search

the-cult-of-integral / discord-raidkit

An open-source, forever free tool that allows you to raid and destroy Discord servers via Discord bots, compromise Discord accounts, and generate Discord token grabbers.
GNU General Public License v2.0
610 stars 166 forks source link

Payloads generated by Osiris do not run if set to not use start-up registry key. #139

Closed GhostYT23 closed 4 months ago

GhostYT23 commented 4 months ago

Describe the bug The payload generated doesn't work i just double click it and nothing happens , i tried from another pc aswell but still nothing . Another thing , it seems to me that even given the token the information that you get from the "account info" function are less then how much they used to be.

To Reproduce Steps to reproduce the behavior:

  1. Just open the .exe
  2. Generate a simple payload
  3. Try to open it
  4. Nothing happens

Expected behavior A message in the channel whit the the webHook in it.

Desktop (please complete the following information):

the-cult-of-integral commented 4 months ago

@GhostYT23 Thanks for the quick test!

I always try to test these things, and something slips me every time. You are correct in saying that the token grabber does not currently do anything. This is because of a single indent that adds the addition of calling main() inside an if statement when it should be outside. A fix for this should be ready in about ten minutes.

I tested the information returned by getting account information on my account, and the information has stayed the same for me. The discriminator is no longer included since Discord deprecated it, but my details are still there, including PayPal information from when I was testing with Nitro. Could you provide me with the output you get with your token (information censored/changed, obviously)?

As I mentioned, the grabber still needs some work for v2.5.1 to combat Discord's changes since the one provided by wodxgod appears to be out of date.

the-cult-of-integral commented 4 months ago

@GhostYT23

I pushed a fix for this issue and updated the released executable. I will mark this issue resolved but keep it open for a secondary point raised regarding less output.

LoLSouley commented 4 months ago

Hey there! I've been trying to use the Token Grabber, I've been testing it with my own token. Before the hotfix, the token was an entirely different one, than my actual one. After the hotfix, roughly the first half of the token grabbed is correct, while the 2nd half is gibberish.

Also when I try to log into the account via Osiris, it gives me an error message.

Failed to login to account with WebDriverException: Message: Stacktrace: GetHandleVerifier [0x0086C203+27395] (No symbol) [0x00803E04] (No symbol) [0x00701B7F] (No symbol) [0x00742C65] (No symbol) [0x00742D3B] (No symbol) [0x0077EC82] (No symbol) [0x007639E4] (No symbol) [0x0077CB24] (No symbol) [0x00763736] (No symbol) [0x00737541] (No symbol) [0x007380BD] GetHandleVerifier [0x00B23AB3+2876339] GetHandleVerifier [0x00B77F7D+3221629] GetHandleVerifier [0x008ED674+556916] GetHandleVerifier [0x008F478C+585868] (No symbol) [0x0080CE44] (No symbol) [0x00809858] (No symbol) [0x008099F7] (No symbol) [0x007FBF4E] BaseThreadInitThunk [0x753DFCC9+25] RtlGetAppContainerNamedObjectPath [0x770380CE+286] RtlGetAppContainerNamedObjectPath [0x7703809E+238]

Please help!

the-cult-of-integral commented 4 months ago

@LoLSouley Hey there!

For the first instance, when it grabbed an entirely different token, was this from some media you haven't used in a while? For example, a token saved by Chrome, and you last logged into Discord on Chrome a while ago? I only ask since Discord user accounts change tokens quite regularly (upon log out, password reset, possibly even on reboot, but I'm not sure about that).

As for the second instance, when you say complete gibberish, do you mean that the second half was just incorrect, or foreign symbols, or what?

Finally, regarding the selenium issue? Does this same error occur for all web browsers? If not, which web browser specifically?

If you wish for more instant communication, add ? on Discord.

the-cult-of-integral commented 4 months ago

After further investigation, it would appear that, after several long, hard, gruelling years of work, the fat, furry gamers who work at Discord have finally patched the most basic security vulnerabilities and no longer store a plaintext authentication token within any leveldb files. I presume anything related to a browser is patched, too.

I have done some looking around on Github, and most of the other similar, open-source token grabbers have also been patched, at least for Discord. I'm sure other methods of grabbing Discord tokens exist, but they're probably way more advanced than wob's, the original base for this grabber. Also, it's now 2:40 in the morning, so I'm gonna go ahead and say it's patched. 😅