Advertisement
emf1123

deobfuscate mk2

Aug 16th, 2018
1,867
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 0.64 KB | None | 0 0
  1. def deobfuscate(source_cmdline):
  2.     import re
  3.     import base64
  4.     elems = source_cmdline.split('&')
  5.     encoded_str = elems[0]
  6.     encoded_str = encoded_str.replace('^','')
  7.     SUB = re.compile(r'.*set.*(.)=(.)!',re.IGNORECASE)
  8.     for e in elems[1:-1]:
  9.         m=SUB.match(e)
  10.         if m:
  11.             encoded_str = encoded_str.replace(m.group(1),m.group(2))
  12.     m=re.match(r'.*\s([A-Za-z0-9]+=?=?)', encoded_str)
  13.     if m:
  14.         try:
  15.             b=base64.b64decode(m.group(1))
  16.             encoded_str=b.replace('\x00','')
  17.         except:
  18.             pass
  19.     m=re.match(r'.*=.(http.+\.[Ss][Pp][Ll][Ii][Tt]\(...\))',encoded_str)
  20.     if m:
  21.         u=m.group(1)
  22.         urls = u[:-12].split(u[-3])
  23.         return urls
  24.     else:
  25.         return []
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement