Advertisement
havalqandiel

openllllddd1

Nov 12th, 2016
90
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 12.76 KB | None | 0 0
  1. import re, urllib2, requests, cookielib, string, urllib
  2.  
  3. #from jsbeautifier.unpackers import UnpackingError
  4.  
  5. PRIORITY = 1
  6.  
  7. def detect(source):
  8. """Detects whether `source` is P.A.C.K.E.R. coded."""
  9. return source.replace(' ', '').startswith('eval(function(p,a,c,k,e,')
  10.  
  11. def unpack(source):
  12. """Unpacks P.A.C.K.E.R. packed js code."""
  13. payload, symtab, radix, count = _filterargs(source)
  14.  
  15. if count != len(symtab):
  16. raise UnpackingError('Malformed p.a.c.k.e.r. symtab.')
  17.  
  18. try:
  19. unbase = Unbaser(radix)
  20. except TypeError:
  21. raise UnpackingError('Unknown p.a.c.k.e.r. encoding.')
  22.  
  23. def lookup(match):
  24. """Look up symbols in the synthetic symtab."""
  25. word = match.group(0)
  26. return symtab[unbase(word)] or word
  27.  
  28. source = re.sub(r'\b\w+\b', lookup, payload)
  29. return _replacestrings(source)
  30.  
  31. def _filterargs(source):
  32. """Juice from a source file the four args needed by decoder."""
  33. juicers = [ (r"}\('(.*)', *(\d+), *(\d+), *'(.*)'\.split\('\|'\), *(\d+), *(.*)\)\)"),
  34. (r"}\('(.*)', *(\d+), *(\d+), *'(.*)'\.split\('\|'\)"),
  35. ]
  36. for juicer in juicers:
  37. args = re.search(juicer, source, re.DOTALL)
  38. if args:
  39. a = args.groups()
  40. try:
  41. return a[0], a[3].split('|'), int(a[1]), int(a[2])
  42. except ValueError:
  43. raise UnpackingError('Corrupted p.a.c.k.e.r. data.')
  44.  
  45. # could not find a satisfying regex
  46. raise UnpackingError('Could not make sense of p.a.c.k.e.r data (unexpected code structure)')
  47.  
  48.  
  49.  
  50. def _replacestrings(source):
  51. """Strip string lookup table (list) and replace values in source."""
  52. match = re.search(r'var *(_\w+)\=\["(.*?)"\];', source, re.DOTALL)
  53.  
  54. if match:
  55. varname, strings = match.groups()
  56. startpoint = len(match.group(0))
  57. lookup = strings.split('","')
  58. variable = '%s[%%d]' % varname
  59. for index, value in enumerate(lookup):
  60. source = source.replace(variable % index, '"%s"' % value)
  61. return source[startpoint:]
  62. return source
  63.  
  64.  
  65. class Unbaser(object):
  66. """Functor for a given base. Will efficiently convert
  67. strings to natural numbers."""
  68. ALPHABET = {
  69. 53 : '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ',
  70. 59 : '0123456789abcdefghijklmnopqrstuvwABCDEFGHIJKLMNOPQRSTUVWXYZ',
  71. 62 : '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ',
  72. 95 : (' !"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ'
  73. '[\]^_`abcdefghijklmnopqrstuvwxyz{|}~')
  74. }
  75.  
  76. def __init__(self, base):
  77. self.base = base
  78.  
  79. # If base can be handled by int() builtin, let it do it for us
  80. if 2 <= base <= 36:
  81. self.unbase = lambda string: int(string, base)
  82. else:
  83. # Build conversion dictionary cache
  84. try:
  85. self.dictionary = dict((cipher, index) for
  86. index, cipher in enumerate(self.ALPHABET[base]))
  87. except KeyError:
  88. raise TypeError('Unsupported base encoding.')
  89.  
  90. self.unbase = self._dictunbaser
  91.  
  92. def __call__(self, string):
  93. return self.unbase(string)
  94.  
  95. def _dictunbaser(self, string):
  96. """Decodes a value to an integer."""
  97. ret = 0
  98. for index, cipher in enumerate(string[::-1]):
  99. ret += (self.base ** index) * self.dictionary[cipher]
  100. return ret
  101. class AADecoder(object):
  102. def __init__(self, aa_encoded_data):
  103. self.encoded_str = aa_encoded_data.replace('/*´∇`*/', '')
  104.  
  105. self.b = ["(c^_^o)", "(゚Θ゚)", "((o^_^o) - (゚Θ゚))", "(o^_^o)",
  106. "(゚ー゚)", "((゚ー゚) + (゚Θ゚))", "((o^_^o) +(o^_^o))", "((゚ー゚) + (o^_^o))",
  107. "((゚ー゚) + (゚ー゚))", "((゚ー゚) + (゚ー゚) + (゚Θ゚))", "(゚Д゚) .゚ω゚ノ", "(゚Д゚) .゚Θ゚ノ",
  108. "(゚Д゚) ['c']", "(゚Д゚) .゚ー゚ノ", "(゚Д゚) .゚Д゚ノ", "(゚Д゚) [゚Θ゚]"]
  109.  
  110. def is_aaencoded(self):
  111. idx = self.encoded_str.find("゚ω゚ノ= /`m´)ノ ~┻━┻ //*´∇`*/ ['_']; o=(゚ー゚) =_=3; c=(゚Θ゚) =(゚ー゚)-(゚ー゚); ")
  112. if idx == -1:
  113. return False
  114.  
  115. is_encoded = self.encoded_str.find("(゚Д゚)[゚o゚]) (゚Θ゚)) ('_');", idx) != -1
  116. return is_encoded
  117.  
  118. def base_repr(self, number, base=2, padding=0):
  119. digits = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ'
  120. if base > len(digits):
  121. base = len(digits)
  122.  
  123. num = abs(number)
  124. res = []
  125. while num:
  126. res.append(digits[num % base])
  127. num //= base
  128. if padding:
  129. res.append('0' * padding)
  130. if number < 0:
  131. res.append('-')
  132. return ''.join(reversed(res or '0'))
  133.  
  134. def decode_char(self, enc_char, radix):
  135. end_char = "+ "
  136. str_char = ""
  137. while enc_char != '':
  138. found = False
  139. # for i in range(len(self.b)):
  140. # print self.b[i], enc_char.find(self.b[i])
  141. # if enc_char.find(self.b[i]) == 0:
  142. # str_char += self.base_repr(i, radix)
  143. # enc_char = enc_char[len(self.b[i]):]
  144. # found = True
  145. # break
  146.  
  147. # print 'found', found, enc_char
  148. if not found:
  149. for i in range(len(self.b)):
  150. enc_char = enc_char.replace(self.b[i], str(i))
  151. # enc_char = enc_char.replace('(゚Θ゚)', '1').replace('(゚ー゚)', '4').replace('(c^_^o)', '0').replace('(o^_^o)', '3')
  152. # print 'enc_char', enc_char
  153. startpos = 0
  154. findClose = True
  155. balance = 1
  156. result = []
  157. if enc_char.startswith('('):
  158. l = 0
  159.  
  160. for t in enc_char[1:]:
  161. l += 1
  162. # print 'looping', findClose, startpos, t, balance
  163. if findClose and t == ')':
  164. balance -= 1
  165. if balance == 0:
  166. result += [enc_char[startpos:l + 1]]
  167. findClose = False
  168. continue
  169. elif not findClose and t == '(':
  170. startpos = l
  171. findClose = True
  172. balance = 1
  173. continue
  174. elif t == '(':
  175. balance += 1
  176.  
  177. if result is None or len(result) == 0:
  178. return ""
  179. else:
  180. for r in result:
  181. value = self.decode_digit(r, radix)
  182. # print 'va', value
  183. str_char += value
  184. if value == "":
  185. return ""
  186.  
  187. return str_char
  188.  
  189. enc_char = enc_char[len(end_char):]
  190.  
  191. return str_char
  192.  
  193. def parseJSString(self, s):
  194. try:
  195. # print s
  196. # offset = 1 if s[0] == '+' else 0
  197. tmp = (s.replace('!+[]', '1').replace('!![]', '1').replace('[]', '0')) # .replace('(','str(')[offset:])
  198. val = int(eval(tmp))
  199. return val
  200. except:
  201. pass
  202.  
  203. def decode_digit(self, enc_int, radix):
  204. # enc_int = enc_int.replace('(゚Θ゚)', '1').replace('(゚ー゚)', '4').replace('(c^_^o)', '0').replace('(o^_^o)', '3')
  205. # print 'enc_int before', enc_int
  206. # for i in range(len(self.b)):
  207. # print self.b[i], enc_char.find(self.b[i])
  208. # if enc_char.find(self.b[i]) > 0:
  209. # str_char += self.base_repr(i, radix)
  210. # enc_char = enc_char[len(self.b[i]):]
  211. # found = True
  212. # break
  213. # enc_int=enc_int.replace(self.b[i], str(i))
  214. # print 'enc_int before', enc_int
  215.  
  216. try:
  217. return str(eval(enc_int))
  218. except: pass
  219. rr = '(\(.+?\)\))\+'
  220. rerr = enc_int.split('))+') # re.findall(rr, enc_int)
  221. v = ""
  222. # print rerr
  223. for c in rerr:
  224. if len(c) > 0:
  225. # print 'v', c
  226. if c.strip().endswith('+'):
  227. c = c.strip()[:-1]
  228. # print 'v', c
  229. startbrackets = len(c) - len(c.replace('(', ''))
  230. endbrackets = len(c) - len(c.replace(')', ''))
  231. if startbrackets > endbrackets:
  232. c += ')' * (startbrackets - endbrackets)
  233. if '[' in c:
  234. v += str(self.parseJSString(c))
  235. else:
  236. # print c
  237. v += str(eval(c))
  238. return v
  239.  
  240. # unreachable code
  241. # mode 0=+, 1=-
  242. # mode = 0
  243. # value = 0
  244.  
  245. # while enc_int != '':
  246. # found = False
  247. # for i in range(len(self.b)):
  248. # if enc_int.find(self.b[i]) == 0:
  249. # if mode == 0:
  250. # value += i
  251. # else:
  252. # value -= i
  253. # enc_int = enc_int[len(self.b[i]):]
  254. # found = True
  255. # break
  256.  
  257. # if not found:
  258. # return ""
  259.  
  260. # enc_int = re.sub('^\s+|\s+$', '', enc_int)
  261. # if enc_int.find("+") == 0:
  262. # mode = 0
  263. # else:
  264. # mode = 1
  265.  
  266. # enc_int = enc_int[1:]
  267. # enc_int = re.sub('^\s+|\s+$', '', enc_int)
  268.  
  269. # return self.base_repr(value, radix)
  270.  
  271. def decode(self):
  272. self.encoded_str = re.sub('^\s+|\s+$', '', self.encoded_str)
  273.  
  274. # get data
  275. pattern = (r"\(゚Д゚\)\[゚o゚\]\+ (.+?)\(゚Д゚\)\[゚o゚\]\)")
  276. result = re.search(pattern, self.encoded_str, re.DOTALL)
  277. if result is None:
  278. common.log_utils.log_debug("AADecoder: data not found")
  279. return False
  280.  
  281. data = result.group(1)
  282.  
  283. # hex decode string
  284. begin_char = "(゚Д゚)[゚ε゚]+"
  285. alt_char = "(o゚ー゚o)+ "
  286.  
  287. out = ''
  288. # print data
  289. while data != '':
  290. # Check new char
  291. if data.find(begin_char) != 0:
  292. common.log_utils.log_debug("AADecoder: data not found")
  293. return False
  294.  
  295. data = data[len(begin_char):]
  296.  
  297. # Find encoded char
  298. enc_char = ""
  299. if data.find(begin_char) == -1:
  300. enc_char = data
  301. data = ""
  302. else:
  303. enc_char = data[:data.find(begin_char)]
  304. data = data[len(enc_char):]
  305.  
  306. radix = 8
  307. # Detect radix 16 for utf8 char
  308. if enc_char.find(alt_char) == 0:
  309. enc_char = enc_char[len(alt_char):]
  310. radix = 16
  311.  
  312. # print repr(enc_char), radix
  313. # print enc_char.replace('(゚Θ゚)', '1').replace('(゚ー゚)', '4').replace('(c^_^o)', '0').replace('(o^_^o)', '3')
  314.  
  315. # print 'The CHAR', enc_char, radix
  316. str_char = self.decode_char(enc_char, radix)
  317.  
  318. if str_char == "":
  319. common.log_utils.log_debug("no match : ")
  320. common.log_utils.log_debug(data + "\nout = " + out + "\n")
  321. return False
  322. # print 'sofar', str_char, radix,out
  323.  
  324. out += chr(int(str_char, radix))
  325. # print 'sfar', chr(int(str_char, radix)), out
  326.  
  327. if out == "":
  328. common.log_utils.log_debug("no match : " + data)
  329. return False
  330.  
  331. return out
  332.  
  333.  
  334. url = 'https://openload.co/embed/aFNMCPye31g/'
  335.  
  336. agent = 'Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36'
  337. Accept_lng = 'nl-NL,nl;q=0.8,en-US;q=0.6,en;q=0.4'
  338. headers = {'Connection': 'keep-alive','User-Agent': agent,'Accept-Encoding': None,'Upgrade-Insecure-Requests': '1','Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8', 'Accept-Language': Accept_lng }
  339. request = urllib2.Request(url, headers = headers)
  340. tk = urllib2.urlopen(request).read(); #print tk
  341.  
  342. match = re.findall('<script type="text/javascript">(.+)\s*(.+?)</script>', tk)
  343. for urlx, urly in match:
  344. if len(urlx) > 220:
  345. url1= urlx
  346. url2 = urly
  347.  
  348. aa1= AADecoder(url1.replace('/*´∇`*/','')); aa1= aa1.decode(); print aa1
  349.  
  350. print '################################################################'
  351.  
  352. aa2= AADecoder(url2.replace('/*´∇`*/','')); aa2= aa2.decode();print aa2
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement