(Legacy) USB Vulnerability on Google Nest Hub - Revision history

NKirnbauer: link that doesnt exist

2024-11-10T19:12:26Z

link that doesnt exist

← Older revision		Revision as of 19:12, 10 November 2024
Line 445:		Line 445:
	== Courses ==		== Courses ==

	* ~~[[WFP2]]~~ (2023)		* WFP-2 (2023)

	== References ==		== References ==

Ikramer at 17:29, 12 March 2024

2024-03-12T17:29:36Z

← Older revision		Revision as of 17:29, 12 March 2024
Line 459:		Line 459:

	[[Category:Documentation]]		[[Category:Documentation]]
			[[Category:Pentesting]]

PKraubner: added precise explaination of the bootloader bug exploit

2024-02-13T14:36:30Z

added precise explaination of the bootloader bug exploit

Show changes

PKraubner at 15:26, 27 January 2024

2024-01-27T15:26:30Z

← Older revision		Revision as of 15:26, 27 January 2024
Line 23:		Line 23:
	=== Step 1 ===		=== Step 1 ===

	Flash an USB stick with Ubuntu 22.04, if you haven't done earlier.		Flash an USB stick with Ubuntu 22.04, if you haven't done earlier. You can use Rufus or Etcher for this task.

	[[File:01_rufus_for_bootUSB.jpeg\|500px\|thumb\|right\|rufusflash]]		[[File:01_rufus_for_bootUSB.jpeg\|500px\|thumb\|right\|rufusflash]]

	~~echo foo~~
	~~echo bar~~

	=== Step 2 ===		=== Step 2 ===

PKraubner: refactoring, but doesn't look too good

2024-01-27T15:25:44Z

refactoring, but doesn't look too good

← Older revision		Revision as of 15:25, 27 January 2024
Line 51:		Line 51:
	1. Install dependencies		1. Install dependencies
	Update the system:		Update the system:
	sudo apt-get update		sudo apt-get update

	Install dependencies:		Install dependencies:
	sudo apt install git		sudo apt install git
	sudo apt install openocd		sudo apt install openocd
	sudo apt install gcc-multilib		sudo apt install gcc-multilib
	sudo apt install build-essential		sudo apt install build-essential
	sudo apt install python3-serial		sudo apt install python3-serial
	sudo apt install libudev-dev		sudo apt install libudev-dev
	sudo apt install cmake gcc-arm-none-eabi libnewlib-arm-none-eabi build-essential		sudo apt install cmake gcc-arm-none-eabi libnewlib-arm-none-eabi build-essential
	sudo apt install libstdc++-arm-none-eabi-newlib		sudo apt install libstdc++-arm-none-eabi-newlib

	Create workspace, current location /home/		Create workspace, current location /home/
	mkdir pico		mkdir pico
	cd pico		cd pico

	Clone pico-sdk and update it, current location /home/pico/		Clone pico-sdk and update it, current location /home/pico/
	git clone https://github.com/raspberrypi/pico-sdk.git --branch master		git clone https://github.com/raspberrypi/pico-sdk.git --branch master
	cd pico-sdk		cd pico-sdk
	git submodule update --init		git submodule update --init

	In the Pico folder we do clone our chipicopwn, current location /home/pico/		In the Pico folder we do clone our chipicopwn, current location /home/pico/

	sudo git clone https://github.com/frederic/chipicopwn chipicopwn		sudo git clone https://github.com/frederic/chipicopwn chipicopwn
			cd chipicopwn
	cd chipicopwn

	Now we need the commands from the repository:		Now we need the commands from the repository:
	Set the Path to wherever you saved your pico-sdk repository		Set the Path to wherever you saved your pico-sdk repository
	export PICO_SDK_PATH=/home/user/pico/pico-sdk/		export PICO_SDK_PATH=/home/user/pico/pico-sdk/

	!! If you have this in the home directory do not use relative paths, since this command is executed as root!		!! If you have this in the home directory do not use relative paths, since this command is executed as root!
Line 87:		Line 86:
	It may be that a build folder already exists. It is recommended to delete it and make a new one, since some files may or may not work / flash as intended.		It may be that a build folder already exists. It is recommended to delete it and make a new one, since some files may or may not work / flash as intended.

	mkdir build		mkdir build
	cd build		cd build
	sudo cmake ..		sudo cmake ..
	sudo make		sudo make

PKraubner at 15:23, 27 January 2024

2024-01-27T15:23:24Z

← Older revision		Revision as of 15:23, 27 January 2024
Line 101:		Line 101:


	=== Step 4 ===		=== Step 5 ===

	Remove the lid underneath the Nest Hub base to expose USB port		Remove the lid underneath the Nest Hub base to expose USB port
	Connect the Raspberry Pico to Nest Hub (through powered-hub or Y-cable because the USB port does not provide power)		Connect the Raspberry Pico to Nest Hub (through powered-hub or Y-cable because the USB port does not provide power)
			[[File:HardwareCabled.png\|500px\|thumb\|right\|Verkabelte Hardware]]
	Hold Volume Down + Volume Up + Mute buttons while powering on the Nest Hub		Hold Volume Down + Volume Up + Mute buttons while powering on the Nest Hub
	Once CHIPICOPWN logo appears on screen, replace the Raspberry Pico with USB flash drive		Once CHIPICOPWN logo appears on screen, replace the Raspberry Pico with USB flash drive
Line 110:		Line 111:
	Now you can install Ubuntu on your Google Nest.		Now you can install Ubuntu on your Google Nest.

			=== Result ===
			[[File:Demonstration.png\|500px\|thumb\|Demonstration]]

	== Used Hardware ==		== Used Hardware ==

PKraubner at 15:15, 27 January 2024

2024-01-27T15:15:58Z

← Older revision		Revision as of 15:15, 27 January 2024
Line 11:		Line 11:
	== Requirements ==		== Requirements ==

	* 1x Google Nest Hub, 2nd Generation		* 1x Google Nest Hub, 2nd Generation --> [[Nest_Hub_2nd_Generation]]
	* 1x Raspberry Pi Pico		* 1x Raspberry Pi Pico
	* 1x Powered Micro-USB Hub (NestUSB does not provide power)		* 1x Powered Micro-USB Hub (NestUSB does not provide power)

PKraubner: v1.0, work in progress

2024-01-27T15:15:01Z

v1.0, work in progress

New page

== Disclaimer ==

Article in progress, this is not the final version.
This tutorial has been patched by Google in December 2021 via OTA-update, now the booting sequence of the Recovery Mode does not work as intended for this exploit to work.

== Summary ==

We want to change the OS of a Google Nest Hub 2. Generation by exploiting a vulnerability in the bootloader u-boot.

== Requirements ==

* 1x Google Nest Hub, 2nd Generation
* 1x Raspberry Pi Pico
* 1x Powered Micro-USB Hub (NestUSB does not provide power)
* 2x Micro-USB cables
* 1x UART to USB
* 1x bootable USB Stick with Ubuntu 22.04 and the files from https://github.com/frederic/elaine-bootimg (Elaine bootimg gives privilege to use the Nest touchscreen for the Linux OS)

== Description ==

=== Step 1 ===

Flash an USB stick with Ubuntu 22.04, if you haven't done earlier.

[[File:01_rufus_for_bootUSB.jpeg|500px|thumb|right|rufusflash]]

echo foo
echo bar

=== Step 2 ===

In order to be compatible with the touchscreen of the nest, we need to adjust some files in partition system boot.

Copy the following files from the repository https://github.com/frederic/elaine-bootimg in partition system-boot :
* u-boot-elaine.bin : U-Boot image for elaine
* u-boot-elaine.cmd : U-Boot environment file
* boot.img : Boot image (Kernel for elaine, DTB, initrd)

=== Step 3 ===

The exploit is made possible because there is a stack overflow within the bootloader u-Boot, which happens with block sizes greater than 512 bytes. Most USB-Sticks only support 512 Bytes. The solution is taking a suitable microcontroller, in our case a Raspberry Pico, which is equipped with TinyUSB, which provides a Mass Storage device example code that can turn a Raspberry Pi Pico into a customizable USB flash drive.
This Pico will be used to inject arbitrary payload into the stack memory and overwrite return address to execute the payload.
However, the storage of the pico is very limited, hence we will have to hotswap the pico with our USB Stick, which contains all neccessary data to install the OS.

=== Step 4 ===

For the Pico we will have to prepare the following:

1. Install dependencies
Update the system:
sudo apt-get update

Install dependencies:
sudo apt install git
sudo apt install openocd
sudo apt install gcc-multilib
sudo apt install build-essential
sudo apt install python3-serial
sudo apt install libudev-dev
sudo apt install cmake gcc-arm-none-eabi libnewlib-arm-none-eabi build-essential
sudo apt install libstdc++-arm-none-eabi-newlib

Create workspace, current location /home/
mkdir pico
cd pico

Clone pico-sdk and update it, current location /home/pico/
git clone https://github.com/raspberrypi/pico-sdk.git --branch master
cd pico-sdk
git submodule update --init

In the Pico folder we do clone our chipicopwn, current location /home/pico/

sudo git clone https://github.com/frederic/chipicopwn chipicopwn

cd chipicopwn

Now we need the commands from the repository:
Set the Path to wherever you saved your pico-sdk repository
export PICO_SDK_PATH=/home/user/pico/pico-sdk/

!! If you have this in the home directory do not use relative paths, since this command is executed as root!

Flashing the program, current location /home/pico/chipicopwn
It may be that a build folder already exists. It is recommended to delete it and make a new one, since some files may or may not work / flash as intended.

mkdir build
cd build
sudo cmake ..
sudo make

Now the project should be built.
Now we need to boot the Pico in bootloader mode (by holding down the BOOTSEL button) and get the chipicopwn.uf2 on the pico device itself by copying it.

Now we should have two hardware components prepared:

The USB Stick with the Ubuntu Image optimized for touchscreen and the Raspberry Pico with the modified bootloader.

=== Step 4 ===

Remove the lid underneath the Nest Hub base to expose USB port
Connect the Raspberry Pico to Nest Hub (through powered-hub or Y-cable because the USB port does not provide power)
Hold Volume Down + Volume Up + Mute buttons while powering on the Nest Hub
Once CHIPICOPWN logo appears on screen, replace the Raspberry Pico with USB flash drive

Now you can install Ubuntu on your Google Nest.

== Used Hardware ==

[[Nest_Hub_2nd_Generation]]
[[Raspberry Pi Pico]]
[[Powered Micro-USB Hub]]
[[Micro-USB cable]]
optional for log insight: [[UART to USB Adapter]]

== Courses ==

* [[WFP2]] (2023)

== References ==

* https://fredericb.info/2022/06/breaking-secure-boot-on-google-nest-hub-2nd-gen-to-run-ubuntu.html
* https://github.com/frederic/chipicopwn
* https://github.com/frederic/elaine-bootimg

[[Category:Documentation]]