Hacking Possible Switch Arbitrary R/W Through Web Browser

[linuxares]

I have doubts that'd work, without escalation especially, but I will try on my switch later
Also you mean this? https://www.exploit-db.com/exploits/48644

Aye that one

Also one for 7.55 that might work as well.

 

[WiiMiiSwitch]

How did I miss this thread?

 

[The Real Jdbye]

@zurgeg since you wrote this in February. There been a couple of improvements for a new exploit on the PS4, that exploits the FreeBSD kernel/network part. Guess what the Switch uses?

Not FreeBSD. It's based on the 3DS kernel.

 

[linuxares]

Not FreeBSD. It's based on the 3DS kernel.

The network parts are FreeBSD however. So it's worth to investigate if he wish.

 

[CompSciOrBust]

The network parts are FreeBSD however. So it's worth to investigate if he wish.

I'm pretty sure all the FreeBSD sockets stuff is in the nifm system module. Since the Switch sys modules run in userland exploiting the freebsd code wouldn't be too helpful. You would have access to more syscalls but since there's no kernel bugs that isn't helpful. What you could do is take over each system module individually but that would mean finding a bug in each one and exploiting them all successfully, once you do that all you would have is a 3.0.0 rohan style homebrew environment which will be patched in the next system update.

 

[SciresM]

The network parts are FreeBSD however. So it's worth to investigate if he wish.

1) The switch kernel has no network parts
2) The vast majority of network code is custom Nintendo, not FreeBSD.

FreeBSD sockets code is used in userland, but it's a minimal part of it and not really a good attack surface. Most exploits in the PlayStation scene have targeted the Berkeley packet filter which doesn't exist on switch.

Also even if you hack bsdsockets sysmodule it doesn't do anything for you -- it has almost no interesting privileges.

 

[linuxares]

1) The switch kernel has no network parts
2) The vast majority of network code is custom Nintendo, not FreeBSD.

FreeBSD sockets code is used in userland, but it's a minimal part of it and not really a good attack surface. Most exploits in the PlayStation scene have targeted the Berkeley packet filter which doesn't exist on switch.

Also even if you hack bsdsockets sysmodule it doesn't do anything for you -- it has almost no interesting privileges.

Aight, it was just a suggestion for him to check on. But you definitely know a lot more about this than I.

 

[Draxzelex]

How did I miss this thread?

Because it never amounted to anything.