All ASIC for Bitcoin do a double SHA256 hash on an arbitrary string. But maybe they might be used for pen testing :-)
Lets assume we have single SHA256 hash we want to crack. We also have an ASIC that does double SHA256. Well if we compare results computed by double SHA256 to passwords that generated SHA256 hash we will get nothing. But what if we do single SHA256 on SHA256 hash that we got on start using CPU, and then try to find SHA(SHA256(x))? If we find goodX it would be our password.
Would modifying firmware, or just mining proxy that feeds miner with work do the job?