forticrack_v8

Forticrack v8.0.0 解密并提取 FortiOS 8.0.0 固件镜像。 本脚本扩展了 Bishop Fox 的 Forticrack，以支持 8.0.0 固件镜像。此外，RandoriSec 的文章 关于 FortiGate 7.4.7 固件加密的内容，对逆向 FortiOS 8.0.0 的加密机制非常有帮助，因为它看起来像是 7.4.7 加密机制的更新迭代版本。 同时适用于 FGT 和 FFW 镜像。 使用方法 已在 FGT 和 FFW v8.0.0.F-build0167 上完成测试。其他构建版本可能需要重新逆向内核，以找到 RSA 公钥和 XOR...

tp-link-decrypt

注意：截至 2025 年 10 月 5 日，此项目现已弃用。 Nate Robbins 已善意接手并添加了交换机解密功能 - https://github.com/robbins/tp-link-decrypt ====================================================================================================== 如果你觉得这个工具好用，欢迎通过 [email protected] 或 GitHub 告诉我 : 1.（可选）运行 ./preinstall.sh 以满足依赖项 2...

lexmark

Lexmark 打印机相关 这个仓库包含了我公开发布的所有与 Lexmark 打印机相关的工作。 你们中的大多数人可能是冲着固件解密工具来的；请查看 tools 文件夹。 exploit 文件夹包含了我开发的一个（在当时属于）0day 漏洞利用，它似乎影响了超过 100 种不同的 Lexmark 打印机型号。这个漏洞利用最初是为 Pwn2Own Toronto 2022 开发的，并在实际比赛期间神奇地失败了。ZDI 无论如何都提出要以一个可笑的金额购买这些漏洞，而我很快就忘了他们的报价。 和往常一样：所有内容均按原样分发，不要期待支持/更新。 尽情享用！ -- blasty...

sonicrack

Sonicrack 由 Bishop Fox 的 Team X 开发 描述 一款用于解密 SonicOSX NSv 防火墙固件（7.1.1+ 版本）的工具。首先对 OVA 镜像运行它以提取密钥，之后它还可以解密 SIG 镜像。固件可通过有效的许可证从 SonicWall 支持站点 获取。 密钥似乎是每种型号特有的，因此该工具仅适用于 VMware NSv 镜像。理论上，获得其他型号的密钥可以让你解密其他镜像。 该工具已公开，以支持对 SonicOSX 的善意安全研究。详细说明请访问 Bishop Fox 博客。 安装 Debian Linux: root@kitploit: sudo a...

canon-tools

canon-tools 用于解密佳能 PIXMA 打印机固件的工具。 有关背景的更多信息，请参阅以下博客文章：https://synacktiv.com/publications/treasure-chest-party-quest-from-doom-to-exploit 参考资料 这项工作受到 Contextis 研究（https://www.contextis.com/us/blog/hacking-canon-pixma-printers-doomed-encryption）的启发。...

samsung-q60t-exploit

Tizen 漏洞利用 描述 在 Grehack 2021 上展示的漏洞利用与固件解密脚本。 幻灯片可在 slides 目录中获取，重播视频可在 Youtube 上观看。 目录 该仓库包含三个目录： exploit/: 包含 v8 漏洞利用和内核漏洞利用， firmware/: 包含固件解密脚本 slides/: 包含在 grehack 上展示的关于此项工作的演示文稿 漏洞利用 首先，你需要修改 payload.c 中的攻击者 IP： .. code-block:: c root@kitploit: char cmdbusybox = "/usr/bin/curl...

EUVD-2025-210675

In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. Successful exploitation may allow access to decrypted...

CVE-2021-27328

Yeastar NeoGate TG400 91.3.0.3 devices are affected by Directory Traversal. An authenticated user can decrypt firmware and can read sensitive information, such as a password or decryption key...

Dormakaba Access Manager security vulnerabilities

Dormakaba Access Manager is a smart hardware controller developed by the American company Dormakaba. There is a security vulnerability in Dormakaba Access Manager, which stems from the use of a static extractable password in the firmware update ZIP file, potentially allowing the firmware to be...

EUVD-2025-16691

Malicious code in bioql PyPI...

CVE-2025-49164

Arris VIP1113 devices through 2025-05-30 with KreaTV SDK have a firmware decryption key of cd1c2d78f2cba1f73ca7e697b4a485f49a8a7d0c8b0fdc9f51ced50f2530668a...

CVE-2025-49164

Arris VIP1113 devices through 2025-05-30 with KreaTV SDK have a firmware decryption key of cd1c2d78f2cba1f73ca7e697b4a485f49a8a7d0c8b0fdc9f51ced50f2530668a...

Arris VIP1113 安全漏洞

The Arris VIP1113 is a set-top box for HD IPTV services from Arris USA. A security vulnerability exists in the Arris VIP1113 version 2025-05-30 and earlier, which stems from a firmware decryption key of cd1c2d78f2cba1f73ca7e697b4a485f49a8a7d0c8b0fdc9f51ced50f2530668a...

CVE-2025-49164

CVE-2025-49164 affects Arris VIP1113 devices using the KreaTV SDK. The root issue is exposure of the firmware decryption key: cd1c2d78f2cba1f73ca7e697b4a485f49a8a7d0c8b0fdc9f51ced50f2530668a. Documented scope indicates vulnerability through 2025-05-30; exploitation status is not provided in the s...

CVE-2025-49164

Arris VIP1113 devices through 2025-05-30 with KreaTV SDK have a firmware decryption key of cd1c2d78f2cba1f73ca7e697b4a485f49a8a7d0c8b0fdc9f51ced50f2530668a...

CVE-2025-49164

Arris VIP1113 devices through 2025-05-30 with KreaTV SDK have a firmware decryption key of cd1c2d78f2cba1f73ca7e697b4a485f49a8a7d0c8b0fdc9f51ced50f2530668a...

CVE-2024-50690

SunGrow WiNet-SV200.001.00.P027 and earlier versions contains a hardcoded password that can be used to decrypt all firmware updates...

SunGrow WiNet-S 安全漏洞

SunGrow WiNet-S is a LAN communication module from SunGrow, China. A security vulnerability exists in SunGrow WiNet-S version V200.001.00.P027 and prior versions, which can be exploited by an attacker to decrypt all firmware updates...

PT-2024-22296 · Image Access Gmbh · Scan2Net

Name of the Vulnerable Software and Affected Versions: Application affected versions not specified Description: The issue concerns the application's use of several hard-coded credentials. These credentials are used for encrypting config files during backup and decrypting new firmware during...

Image Access Scan2Net 安全漏洞

Image Access Scan2Net is a scanning software from Image Access, Germany. A security vulnerability exists in Image Access Scan2Net versions 7.40 and earlier, 7.42 and earlier, and 7.42B and earlier, which stems from the application's use of multiple hard-coded credentials to encrypt configuration...