Toggle sidebar

Hacking [Attempt] Running GW3.0 Web Exploit on a Local Network

  • Thread starter Thread starter bendrr
  • Start date Start date
  • Views Views 68,758
  • Replies Replies 198
  • Likes Likes 1
bendrr

bendrr

Well-Known Member
Member
Level 2
Joined
Dec 3, 2014
Messages
163
Reaction score
58
Trophies
0
Age
51
XP
170
Country
United States
I can't browse anything but ssl ( https:// ) right now with my 3ds browsers. I copied the javascript and html at http://go.gateway-3ds.com/index.php and saved it on my local xampp network so I can browse it from my network. No joy so far, just loads the page and does nothing. It's on 6.2 firmware. I formatted it, cleared history and cookies.

So the question is, since the browser exploit just loads launcher.dat from the sd card ( smc://launcher.dat ), should it work just the same on my network. The xampp install works fine.



The files I used for my solution were from from Falo:

Falo said:
the region doesn't matter, i made a simple c# app to download all of the different payloads and only the version string matters.

fw 2.0 = "Mozilla/5.0 (Nintendo 3DS; U; ; en) Version/1.7412.US"
fw 2.1-3.X = "Mozilla/5.0 (Nintendo 3DS; U; ; en) Version/1.7498.US"
fw 4.0-4.X = "Mozilla/5.0 (Nintendo 3DS; U; ; en) Version/1.7455.US"
fw 5.0-7.0 = "Mozilla/5.0 (Nintendo 3DS; U; ; en) Version/1.7552.US"
fw 7.1-9.X = "Mozilla/5.0 (Nintendo 3DS; U; ; en) Version/1.7567.US"

so there are 5 different payloads.
here the payloads in html and as binary dat:

http://www.mediafire.com/download/2pd0p3htica8c4n/gateway30_payloads.7z
Click to expand...

There were various instructions from others in this thread, read for details.
 
  • Like
Reactions: bowser
bendrr said:
I can't browse anything but ssl ( https:// ) right now with my 3ds browsers. I copied the javascript and html at http://go.gateway-3ds.com/index.php and saved it on my local xampp network so I can browse it from my network. No joy so far, just loads the page and does nothing. It's on 6.2 firmware. I formatted it, cleared history and cookies.

So the question is, since the browser exploit just loads launcher.dat from the sd card ( smc://launcher.dat ), should it work just the same on my network. The xampp install works fine.

Anyone have a solution?
Click to expand...
It's a PHP page
Maybe there is hidden PHP code on it? Not sure
 
  • Like
Reactions: Kelton2
Just to get it out of the way, this is the html on the page in question,
This user does not have permission to use the HTML BB code.

It should run no matter what server it is on right? ( local or not )
 
No, you downloaded the wrong file, you miss the hidden iframe and the correct payload.
Check my post on the main thread.
Visit the site on your pc using the correct 3ds user agent and try again please :)
 
  • Like
Reactions: Margen67
hias said:
No, you downloaded the wrong file, you miss the hidden iframe and the correct payload.
Check my post on the main thread.
Visit the site on your pc using the correct 3ds user agent and try again please :)
Click to expand...

so thats the issue, will move to a normal internet connection and try again.

Does anyone have the contents of the iframe?
 
The iframe just executes the javascript code via event. Not sure if this is needed and part of the browser bug. The important part is the correct payload.
 
The frame.html

Code: 
<html>
        <head>
                <script>
                        var nb = 0;
                        function handleBeforeLoad() {
                                if (++nb == 1) {
                                        p.addEventListener('DOMSubtreeModified', parent.dsm, false);
                                } else if (nb == 2) {
                                        p.removeChild(f);
                                }
                        }
 
                        function documentLoaded() {
                                f = window.frameElement;
                                p = f.parentNode;
                                var o = document.createElement("object");
                                o.addEventListener('beforeload', handleBeforeLoad, false);
                                document.body.appendChild(o);
                        }
 
                        window.onload = documentLoaded;
                </script>
        </head>
        <body>
                KEKEKEKEK...
        </body>
</html>
 
  • Like
Reactions: Margen67 and bendrr
Thomas12345 said:
The frame.html

Code: 
<html>
        <head>
                <script>
                        var nb = 0;
                        function handleBeforeLoad() {
                                if (++nb == 1) {
                                        p.addEventListener('DOMSubtreeModified', parent.dsm, false);
                                } else if (nb == 2) {
                                        p.removeChild(f);
                                }
                        }
 
                        function documentLoaded() {
                                f = window.frameElement;
                                p = f.parentNode;
                                var o = document.createElement("object");
                                o.addEventListener('beforeload', handleBeforeLoad, false);
                                document.body.appendChild(o);
                        }
 
                        window.onload = documentLoaded;
                </script>
        </head>
        <body>
                KEKEKEKEK...
        </body>
</html>
Click to expand...


Thanks, will try it
 
  • Like
Reactions: Margen67
Are y'all entirely certain the web browser entrypoint only loads launcher.dat? If so, why--do you have evidence to suggest so?
If not, I'd probably try sniffing the network to see if the 3DS downloads any other data when the exploit is executed (in the normal way, from the GW website).

Also, could you clarify "just loads the page and does nothing"? I assume this means 'I see "GATEWAY 3DS LOADING"; the web browser does not close with an error or otherwise misbehave'; is this correct?

(I'm a useless asshole who can't help you anyway--sorry ;_;. I'm just interested in the browser exploit.)
 
bendrr said:
I can't browse anything but ssl ( https:// ) right now with my 3ds browsers. I copied the javascript and html at http://go.gateway-3ds.com/index.php and saved it on my local xampp network so I can browse it from my network. No joy so far, just loads the page and does nothing. It's on 6.2 firmware. I formatted it, cleared history and cookies.

So the question is, since the browser exploit just loads launcher.dat from the sd card ( smc://launcher.dat ), should it work just the same on my network. The xampp install works fine.

Anyone have a solution?
Click to expand...


Have you tried the QR Code version? I saw a post about it.
 
  • Like
Reactions: Margen67 and bendrr
Helper said:
Are y'all entirely certain the web browser entrypoint only loads launcher.dat? If so, why--do you have evidence to suggest so?
If not, I'd probably try sniffing the network to see if the 3DS downloads any other data when the exploit is executed (in the normal way, from the GW website).

Also, could you clarify "just loads the page and does nothing"? I assume this means 'I see "GATEWAY 3DS LOADING"; the web browser does not close with an error or otherwise misbehave'; is this correct?

(I'm a useless asshole who can't help you anyway--sorry ;_;. I'm just interested in the browser exploit.)
Click to expand...



The browser closes with an error after the page loads asking me to restart the 3ds when I load the exploit locally. I do see gateway 3ds loading... before it closes.
 
bendrr said:
The browser closes with an error after the page loads asking me to restart the 3ds when I load the exploit locally. I do see gateway 3ds loading... before it closes.
Click to expand...
Interesting. And that's the error which asks you to save and then restart it yourself--not the one which forces a shutdown as soon as you acknowledge the message?

If it's the latter, I'd say something has gone very wrong somewhere. But if it's the former, I think you're almost there. I kept getting the error message upon loading the page; I finally got it to work by placing launcher.dat on a different, newly-formatted SD card. Anyway, it sounds like you have your server set up perfectly--kudos for that!
 
The first error you mentioned is the one. I looked at the javascript functions that I see and it's a buffer overload I think. Wonder why it's not working. The console doesn't throw any errors with default settings. I wonder what firebug would report if anything.

*edit
Just an undefined error, no specifics so far. It's my network I'm positive but I wonder why it can't be executed off their server. If it matters to anyone with the same error, I also get "Failed to load part of this page" when trying to use it locally.

If they enabled ssl for the /go/ folder, that would solve some problems for me (and others?).

Another note, wish they would release the index.php and javascript for a backup url and even better, offline mode. I suppose offline mode is in the next update maybe? The index file has some of the exploit, calculations I think?

Any ideas?
 

Site & Scene News

Go to forum More news

Popular threads in this forum

Why did the price of 3ds shoot up ?

Hacking Homebrew Project  BlazerTube - a YouTube 3DS revival using the REAL app!

Homebrew app Emulator  [Release] 3DS-CLI - Run a real RISC-V Linux environment on the Nintendo 3DS

Gaming  any good rpgs on 3ds?

Hardware  2 Broken 3DSes, need help

Website for finding alternative games for 3DS

Hacking  Modding Reassurance

GodMode9 wont launch, holding START just goes to home screen