Hacking RELEASE File Explorer - Symbolic links vulnerability

carizard

carizard

Well-Known Member
OP
Member
Level 7
Joined
Dec 4, 2018
Messages
127
Trophies
0
Age
34
XP
1,193
Country
Antarctica
Release date: 02.06.2017
Author: xenomega
Classification: File Access
Patched: yes
Patch date: 05.05.2017
First patched: system version 10.0.15063.2022 (RS2_RELEASE_XBOX_1704.170501-1052)
Source: https://github.com/Xenomega/xsymlink
Download: Download

Info
Access restricted/encrypted volumes using the Xbox File Explorer.

  • Patched as of 5/5/2017: 10.0.15063.2022 (RS2_RELEASE_XBOX_1704.170501-1052). Thus in accordance with responsible disclosure.
  • The Xbox One File Explorer does not check if a path is a symbolic link elsewhere, allowing an attacker to browse/read/write to mounted volumes which are normally restricted.
  • This includes any encrypted virtual harddisk partitions (XVD files) which the console mounts for content such as gamesaves, etc.
Prerequisites
  • Download Windows Server 2003 Resource Kit Tools, from which you'll need the "linkd" utility, as the program relies on it to create links, since mklink does not link to paths that do not exists, and the paths we intend to link to are likely non-existent on your computer.
Instructions
  • Change the drive letter to your USB drive letter in Program.cs
  • Run it
  • Plug it into Xbox, use File Browser to browse through the symlinks, which will link to other parts of the system.
 
  • Like
Reactions: TheMasterPlan

Site & Scene News

Go to forum More news

Popular threads in this forum

XBOX One S Power On and then Off Q9F2

Xbox one fat original - help HDD replacement

General chit-chat
Help Users
  • K3Nv2 @ K3Nv2:
    https://slickdeals.net/f/17475219-1...e&prop=rcmid-639651d2669be150216d5d26acbce148
  • BigOnYa @ BigOnYa:
    Damn that's cheap.
  • K3Nv2 @ K3Nv2:
    Slower speeds for gen4
  • K3Nv2 @ K3Nv2:
    I'll reformat and have a 3tb raid0 m. 2 at least
     +1
  • K3Nv2 @ K3Nv2:
    Lmao that sold out fast
     +1
  • Veho @ Veho:
    https://i.imgur.com/h0w1HLp.mp4
     +1
  • Veho @ Veho:
    Yeet the cat.
     +1
  • K3Nv2 @ K3Nv2:
    Good idea
     +1
  • K3Nv2 @ K3Nv2:
    https://youtu.be/9kE3Env_2AY?si=Bs6lUZ0ZIlqmYaGT
     +1
  • Psionic Roshambo @ Psionic Roshambo:
    https://youtu.be/TECN1Gm7j3A?si=XwYKYHKwxoMNdFqN
  • Veho @ Veho:
    https://i.imgur.com/7bH4YgV.mp4
  • The Real Jdbye @ The Real Jdbye:
    i thought everybody knew cocktails are like 75% ice
  • Veho @ Veho:
    Yeah but not like this.
  • Veho @ Veho:
    It's not like they're complaining that their Slurpee is 99% ice or something, but if the cocktail calls for "shot of vodka, shot of vermouth, shot of gin, shot of Campari, three shots of juice, squirt of lemon" and ends up being a thimbleful of booze, that's a problem.
  • The Real Jdbye @ The Real Jdbye:
    the funny thing is cocktails in norway are only allowed to have 1 20ml shot of booze
  • The Real Jdbye @ The Real Jdbye:
    so..... yeah
  • The Real Jdbye @ The Real Jdbye:
    we're used to only having a thimbleful of booze
  • Veho @ Veho:
    Booo.
  • The Real Jdbye @ The Real Jdbye:
    same thing if you want whisky on the rocks or something, you can't get a double
  • The Real Jdbye @ The Real Jdbye:
    but you could buy as many shots of whisky (or anything else) as you want and ask for a glass of ice and pour them in
  • The Real Jdbye @ The Real Jdbye:
    it's dumb
  • Veho @ Veho:
    Maybe.
  • Veho @ Veho:
    There was a comparison of the number of Ibuprofen poisonings before and after they limited the maximum dosage per box or per pill (i'll look that up). No limit on the number of boxes you can still buy as many as you want, so people argued it was pointless.
  • Veho @ Veho:
    But the number of (accidental) poisonings dropped because drinking an entire package of ibuprofen pills went from "I need a new liver" to "I need a new box of Ibuprofen".
  • Veho @ Veho:
    Here we have ketoprofen that used to be prescription-only because of the risk of toxic dosages, but then they halved the dose per pill and sell them in bottles of six pills apiece instead of twenty and it doesn't need a prescription any more. Yes you can buy more than one bottle but people simply don't.
    Veho @ Veho: Here we have ketoprofen that used to be prescription-only because of the risk of toxic dosages...