replicate it myself: http://wiiu-hb.com/testing.html )

 

[ChrisX930]

After I am home (I'm at school now <_< ) I'll send you a Link to the videofile.
You should try to load it with PLEX then.
If I try to load it directly from browser (IP/video.mkv), It will not be loaded.
I tried to embed the video via html, but I can't play it on this way.
Only If I try to run the Video with PLEX ON WIIU, it'll crash for me.
I tried to load this video with PLEX on PC. The Video is playable on PC.
It only crashes on Wii U

 

[Cyan]

Don't upload the file if it's an anime.
even if it's not licensed in a country doesn't mean it's free to upload. It's licensed in other country (Japan). It's illegal to share it.

You can try to remux to mkv and remove streams.
remove audio, remove subtitles, etc. until you find what is causing the issue.
Create your own video with the same stream specs, it will be legal to share.

 

[ChrisX930]

Don't upload the file if it's an anime.
even if it's not licensed in a country doesn't mean it's free to upload. It's licensed in other country (Japan). It's illegal to share it.

You can try to remux to mkv and remove streams.
remove audio, remove subtitles, etc. until you find what is causing the issue.
Create your own video with the same stream specs, it will be legal to share.

uhhhhh, yea... xD I don't know much about video editing/recreating etc.
I could try to setup PLEX on a second instance on my homeserver so I could give you a link+stream. Streaming this file isn't illegal here in germany (because it isn't licensed in Europe and america.



EDIT: Problem -> Cannot share my PLEX Library with other persons. The problem is: If I give someone outside of my network the IP + Login, he can browse through my PC ^^'

 

[Cyan]

You don't need to upload it, or give any link. it's easy to find, you gave the filename, team name and CRC.
and like I said, it's not because it's not licensed for distribution by a publisher in your country that it's not illegal. if you upload or provide a link, You are providing it for the whole world, even the place where it's licensed.

if someone want to play with the file, he can find it and edit it, don't worry.

 

[ChrisX930]

Okay.
Filename: [RisingSun]_Spice_and_Wolf_-_01_(ger.sub)(720p)[7B9219C3].mkv
Good Look to find a Downloadlink

Open it with PLEX on your Wii U, it'll crash.

 

[Katsumi San]

Okay.
Filename: [RisingSun]_Spice_and_Wolf_-_01_(ger.sub)(720p)[7B9219C3].mkv
Good Look to find a Downloadlink

Open it with PLEX on your Wii U, it'll crash.

I will analyze such file. Perhaps the encode was not done partially right. I got experience in this since in fansub world I do the encode/TL/karaoke thing.

 

[ChrisX930]

Okay, let's see what we get out of this.
If you want you can try to run it on PLEX on Wii U, too to replicate the exploit.

 

[Katsumi San]

When I arrive home from part time I will download this plex thing.

 

[Blayd]

Downloaded the file, tried to play it with Plex and my WiiU froze. I'm also on firmware 5.1.2E.

 

[ChrisX930]

Downloaded the file, tried to play it with Plex and my WiiU froze. I'm also on firmware 5.1.2E.

This is what happen all time with my console

 

[Thirty3Three]

So how does one go about downloading in IRC?

 

[rumblpak]

What version of plex are you using so that I can match versions to test?

[Update] Downloaded that exact file and Wii U reports it can't play the file. After multiple attempts, and after force-closing the transcoder, I can produce the error. I checked the file with mkvinfo and it reports multiple errors with the file. In other words, its a badly encoded video. I used handbrake to quickly re-encode it and it worked fine. However, the crash is a combination of things, plex cant properly read the file, so it sends a javascript update to close the video, which, and this is where the Wii U crashes, it doesn't comply. On newer versions of plex (I actually paid for it), it will properly close the video. However, by playing it multiple times repeatedly, you can bypass the prompt. I'm not sure of the extent of this yet but it looks like weird handling of UTF8. Someone who knows more than myself about webkit bugs may want to look into it more. However, I'm an engineer, not a cs guy, so I'll go back to my assembly and hardware.

 

[ChrisX930]

and, any news about it?

 

[MopSec]

Well if it's the javascript that makes the Wii U crash, as rumblpak said, this could become pretty interesting

 

[ChrisX930]

yep, that's true. Let's see what some guys can do with it.

 

[yuyuyup]

definitely blocking router updates on 5.1.2 (yeah, I screwed the pooch but hey maybe this will be something)

 

[Thirty3Three]

Can confirm it crashes 5.1.2U.
When you hit home, you get a white screen like he had. Then, if you leave it on said screen without doing anything, the screen will eventually turn black, but the wii u will still be on (and crashed). There may be something to this, after all!