Hacking Self-hosted payloads with only static HTML

The Real Jdbye

*is birb*
Member
Joined
Mar 17, 2010
Messages
23,252
Trophies
4
Location
Space
XP
13,805
Country
Norway
Android uses java language, but no standard library is available. it's simpler to use a webserver for Android to host static files
That's simply untrue.
These are all the libraries HaxServer uses:
http://developer.android.com/reference/java/io/package-summary.html
http://developer.android.com/reference/java/nio/package-summary.html
http://developer.android.com/reference/java/util/package-summary.html
http://developer.android.com/reference/java/net/package-summary.html
http://developer.android.com/reference/java/lang/reflect/package-summary.html
As you can see they are all available on Android. Generally any java.* library should be available on android, and I'm not aware of any missing things. The only difference is in GUI, which HaxServer doesn't have much of anyway. You can even include standard .jar files as libraries.
Edit: Turns out there are certain things that are missing from the Java libraries in Android, but the essentials are all there, including everything HaxServer needs.
 
Last edited by The Real Jdbye,

drizztbsd

Well-Known Member
OP
Newcomer
Joined
Apr 4, 2016
Messages
66
Trophies
0
XP
138
Country
Italy
Update:
Now the repository ia automatically updated (hourly job) using new releases of loadiine payloads.
Automatic Homebrew Launcher update support is WIP.
 
  • Like
Reactions: KiiWii

SpaceJump

Well-Known Member
Member
Joined
Aug 18, 2005
Messages
3,866
Trophies
1
Location
Zebes
XP
3,272
Country
Germany
I can't get this to work on my Android phone? I installed the Palapa web server on my phone and copied the files to www root folder. When I launch the site I see the Homebrew Launcher and Loadiine buttons, but when I click either of them all I get is a white screen.

Loading from wiiubru.com works fine.
 
  • Like
Reactions: pwsincd

kikukku

Active Member
Newcomer
Joined
Mar 31, 2016
Messages
25
Trophies
0
Age
38
XP
94
Country
Indonesia
Hello guys, may i ask you some question?

1. Does 5.5.1 kexploit still using the same 5.3.2 race attack?
2. I use 5.3.2 kexploit files/elf from definitive guide, and have about 50% chance of success. So if i use this 5.5.1 kexploit files on 5.3.2, will it increase those chance?
3. I'm using tosh*ba flash air to do my own offline "private server", so with the OP files, i could do the same things right? Waiting answer from @KiiWii
 

KiiWii

Editorial Team
Editorial Team
Joined
Nov 17, 2008
Messages
16,574
Trophies
3
Website
defaultdnb.github.io
XP
26,885
Country
United Kingdom
Hello guys, may i ask you some question?

1. Does 5.5.1 kexploit still using the same 5.3.2 race attack?
2. I use 5.3.2 kexploit files/elf from definitive guide, and have about 50% chance of success. So if i use this 5.5.1 kexploit files on 5.3.2, will it increase those chance?
3. I'm using tosh*ba flash air to do my own offline "private server", so with the OP files, i could do the same things right? Waiting answer from @KiiWii

These files didn't work for me self hosting on ez share for my 5.5.1 console. No idea why, other than perhaps lack of php/Java support on ez share.

Using the original files from HBL and loadiine on 5.3.2 though I have excellent success rate on my 5.3.2 Wii u self hosting.
 

Patxinco

Riding a Shooting Star
Member
Joined
Apr 18, 2011
Messages
847
Trophies
1
XP
2,228
Country
Spain
I'm using your package with kWS android server, and works perfect, selecting the route of the www in the app, and bookmark the ip + port do the trick.
Easy as fuck, thank you!!!
 

kimmy2000

Active Member
Newcomer
Joined
Apr 10, 2016
Messages
40
Trophies
0
Age
45
XP
105
Country
These files didn't work for me self hosting on ez share for my 5.5.1 console. No idea why, other than perhaps lack of php/Java support on ez share.

Using the original files from HBL and loadiine on 5.3.2 though I have excellent success rate on my 5.3.2 Wii u self hosting.

Also not working for my Flashair wifi card =(
 
  • Like
Reactions: KiiWii

Inaki

Well-Known Member
Member
Joined
Jan 23, 2014
Messages
278
Trophies
0
Age
42
XP
603
Country
Also not working for my Flashair wifi card =(

Not working with my Toshiba FlashAir either :(. I have tried redatim's package and also other verions of kexploit10.mp4, loadiine.mp4 out there ( I even converted some .bin ones to .mp4 with bin2mp4 ) and no luck. The sympthoms are the video player appears and the console freezes.

Only had success with HaxServer.jar or http://loadiine.ovh/hax?kexploit10 and http://loadiine.ovh/hax?kexploit10 so far :(

I really really reaaally want to use my WiFi SD for this but...
 
  • Like
Reactions: KiiWii

drizztbsd

Well-Known Member
OP
Newcomer
Joined
Apr 4, 2016
Messages
66
Trophies
0
XP
138
Country
Italy
Not working with my Toshiba FlashAir either :(. I have tried redatim's package and also other verions of kexploit10.mp4, loadiine.mp4 out there ( I even converted some .bin ones to .mp4 with bin2mp4 ) and no luck. The sympthoms are the video player appears and the console freezes.

Only had success with HaxServer.jar or http://loadiine.ovh/hax?kexploit10 and http://loadiine.ovh/hax?kexploit10 so far :(

I really really reaaally want to use my WiFi SD for this but...

Unlucky some webserver doesn't work correctly with mp4 payload (and I didn't know the reason, maybe latency or some header) :mellow:
 

Inaki

Well-Known Member
Member
Joined
Jan 23, 2014
Messages
278
Trophies
0
Age
42
XP
603
Country
Unlucky some webserver doesn't work correctly with mp4 payload (and I didn't know the reason, maybe latency or some header) :mellow:

I tried static html or direct route to the .mp4 itself, no luck...

Maybe the whole point of doing dynamic stuff ( java, php,... ) is adapting to the requesting memory layout ? I don't mean just the wii u version but more tricky things usually done in exploiting such as calibrating the shellcode and adapting the base shellcode in the .BIN to the .MP4, making some offsets/values in the shellcode adapt to the nature of the executing browser or something like that.

One thing I would try is downloading the .MP4 by sniffing the communication between our wii u to a working server, be it the java one or some working online server. That could make it... although maybe it is not enough yet, because maybe is not just the console but the iteration/instance itself which makes a difference in offsets, etc.

What do java and php versions exactly do in the .BIN > .MP4 generation ?, there must be a point of doing dynamic generation... yet, using a server with these static versions is working... WTF ?!

:?

EDIT: it could be as simple as our toshiba flashair's http server being slow combined to the fact that as an MP4 is a "streamable" type of file the reception of the MP4 is both chunk by chunk and slow. So the wiiu's browser receives first few chunks ( small ones ) and starts to interpret them ( the video player part starts to process it ) and the exploit is triggered but part of the file ( and shellcode ) is not available yet so it crashes. Just a theory...
 
Last edited by Inaki,

drizztbsd

Well-Known Member
OP
Newcomer
Joined
Apr 4, 2016
Messages
66
Trophies
0
XP
138
Country
Italy
Hello guys, may i ask you some question?

1. Does 5.5.1 kexploit still using the same 5.3.2 race attack?
2. I use 5.3.2 kexploit files/elf from definitive guide, and have about 50% chance of success. So if i use this 5.5.1 kexploit files on 5.3.2, will it increase those chance?
3. I'm using tosh*ba flash air to do my own offline "private server", so with the OP files, i could do the same things right? Waiting answer from @KiiWii

1. No different hax
2. you can try to use payload532.mp4 directly since, by default, the old payload532.html is used
 

lordelan

Well-Known Member
Member
Joined
Jan 4, 2015
Messages
5,784
Trophies
1
Age
44
XP
6,509
Country
Germany
This is a mod of the www directory present on homebrew_launcher and loadiine, but with mp4 payloads precompiled using bin2mp4.

This mod allows you to host the payloads ony *any* webserver.

Supported Wii U version:
Loadiine: 4.0.0, 4.1.0, 5.0.0, 5.3.2, 5.5.0, 5.5.1
Homebrew Launcher: 3.0.0, 3.1.0, 4.0.0, 4.1.0, 5.0.0, 5.3.2, 5.5.0, 5.5.1

Just download https://github.com/drizzt/wiiu-payloads/archive/www.zip, extract it and copy wiiu-payloads-www in your webserver.

No PHP, Python, Java, JavaScript, etc, required. Just a pure webserver.

Update:
Added a GitHub hosted version of the site.
You just need to open http://git.io/wiiuhax on your Wii U.
This is epic and makes my ZSUN Wifi Stick with OpenWRT usable for 5.5.x consoles as well. Thank you very much! :)

--------------------- MERGED ---------------------------

I can't get this to work on my Android phone? I installed the Palapa web server on my phone and copied the files to www root folder. When I launch the site I see the Homebrew Launcher and Loadiine buttons, but when I click either of them all I get is a white screen.

Loading from wiiubru.com works fine.
Use kWS app.
 

onepiecefreak

Kuriimu 2 Developer
Member
Joined
Aug 12, 2015
Messages
525
Trophies
0
XP
1,733
Country
Germany
I used your package. But when I click on the Loaddine button, my console freezes. I thought the kexploit were included in the loadiine's nightly build or something like that?
I'm on 5.5.1.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    DinohScene @ DinohScene: Certified Nin10yearold (tm)