Hacking CVE-2016-4657 walk-through and intro to browser exploitation

[Deleted User]

not by me
thanks to LiveOverflow on twitter



https://github.com/LiveOverflow/lo_nintendoswitch/blob/master/poc1.html

 

[iAqua]

well that was fast .

 

[rensenware]

damn, can't wait for userland. Wanna play dem emulators.

 

[AecdArmy]

damn, can't wait for userland. Wanna play dem emulators.

Give it a bit we need a DEP Bypass first

 

[rensenware]

Give it a bit we need a DEP Bypass first

Yep, but it's still great to see progress so quickly.

--------------------- MERGED ---------------------------

not by me
thanks to LiveOverflow on twitter



https://github.com/LiveOverflow/lo_nintendoswitch/blob/master/poc1.html

At this rate, the switch will be hacked before we get sighax.

 

[studio1b]

keep it up great news

 

[TheCyberQuake]

Remember to keep in mind that they still have to develop a format for homebrew as well, along with tools to develop the homebrew (or sdk leaks). Kinda like how the 3ds has it's .3dsx format

 

[Deleted User]

I have taken the liberty of recording this webpage in action in case anyone is curious as to what it does currently without sitting through an 18 minute video

 

[AecdArmy]

I have taken the liberty of recording this webpage in action in case anyone is curious as to what it does currently without sitting through an 18 minute video

Its kinda weird last night I finished the whole thing saying the switch will now crash now I get up to that part only then it crashes...

 

[Deleted User]

Its kinda weird last night I finished the whole thing saying the switch will now crash now I get up to that part only then it crashes...

It depends on how the script runs I assume since it doesnt even have a 100% success rate. I noticed it should have said that for me as well.

 

[Hillary_Clinton]

always crashes before the end for me

 

[Deleted User]

always crashes before the end for me

It's supposed too

 

[Hillary_Clinton]

It's supposed too

What I mean is, it doesn't get to the part where it's supposed to alert "smash.length is now: 0x1337"

It should get there before crashing.

 

[Deleted User]

What I mean is, it doesn't get to the part where it's supposed to alert "smash.length is now: 0x1337"

It should get there before crashing.

You installed/set it up wrong. If you want to test a working version set your DNS to go too http://dnswitch.redthetrainer.com/

Once there click "tap to test webkit"

 

[Hillary_Clinton]

You installed/set it up wrong. If you want to test a working version set your DNS to go too http://dnswitch.redthetrainer.com/

Once there click "tap to test webkit"

Still crashes after the first two alerts. Is it working any better for you?

 

[Deleted User]

Still crashes after the first two alerts. Is it working any better for you?

Like I said. Its supposed to crash. You can see so in my video above as well.

 

[Hillary_Clinton]

Like I said. Its supposed to crash. You can see so in my video above as well.

But it's not supposed to crash; if you watch the first video, he gets all the way through. What I think you're saying is: this is expected behavior since it's just a really touchy exploit?

Edit: It sometimes makes it to the "misaligned" alert.

 

[Deleted User]

But it's not supposed to crash; if you watch the first video, he gets all the way through. What I think you're saying is: this is expected behavior since it's just a really unreliable exploit?

The same exact thing happens in the video he crashes. You're crashing because it doesn't do anything yet and is just a POC. You won't be pirating games or using homebrew with this right now. This "exploit" won't do anything other then crash your system

 

[Hillary_Clinton]

The same exact thing happens in the video he crashes. You're crashing because it doesn't do anything yet and is just a POC. You won't be pirating games or using homebrew with this right now. This "exploit" won't do anything other then crash your system

Yes, it's a proof of concept, but a critical part of the proof is seeing that the length changed, and I'm not reaching that alert. So this makes me curious exactly what his setup was, if he was reliably having success.

Edit: Okay, now if I set up my server with his exact files freshly unzipped from his github master (not just poc1.html but also his index.html which redirects to it), then I am able to get to the end of the PoC reliably.

 

[gudenau]

New to find gadgets and such. ^^

Edit:
Got to love use after free exploits. So fun.