This topic is best reviewed by a panel of Embedded Systems Security Researchers, Red Team Analysts, and Firmware Reverse Engineers.
Abstract
This presentation details a comprehensive security analysis and exploitation chain targeting the Freebox HD, a MIPS-based set-top box released by the French ISP 'Free' in 2006. The researcher’s objective was to bypass DRM-like restrictions on Personal Video Recorder (PVR) data by gaining root access to the device's Linux-based OS.
The exploit chain consists of two primary 0-day vulnerabilities. First, a User-Mode Arbitrary Code Execution (ACE) was achieved via the pre-installed PrBoom (Doom) engine by exploiting a lack of bounds checking in save-file index-to-pointer conversion. Reliability was ensured through heap spraying using large WAD files to facilitate a MIPS-based shellcode execution. Second, a Local Privilege Escalation (LPE) and sandbox escape were performed by targeting a stack-based buffer overflow in the Linux kernel’s HFS+ file system module, triggered via a malicious USB drive.
Post-exploitation analysis revealed the device's security architecture, including encrypted XFS partitions managed via dm-crypt, a restricted Dropbear SSH server, and a private management network. The researcher uncovered evidence of ISP remote-management capabilities (the "chain" RPC interface) and verified that the internal network utilizes specific VLANs and IPSec tunnels for technical support access.
Exploitation and Analysis of the Freebox HD
0:26 Triple Play Legacy: The Freebox HD, released in 2006, was an early pioneer in "Triple Play" services, featuring a dual-box architecture (modem and PVR) running a MIPS-based Linux environment.
2:45 PVR Restrictions: The motivation for the hack arose when the ISP blocked the ability to download recordings from major TV channels via FTP, setting file ownership to root on an encrypted XFS partition.
6:56 Hardware Constraint: Because the hardware is legally owned by the ISP, the researcher opted for a "soft-mod" approach to avoid physical evidence of tampering, such as desoldering the 32MB flash chip.
10:40 Doom as an Entry Point: The pre-installed PrBoom port provided the initial attack surface. Analysis of the source code revealed that the P_UnArchivePlayers function failed to validate the state index, allowing a crafted save file to redirect a pointer to arbitrary memory.
15:24 MIPS Heap Spraying: To achieve reliable ACE, the researcher used 100MB WAD files to fill the MIPS address space (lower 2GB) with a NOP sled and shellcode, overcoming the lack of a memory leak.
20:43 Successful ACE: Verification was achieved through MIPS assembly shellcode that created a visible file on the FTP server, confirming code execution despite the process being trapped in a restricted sandbox/chroot.
25:10 Kernel HFS+ Vulnerability: To gain root, the researcher targeted the Linux kernel's file system drivers. A stack-based buffer overflow was discovered in the hfsplus_readdir function, which lacked length validation when reading catalog nodes.
30:41 Local Privilege Escalation: By plugging in a USB drive with a corrupted HFS+ image, the researcher triggered the kernel overflow. The payload modified the task_struct credentials (UID 0) and enabled all Linux capabilities to escape the sandbox.
34:33 The "42" Mystery: Post-root analysis of /etc/passwd revealed the root password as "42," a nod to the French computer science school and The Hitchhiker's Guide to the Galaxy.
36:42 ISP Network Infrastructure: Exploration revealed that the device communicates over private VLANs (VLAN 100) and uses IPSec. Management access (SSH) is restricted to the 172.16.0.0/12 IP range, intended for ISP developers.
40:34 Remote Support Capabilities: A custom "chain" RPC server was discovered, allowing the ISP to remotely reboot devices, display messages on the front panel, and perform diagnostics.
43:13 Responsible Disclosure: The researcher confirmed that the HFS+ vulnerability was patched in the mainline Linux kernel shortly after discovery and that the ISP has been notified of the findings.