Manouchehri

Recovering the BIOS password from a Panasonic CF-U1 mk2 (AMI Aptio UEFI)

A mess of my own making

While messing with a CF-U1 handheld PC that I bought off ebay I managed to mess up the BIOS and it seems it reverted to previous settings which included an unknown BIOS password, it would however still boot into windows. Since I could still boot windows I was able to dump the bios flash using AFUWINGUI.EXE the version I used was 3.09.03.1462 which is available here:
https://ami.com/en/?Aptio_4_AMI_Firmware_Update_Utility.zip

Manouchehri

Hitron CODA-4582U 7.1.1.30 devices allow XSS via a Managed Device name on the > Wireless > Access Control > Add Managed Device screen.

Impact: 
Script can be stored in Database and execute every time when users visits it. If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user.
Amongst other things, the attacker can:
1) Perform any action within the application that the user can perform. 
2) View any information that the user is able to view. 
3) Modify any information that the user is able to modify. 
4) Initiate interactions with other application users, including malicious attacks, that will appear to originate from  the initial victim user.

Manouchehri

• sudo apt install zram-config, this will install several files, including systemd startup /etc/systemd/system/multi-user.target.wants/zram-config.service
• sudo nano /usr/bin/init-zram-swapping and edit:

#!/bin/sh

# load dependency modules
NRDEVICES=1
if modinfo zram | grep -q ' zram_num_devices:' 2>/dev/null; then
 MODPROBE_ARGS="zram_num_devices=${NRDEVICES}"

Manouchehri

[Match]
Name = enp2s0
[Network]
Address = 172.16.25.52/22

Manouchehri

/*
  NOTE: This code assumes a bare git repo in ./bare-git/,
  which should have at least one text file in its root,
  named "greetings.txt".
  
  This code updates the contents of a "greetings.txt"
  file, and creates a new file called "greetings-XXX.txt"
  (with XXX being a random number). It then creates a new
  commit for these changes. Finally, it reads and dumps
  the new current contents of the repo, file by file.

Manouchehri

From a4a400549761cba03af4a6a14caeb3785255a1e3 Mon Sep 17 00:00:00 2001
From: Joey Jiao <joeyjiaojg@163.com>
Date: Sun, 27 Oct 2019 13:39:43 +0800
Subject: [PATCH] AFL: Enable AFL by global paths

Change-Id: Iede00c60802f7b4856cde6d3b3c27201a68f3e5f
---
 android/config.go   | 21 +++++++++++++++++++++
 android/variable.go |  4 ++++
 cc/builder.go       | 11 +++++++++++

Manouchehri

#!/usr/bin/env bash

set -e -o pipefail
shopt -s extglob
export LC_ALL=C

CONTAINER=""
INTER_GATEWAY="192.168.30.0/24"
INTER_IP_HOST="192.168.30.1/32"
INTER_IP_CONT="192.168.30.2/32"

Manouchehri

# got this from http://stackoverflow.com/questions/8672809/use-ffmpeg-to-add-text-subtitles

ffmpeg -i infile.mp4 -f srt -i infile.srt -c:v copy -c:a copy -c:s mov_text outfile.mp4


# confirmed working with the following ffmpeg
# (installed using `brew 'ffmpeg', args: ['with-libvorbis', 'with-libvpx']` )
ffmpeg version 3.1.2 Copyright (c) 2000-2016 the FFmpeg developers
built with Apple LLVM version 7.3.0 (clang-703.0.31)
configuration: --prefix=/usr/local/Cellar/ffmpeg/3.1.2 --enable-shared --enable-pthreads --enable-gpl --enable-version3 --enable-hardcoded-tables --enable-avresample --cc=clang --host-cflags= --host-ldflags= --enable-opencl --enable-libx264 --enable-libmp3lame --enable-libxvid --enable-libvorbis --enable-libvpx --disable-lzma --enable-vda

Manouchehri

#!/bin/bash -ex

# Build a new Centos8 install on EBS volume in a chroot
# Run from RHEL8 or CentOS8 instance - eg: ami-0c322300a1dd5dc79 in us-east-1 (RHEL 8 official image)
# Script expects a second EBS volume, I add them as /dev/sdf in the console
# When the script completes, turn the second EBS volume into your new AMI through the console.

# Adjust the section below to match the device names you're using. Defaults are for an m5.large

# m5 series requires the updated device names

Manouchehri

hardware/software

Webcam parts:

• Raspberry Pi Zero W Rev 1.1
• Raspberry Pi Camera v2 (8-megapixel)
• Raspberry Pi High Quality Camera (12.3-megapixel)
• Raspbian Buster Lite 2020-02-13

Webcam works with:

• Windows 10
• Windows 10 "Camera" app