Post by: Pr0crastin8r on November 17, 2002, 01:07:00 AM
keep up the good work... you and opjose make a nice team 
Post by: Zander on November 17, 2002, 07:19:00 AM
I KNOW some ppl in here have ethereal, and know how to use it.
You can find me on efnet running around. I'd like to discuss the results.
Z
Post by: MagamiAKO on November 17, 2002, 08:18:00 AM
Unfortunately Zander and I are in the same position, though he knows just a tad more Kerberos than I do......neither of us can decrypt the data. Though when I tried to sniff my xbox through double NAT, it returned KB5DC_ERROR or something like that...We assumed it was more than likely the fact that it was travelling like this:
xbox > my pc > gateway pc > internet
LOL.....the things thhat I find that work are amusing. Though it did work, packets did get to and from as.xboxlive.com, just had return packets of kerberos errors.
Post by: pvwr on November 17, 2002, 11:16:00 AM
.
Post by: Zander on November 17, 2002, 11:54:00 AM
But in a FAILED Xbox... they like bornounce said in his new thread, the "broken" boxes try to multicast out to XBL, which isn't going to work on lik 99% of networks out there.
Any ideas on how to capture the 4 kerberos packet inboudn adn changing the site0 to site1? I'm trying to come up with a way to do that now...
I REALLY want to know what would happen if a site1 response was issued to a broken xbox. Is it possible this code could determine the way the xbox would determine the method of connection to use somehow? This is theory, no real basis, don't take it for fact at all.
site1 = attempt conventional UDP connection over 3074?
site0 = come at me with mutlicasts?
no idea.
I'm reading up on kerberos to come up with SOMETHING. I just hope it's not some custom MS thing.
Z
Post by: pvwr on November 17, 2002, 12:01:00 PM
.
Post by: Zander on November 17, 2002, 12:05:00 PM
You can find me on efnet though, I can look at the packet for you.
Please note - Your serial is in the packet, if you don't want me to be able to read your serial, don't give out your ethereal capture. Note also though, I have had 3 ppl give me their serials and captures, I will not use them no give them out. It's up to you.
Z
Post by: pvwr on November 17, 2002, 12:14:00 PM
Post by: Zander on November 17, 2002, 12:22:00 PM
Broken xboxes have = site0
working xboxes have = site1
I'd like to verify this with ppls sniffs. They can just post their results, if they know how to read the packet sniff, if not, then someone else should analyze it for them and post results here.
I have tested about 5 xboxes and their sniffs thus far, I'd really like to know what more WORKING xboxes see.
Z
Post by: pvwr on November 17, 2002, 12:31:00 PM
| QUOTE |
Kerberos Version: 5 MSG Type: TGS-REP Pre-Authentication Type: Unknown preauth type Oxca Value: 30820108a003020117a103020101a281.... Realm: PASSPORT.NET Client Name: SN.(my serial)@xbox.com Type: Service and Instance Name: SN.(SERIALNUMBER)@xbox.com Name: PASSPORT.NET Ticket Version: 5 Realm: XBOX.COM Service Name: sg Type: Service and Instance Name: sg Name: site1 Encrypted Data: Ticket data Type: rc4-hmac KVNO: 1 Ciphertext: .... Encrypted Data: Encrypted Payload Type: rc4-hmac CipherText: ... |
Yeah, I kinda copied your template, but well, there goes the information anyway.
My XBox is modded with a homebrew chip, no switch so far. I have Evox on HD (evoxdash.xbe bios), linking to MS dah. I updated the dash with Whacked sometime ago and tested it just to see if my connection would work with Live and it did, as it does now (dashboard test).
Of course, as I have not updated the dash after that, I'm not on a ban list whatsover, and I don't even have an account. I guess if I just add the switch I will be fine, but I just don't know for how long
. The safest bet is to get a brand new one, but I'll sure miss DiVX viewing on the XBox, which rocks 
.
Post by: NetJunkie on November 17, 2002, 12:43:00 PM
So, SOMETHING has changed in the last 48 hours. Maybe MS is working on the issue.
Post by: Zander on November 18, 2002, 07:33:00 AM
I would LOVE to see what sending the xbox a "site1" would do, but it's beyond my ability to intercept the communication from TGS.XBOXLIVE.COM change the ONE byte, and forward it to the xbox.
CAN ANYONE DO THIS??? I would love to see what would happen if a non-working xbox got a "site1" packet from TGS.XBOXLIVE.COM
I'm not a programmer though, I can't write a redirector like this.
Help? burnonce? Opjose? anyone?
Z
Post by: NetJunkie on November 18, 2002, 08:44:00 AM
Post by: ArMaGeDdOn on November 18, 2002, 09:14:00 AM
instead of getting the right signal to GET to the xbox, why don't you have the xbox itself interpret both signals as the same? that way it will be local. MS will NOT be able to detect it, and if your theories are correct, you will be able to get online with XBL. To do this you would have to decompile, edit, and recompile XBL and possibly its updates.
Uhmm....that's all I can think of. It will be easier to do, especially if it is successful and others want to do it. Great job guys. Hoping you and opjose can figure something out. You guys are MY biggest hope.
Post by: ArMaGeDdOn on November 18, 2002, 09:30:00 AM
Post by: ArMaGeDdOn on November 18, 2002, 09:41:00 AM
Post by: Zander on November 18, 2002, 10:29:00 AM
I'm not a coder, just a network engineer.
Z
Post by: Sev on November 18, 2002, 12:54:00 PM
The LocalCachexx.bin files have information in them, including a 'site' value. It says 'site1' in there for me, though I can't connect.
It may be easier to work these out than hope some people can use ethereal.
Post by: Zander on November 18, 2002, 01:22:00 PM
Z
Post by: Zander on November 18, 2002, 01:59:00 PM
If you didn't know, the MS backend for XBL is Win2KAS with .NET.
If you'd like to read up on MS's implementation of kerberos within Win2k...
http://www.MS.com/te...at/kerberos.asp
After reading some of this and comparing it against my results from my various sniffs, TGS IS handing out a valid service ticket to the xbox, but the instructions within that ticket are invalid, leading to the garbage mutlicasts we see.
Thoughts?
Z
Post by: Zander on November 18, 2002, 02:25:00 PM
Oh yeah, if you don't know what an RFC is, you probably shouldn't be reading the thread.Damn, I love responding to myself.
Z
Post by: Sev on November 18, 2002, 02:56:00 PM
The cache makes references to passport.net and xbox.com with the sn.<serialnumber> deal. I think the caches contain a raw version of what you are sniffing - it looks like Xboxes connect in a similar way to other .NET clients, but with usernames of SN.xxxxxxxxxxxx
All I can see in the logs is, as I said, site1. This may be an outgoing thing, however.
If other people with working/nonworking systems can scan their E:\cache logs, it may give some interesting results maybe.
Post by: ChocoboLee on November 18, 2002, 03:49:00 PM
Post by: PillMonster on November 18, 2002, 03:59:00 PM
Post by: Fuzzy on November 18, 2002, 04:47:00 PM
) i found a section that says sender mac adress than lists mine then says the packet MS sent out with my correct ipp but no mac adress....hmmmm
Post by: Fuzzy on November 18, 2002, 04:54:00 PM
Post by: PillMonster on November 18, 2002, 06:00:00 PM
Almost right. I think you'll find the code is actually in one of the packets being sent though, or alternatively in the "update" code or both. This way MS can use different packets for different serial numbers, cycle them etc. making the system nigh on impossible to crack. Or as soon as they suspect a successful hack, limit it, and quickly replace the code.
Post by: Zander on November 18, 2002, 06:44:00 PM
http://xbox-scene.fx...1e45dab7430272b
Thanks, that thread has more up to date information.
Z