ss23

#!/bin/bash

# https://hashcat.net/wiki/doku.php?id=example_hashes
hashtype=500
filename=./hashes.txt

# You can pass arguments to hashcat using this script, e.g.
# ./crack-template.sh --username --show

hashcat=/opt/hashcat/latest/hashcat.bin

ss23

<?php

$url = parse_url($_GET['url']);
if ($url['host'] == 'example.com') {
  $ch = curl_init();
  curl_setopt($ch, CURLOPT_URL, htmlentities($_GET['url']));
  curl_setopt($ch, CURLOPT_FOLLOWLOCATION,TRUE);
  curl_exec($ch);
}

ss23

Top 10 Pinephone uses

ss23

#!/bin/bash
# Run this with "./crack-template.sh --show" to show cracked passwords

hashcat=/opt/hashcat/latest/hashcat.bin

# Dictionary attack (plain)
$hashcat -m 7500 ./hashes.txt /usr/share/wordlists/rockyou.txt

# Dictionary attack with rules (use base64.rule for best bang for buck -- dive.rule for exhaustive rules)
$hashcat -m 1000 ./hashes.txt --username /usr/share/wordlists/crackstation.txt -O -r /opt/hashcat/latest/rules/dive.rule $1

ss23

0x1000000:      0xE3A00012      mov             r0, #0x12
0x1000004:      0xE121F000      msr             cpsr_c, r0
0x1000008:      0xE36FF013      msr             spsr_fsxc, #0x13
0x100000c:      0xE3A00017      mov             r0, #0x17
invalid type of memory specified
unmapped memory read!!! addr: 0x14 size: 0x0

ss23

0x1000000:      0xE36FF013      msr             spsr_fsxc, #0x13
0x1000004:      0xE3A00017      mov             r0, #0x17
0x1000008:      0xE121F000      msr             cpsr_c, r0
0x100000c:      0x00000000      andeq           r0, r0, r0

ss23

typedef enum uc_mode {
    UC_MODE_LITTLE_ENDIAN = 0,    // little-endian mode (default mode)
    UC_MODE_BIG_ENDIAN = 1 << 30, // big-endian mode

    // arm / arm64
    UC_MODE_ARM = 0,              // ARM mode
    UC_MODE_THUMB = 1 << 4,       // THUMB mode (including Thumb-2)
    UC_MODE_MCLASS = 1 << 5,      // ARM's Cortex-M series (currently unsupported)
    UC_MODE_V8 = 1 << 6,          // ARMv8 A32 encodings for ARM (currently unsupported)

ss23

exec_addr: 0x4FFFC140
load_addr: 0x4E080000
load_size: 0x1F7FFF8
Finished parsing firmware header. Initializing Unicorn Engine...
real_load_size: 0x1F80000
Finished loading Unicorn Engine. Loading firmware image into memory mapped region...
Reading firmware image from 0x60800...
Firmware loaded! Lets get this party started.
0x4fffc140:     0xE3A00000      mov             r0, #0
0x4fffc144:     0xE3A01000      mov             r1, #0

ss23

exec_addr: 0x4FFFC140
load_addr: 0x4E080000
load_size: 0x1F7FFF8
Finished parsing firmware header. Initializing Unicorn Engine...
real_load_size: 0x1F80000
Finished loading Unicorn Engine. Loading firmware image into memory mapped region...
Reading firmware image from 0x60800...
Firmware loaded! Lets get this party started.
%pc: 4fffc140

ss23

import socket
HOST = 'host.com'
PORT =  50100
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((HOST, PORT))

# read
data = s.read(8192)

# write