Geofferey

#!/bin/env python3

import socket
import sys
from datetime import datetime, timedelta, timezone
import string
import argparse
import os
import time
import threading

Geofferey

#!/bin/sh

## This is an example of enabling QCOM HS USB DIAG + ADB using rc.local.d/00adbd
# You can get out of this mode by plugging in and select charge only then tehter
# I feel like there may be better way but this is easiest way I've found
#
# Place me in /etc/rc.local.d/00adbd
#

PATH=/bin:/sbin:/usr/bin:/usr/sbin:/opt/nvtl/bin:/opt/nvtl/data/branding/bin

Geofferey

#!/bin/sh

## This script will make persistent modifications to the Inseego M2000
#
# • Enables rc.local(.d) init for easily executing arbitrary scripts
# • Permanently enables dropbear SSH via symlink to rc3.d/
# • Permanently enable QCOM HS USB DIAG + ADB on boot
# 

/bin/ln -s /etc/init.d/dropbear /etc/rc3.d/S99sdropbear

Geofferey

#!/bin/sh

PATH=/bin:/sbin:/usr/bin:/usr/sbin:/opt/nvtl/bin:/opt/nvtl/data/branding/bin

# Place in /etc/rc.local

for script in /etc/rc.local.d/*; do

    if [ -x $script ]; then

Geofferey

#!/bin/sh
# INIT script for starting rc.local > rc.local.d
# Placed in /etc/init.d/rc_local.sh
#set -x

case "$1" in
  start)
        echo -n "Starting rc.local: "
        /bin/sh /etc/rc.local
        echo "done"

Geofferey

client
dev tun
persist-tun
persist-key
ncp-ciphers AES-128-GCM:AES-256-GCM
cipher AES-128-GCM
auth SHA1
tls-client
resolv-retry infinite
remote some-server.internal 1196 

Geofferey

client
dev tun
persist-tun
persist-key
ncp-ciphers AES-128-GCM:AES-256-GCM
cipher AES-128-GCM
auth SHA1
tls-client
resolv-retry infinite
remote some-server.internal 1196 

Geofferey

#!/bin/sh

PATH=/bin:/sbin:/usr/bin:/usr/sbin:/opt/nvtl/bin:/opt/nvtl/data/branding/bin

## PoC Exploit payload for the Open VPN implementation RCE on Inseego M2000 (Novatel)
# Append the following to .opvn to be uploaded to the Inseego m2000, full paths must be used
#
#     tls-verify "/path/to/bin/executable"
#
# ^ That's 5 spaces or a <TAB> ^

Geofferey

#!/system/bin/sh

if [ -z ${INTERACTIVE} ]; then

    until [[ $(getprop sys.boot_completed) = 1 ]] && [[ $(getprop dev.bootcomplete) = 1 ]] && [[ $(getprop service.bootanim.exit) = 1 ]] && [[ $(getprop init.svc.bootanim) = stopped ]]; do

      sleep 5

    done

Geofferey

#!/system/bin/sh

PATH=$PATH:/system/bin:/system/xbin:/vendor/bin:/vendor/xbin

TUN_INTF=tun_vpn0
WLAN_INTF=wlan0
AP_INTF=wlan1
ETH_INTF=eth0
RMNET_INTFS=rmnet_data+
WG_INTF=tun_vpn0