search

exploits-forsale / collateral-damage

Kernel exploit for Xbox SystemOS using CVE-2024-30088
MIT License
355 stars 30 forks source link

Nothing happens when I run the script. #8

Closed UberZer0 closed 1 day ago

UberZer0 commented 3 weeks ago

My OS is 10.0.25398.4478, got gamescript installed and stayed offline with custom DNS. Literally did everything letter to letter, even permissions through firewall for both run.exe and payload. Netcat is also listening, but whenever I run the code, counter just goes up and there is no further log from console. Any tips?

Daasin commented 1 week ago

Have you checked game script error logs?

Might show an issue there, also you could try turning off WiFi and data on mobile and connecting both PC & Xbox to a hotspot if on Android (Don't need DNS for that if mobile doesn't have internet)

UberZer0 commented 1 week ago

Have you checked game script error logs?

Might show an issue there, also you could try turning off WiFi and data on mobile and connecting both PC & Xbox to a hotspot if on Android (Don't need DNS for that if mobile doesn't have internet)

I even tried literal ethernet connection, directly from my motherboard to xbox. I have no idea. I haven't checked the error logs though, but I didn't try looking at the gs error logs and I just did. Here is the problem, it's parsing error. I wonder if it is because of picoducky? Thank you for your reply, literally didn't think of that.

parse

landaire commented 1 week ago

Sounds like the picoducky might not have typed the script correctly. You should try comparing what was typed into the app vs the raw text file. You don't need to go deep into the weeds on the shellcode, but just see if the code surrounding it looks the same.

Daasin commented 1 week ago

I had similar issues when copying and pasting it, used a flipper rubber ducky and some editing when it kept inserting the word TRING instead of enter... And then it worked

UberZer0 commented 1 week ago

Sounds like the picoducky might not have typed the script correctly. You should try comparing what was typed into the app vs the raw text file. You don't need to go deep into the weeds on the shellcode, but just see if the code surrounding it looks the same.

I had similar issues when copying and pasting it, used a flipper rubber ducky and some editing when it kept inserting the word TRING instead of enter... And then it worked

In the Game Script app (iirc, at work right now, will check about in 6 hours) I saw nothing out of ordinary though. The payload had it's STRING to let the ducky know what it is but the text itself in the app didn't have that. I'll check that again. I wonder if I can type it myself without errors... (probably not.) Also Daasin, did your ducky did a misinput with writing TRING as text or something else happened? Iandaire, (iirc again) I saw nothing out of ordinary but... will check it again and report here with screenshots again.

Thank you all for your inputs.

UberZer0 commented 1 week ago

I think I found it. It refuses to add '[ ]'. I can't even do it with a keyboard. Any suggestions? Edit: All of them are missing and Xbox is refusing to add them manually. Another edit: Changing the region for keyboard does nothing. image

landaire commented 1 week ago

It looks like multiple characters are failing to type correctly. Notice that i is missing from i2c_map and host_ip. I would recommend trying a different method or figuring out why the picoducky is having troubles. I've not done this method so I can't really help here.

UberZer0 commented 1 week ago

It looks like multiple characters are failing to type correctly. Notice that i is missing from i2c_map and host_ip. I would recommend trying a different method or figuring out why the picoducky is having troubles. I've not done this method so I can't really help here.

How did you do it? With file explorer? I just increased delay but it made it even worse now, it writes like it's corrupted. I don't know what to do. Maybe I can use my phone as ducky? Edit: nvm, it needs root with custom rom.

landaire commented 1 week ago

Maybe I can use my phone as ducky?

Is it an Android phone? I believe there are apps / people who have done it this way.

How did you do it? With file explorer?

Adv File Explorer.

UberZer0 commented 1 week ago

Maybe I can use my phone as ducky?

Is it an Android phone? I believe there are apps / people who have done it this way.

How did you do it? With file explorer?

Adv File Explorer.

Wait ok I found Modded Warfare's video, I'll try to get it from local page but idk if it will allow me to copy brackets. Edit: The goddamn mobile app doesn't ''see'' the text files to share.

DerfJagged commented 2 days ago

You could try miniweb. Download miniweb.exe, put the script in the htdocs folder and delete everything else in that folder, run miniweb.exe, then on your Xbox open Edge and go to your computer's IP address and the port mentioned on the miniweb (default 8000?). It will open the script in the browser and you can copy and paste the text.

UberZer0 commented 1 day ago

You could try miniweb. Download miniweb.exe, put the script in the htdocs folder and delete everything else in that folder, run miniweb.exe, then on your Xbox open Edge and go to your computer's IP address and the port mentioned on the miniweb (default 8000?). It will open the script in the browser and you can copy and paste the text.

Dude it worked, thank you SO much. So it was all about the ducky. Maybe it's because I'm using it in my language. Thank you all, DerfJagged, Iandaire, Daasin for your time and patience. Cheers. image