ira grachevskaya from the hit vn Z.A.T.O. // I Love the World and Everything In It49016@catgirl.cloud
Oct 20, 2026, 11:51 PMdo you have any trust in eMudhra after the 4 incident? glad that at least the RSA certificates were safe?
fear not, here's a complete bypass of their 1fa otp login system. they encrypt OTPs to a public key and issue those behind cloudflare turnstile. this key to be precise:
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA7/OR1az+yTKt1ZONkk+T
owML34smGCo8evpk4zLCsrc+LXtX20yERombX4xh2Sd3VDFML2LuOavB3PwGFfL0
Qr+gGPomq23nqaX9nr5SeSTpFbrxsEEVdipXXpucTFFhnzye7Y7ZodHNQSjUqQPu
L6ktk/YkP0B6k5lIMT//W/4gB3yU1UGCLcSvdMQJo5+I7OdIGxQbir4rtXpdm8qP
3pblFPJXcHc2urBHvJvatUpq/rY0Km4Cxz5ZJwM7MW/hxSRpiTXNoE58W8DHEQVq
ln7RDh0Cc7lA0Qvm92NJIohbi4KZzmq81UA2MyHwyxtkykQxRFO1gEU5i/dp/I5D
ZQIDAQAB
-----END PUBLIC KEY-----
would be a real shame if you can just take that key and """sign""" (encrypt) otp requests yourself :^)
