Usb control msg(0xA1, 1) Exploit - Revision history

Spydar007 at 09:29, 26 March 2017

2017-03-26T09:29:40Z

2015-10-11T10:39:13Z

Updating

2013-08-19T01:46:13Z

Undo revision 34171 by 5urd (talk) only interesting thing is the buffer... that's already here

2013-08-19T01:45:44Z

2012-10-26T12:33:24Z

not working on non-ipt2g

2012-03-12T19:59:01Z

2012-03-11T15:14:15Z

2012-03-11T15:13:05Z

fix links

2012-02-08T18:37:15Z

‎Credit (Alphabetical): fixed links

2012-02-08T17:51:32Z

@@ Line 1: / Line 1: @@
 {{DISPLAYTITLE:usb_control_msg(0xA1, 1) Exploit}}
-A heap overflow exists in the [[N72AP|iPod touch 2G]] (both [[Bootrom 240.4|old]] and [[Bootrom 240.5.1|new]] [[bootrom]]s) [[DFU Mode]] when sending a USB control message of request type 0xA1, request 0x1. This exploit is also referred to as the "steaks4uce" exploit.
+A heap overflow exists in the [[N72AP|iPod touch (2nd generation)]] (both [[Bootrom 240.4|old]] and [[Bootrom 240.5.1|new]] [[bootrom]]s) [[DFU Mode]] when sending a USB control message of request type 0xA1, request 0x1. This exploit is also referred to as the "steaks4uce" exploit.
 On newer devices, the same USB message triggers a double free() when the image upload is marked as finished, also rebooting the device (but that's not exploitable because the double free() happens in a row). [[User:posixninja|posixninja]] analyzed and explained this one.
@@ Line 12: / Line 12: @@
 == Vulnerability ==
-By fuzzing all possible USB control messages of the [[N72AP|iPod touch 2G]]'s [[DFU Mode]], it appeared that one special usb control message made it reboot.
+By fuzzing all possible USB control messages of the [[N72AP|iPod touch (2nd generation)]]'s [[DFU Mode]], it appeared that one special usb control message made it reboot.
 The reboot happens only with lengths bigger than 0x100 bytes. It's a buffer overflow.

@@ Line 1: / Line 1: @@
 {{DISPLAYTITLE:usb_control_msg(0xA1, 1) Exploit}}
-A heap overflow exists in the [[N72ap|iPod touch 2G]] (both [[Bootrom 240.4|old]] and [[Bootrom 240.5.1|new]] [[bootrom]]s) [[DFU Mode]] when sending a USB control message of request type 0xA1, request 0x1. This exploit is also referred to as the "steaks4uce" exploit.
+A heap overflow exists in the [[N72AP|iPod touch 2G]] (both [[Bootrom 240.4|old]] and [[Bootrom 240.5.1|new]] [[bootrom]]s) [[DFU Mode]] when sending a USB control message of request type 0xA1, request 0x1. This exploit is also referred to as the "steaks4uce" exploit.
 On newer devices, the same USB message triggers a double free() when the image upload is marked as finished, also rebooting the device (but that's not exploitable because the double free() happens in a row). [[User:posixninja|posixninja]] analyzed and explained this one.
@@ Line 12: / Line 12: @@
 == Vulnerability ==
-By fuzzing all possible USB control messages of the [[N72ap|iPod touch 2G]]'s [[DFU Mode]], it appeared that one special usb control message made it reboot.
+By fuzzing all possible USB control messages of the [[N72AP|iPod touch 2G]]'s [[DFU Mode]], it appeared that one special usb control message made it reboot.
 The reboot happens only with lengths bigger than 0x100 bytes. It's a buffer overflow.

@@ Line 45: / Line 45: @@
 Note: FD[0xc] will also be overwritten by BK (because of the free() unlink code), the first instruction of the shellcode
 shall jump to FD[0x10] to skip the junk.
 [[Category:Exploits]]

@@ Line 45: / Line 45: @@
 Note: FD[0xc] will also be overwritten by BK (because of the free() unlink code), the first instruction of the shellcode
 shall jump to FD[0x10] to skip the junk.
 [[Category:Exploits]]

@@ Line 1: / Line 1: @@
 {{DISPLAYTITLE:usb_control_msg(0xA1, 1) Exploit}}
-A heap overflow exists in the [[N72ap|iPod touch 2G]] (both [[Bootrom 240.4|old]] and [[Bootrom 240.5.1|new]]) [[bootrom]]s) [[DFU Mode]] when sending a USB control message of request type 0xA1, request 0x1. This exploit is also referred to as the "steaks4uce" exploit.
+A heap overflow exists in the [[N72ap|iPod touch 2G]] (both [[Bootrom 240.4|old]] and [[Bootrom 240.5.1|new]] [[bootrom]]s) [[DFU Mode]] when sending a USB control message of request type 0xA1, request 0x1. This exploit is also referred to as the "steaks4uce" exploit.
 On newer devices, the same USB message triggers a double free() when the image upload is marked as finished, also rebooting the device (but that's not exploitable because the double free() happens in a row). [[User:posixninja|posixninja]] analyzed and explained this one.
 == Credit (Alphabetical) ==

@@ Line 7: / Line 7: @@
 * '''vulnerability''': [[User:pod2g|pod2g]]
 * '''exploitation''': [[User:pod2g|pod2g]]
-* '''payload''':  [[Greenpois0n (jailbreak)|Greenpois0n]]: both the old [[iBoot-240.4]] (In conjuction with the [[0x24000 Segment Overflow]]) and [[iBoot-240.5.1]] (In conjuction with a kernel [[:Category:Exploits|exploit]], such as [[BPF_STX Kernel Write Exploit]] or [[HFS Legacy Volume Name Stack Buffer Overflow]])
+* '''payload''':  [[Greenpois0n (jailbreak)|Greenpois0n]]: both the old [[Bootrom 240.4]] (In conjuction with the [[0x24000 Segment Overflow]]) and [[Bootrom 240.5.1]] (In conjuction with a kernel [[:Category:Exploits|exploit]], such as [[BPF_STX Kernel Write Exploit]] or [[HFS Legacy Volume Name Stack Buffer Overflow]])
 == Vulnerability ==