New dev mode privilege escalation exploit published

Discussion in 'Xbox One - Hacking & Homebrew' started by carizard, Jun 12, 2019.

Page 1 of 5
  1. carizard
    OP

    carizard Member

    Newcomer
    2
    21
    Level 2
    Dec 4, 2018
    Antarctica
    @XVMM has published a new privilege escalation exploit on his discord.

    The executables were published in a zip file named system os utilities, along with read me which contains a small tutorial

    this allows you to use the tool XRF to read the contents of nand.

    Readme

    sorry for any mistakes in this post I am quite exhausted.
     

    Attached Files:

    OneForAll, stanleyopar2000, gnmmarechal and 11 others like this.
    #1 Jun 12, 2019
  2. KiiWii

    KiiWii Contributor

    pip Contributor
    18
    9,341
    Level 18
    Nov 17, 2008
    United Kingdom
    Quality :)
     
    #2 Jun 12, 2019
  3. DinohScene

    DinohScene Feed Dino to the Sharks

    Moderator
    23
    GBAtemp Patron
    DinohScene is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    19,400
    Level 23
    Oct 11, 2011
    Antarctica
    Восторг
    Oh nice!
     
    #3 Jun 12, 2019
  4. wiired24

    wiired24 GBAtemp Maniac

    Member
    9
    1,026
    Level 9
    Sep 3, 2013
    United States
    Dev_Home
    Exciting stuff!
     
    #4 Jun 12, 2019
  5. NathanBrown

    NathanBrown Advanced Member

    Newcomer
    4
    91
    Level 4
    Jun 19, 2018
    India
    What will this lead us towards? Possibly backups?
     
    #5 Jun 14, 2019
  6. Seelbreaker

    Seelbreaker GBAtemp Regular

    Member
    4
    188
    Level 4
    Mar 22, 2010
    Gambia, The
    Hmmm so the XBOX One seems to be having something Windows-PE like running?... (i don't have a XBox One and don't have any clue about it).

    Atleast on Windows you can use sc stop, sc start and so on to control services... you can also use "sc query type= service type=" to get all services... Would be interesting to know how Xbox One differs from a current Windows 10 Installation ;-)

    Windows-PCs or the installation media also have an unattend.xml file which is used to predefine Setup-Options and Disk Format Stuff, Region and so on.
    You can actually create your own unattend.xml file - put it into the root of an usb-stick (the one with which you install windows) and start the windows setup without moving a finger after letting it load it up.

    Now i'm wondering, if with those unattend.xml files you can do other stuff if the XBox One has an reinstall feature, because you might be able to call a local cmd from within the setup and get access to the filesystem...

    Now i'm kinda curios and wanna buy an Xbox One myself :P

    Is this exploit working on all versions?
     
    XVMM likes this.
    #6 Jun 14, 2019
  7. leon315

    leon315 POWERLIFTER

    Member
    9
    2,715
    Level 9
    Nov 27, 2013
    Italy
    i think the most interested thing is ''when can we play X1 games for free''??
     
    OneForAll, Ryccardo and NutymcNuty like this.
    #7 Jun 14, 2019
  8. XVMM

    XVMM Advanced Member

    Newcomer
    3
    57
    Level 3
    Sep 9, 2018
    Afghanistan
    United Kingdom
    The tool will support any version past mid-late 2017. It's also not really possible to run the standard windows setup, it's not that simple. It's a very different beast but you can run a standard win32 console app and also, through hooking and all, attach and render standard programs.
    I don't intend to ever enable privacy. And it's not happening soon.
     
    Seelbreaker likes this.
    #8 Jun 14, 2019
  9. leon315

    leon315 POWERLIFTER

    Member
    9
    2,715
    Level 9
    Nov 27, 2013
    Italy
    What? privacy? honostly we don't care what u do under the shower :P
     
    gnmmarechal, Mazamin and NutymcNuty like this.
    #9 Jun 14, 2019
  10. XVMM

    XVMM Advanced Member

    Newcomer
    3
    57
    Level 3
    Sep 9, 2018
    Afghanistan
    United Kingdom
    Woops, completely overlooked it. Meant piracy.
     
    #10 Jun 14, 2019
  11. Carltrek

    Carltrek Newbie

    Newcomer
    1
    4
    Level 1
    Jun 15, 2019
    China
    Seems the Telnet session is not created successfully... both SSH and Telnet cannot connect to the console. Do you need to put *.xboxunattend in an empty USB drive, or any USB drive that Xbox One recognize is okay ?
    Edit: Okay, I made a mistake while putting the file and now SSH is on. But SSH session is asking for a password. What's the default password for this SSH session ? Leaving it empty and press enter doesn't work.
     
    Last edited by Carltrek, Jun 15, 2019
    #11 Jun 15, 2019
  12. Lemmingscanfly

    Lemmingscanfly Member

    Newcomer
    1
    10
    Level 1
    Mar 1, 2018
    Canada
    Mount Olympus
    My most interested thing is, "when can I emulate every other game I already own?"
     
    Vorde and slaphappygamer like this.
    #12 Jun 15, 2019
  13. XVMM

    XVMM Advanced Member

    Newcomer
    3
    57
    Level 3
    Sep 9, 2018
    Afghanistan
    United Kingdom
    The password to DevToolsUser is available in the Windows Device Portal. You can access that through https://xboxone:11443 (replace xboxone with your IP). However, if you've formatted your USB as NTFS and put the script on the root of it then run superfun it'll be fine.
     
    Carltrek likes this.
    #13 Jun 15, 2019
  14. XVMM

    XVMM Advanced Member

    Newcomer
    3
    57
    Level 3
    Sep 9, 2018
    Afghanistan
    United Kingdom
    Additional note: the password for "DevToolsUser" might be the pin from the Visual Studio pin. I can't recall but in Dev Home hit Show Visual Studio Pin and use that for password.
     
    DefaultAccount likes this.
    #14 Jun 15, 2019
  15. Carltrek

    Carltrek Newbie

    Newcomer
    1
    4
    Level 1
    Jun 15, 2019
    China
    Doesn't mean to sound funny here, but after fiddling in the Xbox remote access webpage for a while, I still can't find the DevToolsUser password. I checked Microsoft's help webpage, and they didn't noticed this either. Visual Studio pairing key in Xbox Dev Home is not working.
     
    Last edited by Carltrek, Jun 15, 2019
    #15 Jun 15, 2019
  16. jammybudga777

    jammybudga777 GBAtemp Addict

    Member
    7
    2,010
    Level 7
    Aug 23, 2013
    what benefits are there to this?
     
    #16 Jun 15, 2019
  17. XVMM

    XVMM Advanced Member

    Newcomer
    3
    57
    Level 3
    Sep 9, 2018
    Afghanistan
    United Kingdom
    I'll double check for you. The pairing key should be working.

    — Posts automatically merged - Please don't double post! —

    Running as an elevated user allows the read and write functionality of flash, the ability to interact with pipes/drivers, read/write process memory and more. It's useful for many things if you're interested in digging around. It's been useful for a couple findings.
     
    jammybudga777 likes this.
    #17 Jun 15, 2019
  18. azoreseuropa

    azoreseuropa GBAtemp Guru

    Member
    11
    8,284
    Level 11
    Nov 6, 2002
    United States
    Azores/Portugal
    I will grab XBOX One for the first time if they are running backup games for all FW. :)
     
    #18 Jun 15, 2019
  19. XVMM

    XVMM Advanced Member

    Newcomer
    3
    57
    Level 3
    Sep 9, 2018
    Afghanistan
    United Kingdom
    I just logged in to DevToolsUser using the pairing key. Have you entered it correctly? There's a chance that it may have reset before you entered but I just did it again.
     
    #19 Jun 15, 2019
  20. wakabayashy

    wakabayashy GBAtemp Advanced Fan

    Member
    5
    599
    Level 5
    Dec 25, 2014
    France
    France
    we have to hope that a CFW will be working on ~~
     
    #20 Jun 15, 2019
Page 1 of 5
Loading...
Similar threads with keywords: escalation privilege published Hide similar threads
  1. Drew That Gamer

    [HELP] Local Privilege Escalation on macOS 10.12.3

    Drew That Gamer, Jun 13, 2017, in forum: Computer Software and Operating Systems
    Replies:
    1
    Views:
    526
    Joom
    Jun 14, 2017
  2. soulskeeper

    what's usereland privilege escalation attack?

    soulskeeper, Dec 31, 2015, in forum: 3DS - Flashcards & Custom Firmwares
    Replies:
    4
    Views:
    779
    Kafke
    Dec 31, 2015
  3. Prans

    'League of Legends' comics to be published by Marvel

    Prans, Nov 20, 2018, in forum: GBAtemp & Scene News
    Replies:
    16
    Views:
    2,921
    azoreseuropa
    Nov 22, 2018
  4. Taleweaver

    The escalation of the Israel-Palestine conflict

    Taleweaver, May 16, 2018, in forum: World News, Current Events & Politics
    Replies:
    150
    Views:
    4,231
    Flame
    Jun 3, 2018
  5. cots

    New Sony Warranty Published! (offical email) - You can open your console now!

    cots, May 15, 2018, in forum: PS4 - Console, Accessories and Hardware
    Replies:
    0
    Views:
    992
    cots
    May 15, 2018