#!/usr/bin/perl use strict; use warnings; #use MIME::Base64; use URI::Escape; use LWP::UserAgent; #print base64ToText("lUcPBf9dfsxp_6VvTASlkbO462aWgXNwMOl00HyBlqTCZowPGR1l4i\"uxLkgseX0Sefqpmf7aCMRZd1kc8scScfIf8juFgxPup357nLOuVhsHlFqsU6SH9JPM\"RY\"4XKVOFd790u4G8UoxHAfrS4s52EzM7mcuNhfNfQRG7V98LRk8IcGGLvgwoxz0Nv48IchbHtLgN62kt\"tXd7_dhrYq3EP5m7Ax0nsbkksCQBhHIaIyKGJvSDejAsbkovRGgDGGbEul_v3aFhH2xbTnk01DN1DHwABeDCK9T7Xl9i3yK0H_aDOCQ00JvX_hWp3\"pAydZaX0UrqZDxwiY5aqUmKchQCSm7"),"\n"; #print decode_base64("lUcPBf9dfsxp+6VvTASlkbO462aWgXNwMOl00HyBlqTCZowPGR1l4i/uxLkgseX0Sefqpmf7aCMRZd1kc8scScfIf8juFgxPup357nLOuVhsHlFqsU6SH9JPM/RY/4XKVOFd790u4G8UoxHAfrS4s52EzM7mcuNhfNfQRG7V98LRk8IcGGLvgwoxz0Nv48IchbHtLgN62kt/tXd7+dhrYq3EP5m7Ax0nsbkksCQBhHIaIyKGJvSDejAsbkovRGgDGGbEul+v3aFhH2xbTnk01DN1DHwABeDCK9T7Xl9i3yK0H+aDOCQ00JvX+hWp3/pAydZaX0UrqZDxwiY5aqUmKchQCSm7"),"\n"; my ($text,$ob,$base_length)=@ARGV; if ($text && $ob && $base_length) { #print uri_escape(&dec(&base64ToText($text),$ob,$base_length)); print &dec(&base64ToText($text),$ob,$base_length),"\n"; } elsif ($text =~ /http:/) { my ($doc, $ret, $url, $name); $doc=&wget($text) || die "fetch $text"; if ($doc =~ /new Array\(\);\w+=(\d+)[^']*?\w+='(\w+)'/s) { $base_length=$1; $ob=$2; } else { die "base_length or ob(fuscation) string not found"; } if ($doc =~ /enc\(base64ToText\('([^']+)'/s) { $text=$1; } else { die "(cipher)text not found"; } $ret=&dec(&base64ToText($text),$ob,$base_length); if ($ret =~ /href="([^"]+)">([^<]+)$name" || die "open $name"; print O &wget($url) || die "wget/write"; close O || die "close $name"; } else { print $ret; } } else { print <<"EOF"; $0: decode sendspace obfuscated urls sendspace_dec.pl sendspace_dec.pl examples: sendspace_dec.pl 'oogfcnUJCC87dTWtGrVsC8jlkaEboGYh9JMefmKoclAmbWUbPr"kFdCZt_9UUbtxi4muu8GfiMNae1VbYQTUIT2l9fOgNnE9bzydvKN_WOlvuBtGx0OmOsHfuymiCsB6asZdH7cph_xr3YLiHQR690kSNpK9o8EoCB749fay_gaY1XGBqzUefHjOGcfC5dBpnb8pG7xpAIlFoLTDTZkV26C82doBdj1ofgt"HZe6Ibd6G3lp9_E8RwOOsJEnBDKE2cvsN0eIQ1tb4zHORFz8UL3yuhldGtYYULZPGScU71z8pzY"zFM"br9mpabEn"_hjc3IlWQ1erwkiZpO3qecN1yRQjOB' b7Nxf 236 Axel Corti - Der Schalldämpfer - An Einem Wintermorgen vor Sonnenaufgang.mp3 sendspace_dec.pl http://www.sendspace.com/file/3hblgx getting http://fs07n2.sendspace.com/dl/85aed4abf9bd2cdd7176a759896fffa8/45bab071/3hblgx/Axel Corti - Der Schalldämpfer - An Einem Wintermorgen vor Sonnenaufgang.mp3 EOF } sub dec($$) { my ($text,$ob,$base_length)=@_; my (@base_array, $i, $j, $k, $l, @ob_array, $out,$exc,$offset); for $i (0.. ($base_length-1)) { $base_array[$i]=$i; } #ob='HGZNc'; $k=0; @ob_array=@base_array; for $j (0.. ($base_length-1)) { $k=(unpack("C",substr($ob,$j%length($ob),1))+$ob_array[$j]+$k)%$base_length; $exc=$ob_array[$j]; $ob_array[$j]=$ob_array[$k]; $ob_array[$k]=$exc; $ob_array[$k]=$ob_array[$k]^5; } $out=""; $k=0; for $l (0..(length($text)-1)) { $offset=$l%$base_length; $k=($ob_array[$offset]+$k)%$base_length; $exc=$ob_array[$offset]; $ob_array[$offset]=$ob_array[$k]; $ob_array[$k]=$exc; $out.=pack("C",unpack("C",substr($text,$l,1))^$ob_array[($ob_array[$offset]+$ob_array[$k])%$base_length]); } return $out; } sub base64ToText($) { my $b64s='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_"'; my ($t)=@_; my $r=''; my $m=0; my $a=0; my $c; for my $n (0..(length($t)-1)) { $c=index($b64s,substr($t,$n,1)); if($c >= 0) { if($m) { $r.=pack("C",(($c << (8-$m))&255) | $a) } $a = $c >> $m; $m+=2; if($m==8) { $m=0; } } else { print substr($t,$n,1); } } return $r; } # par 1: url, (optional) parameter 2: content in case of POST request sub wget($;$) { my ($request, $response, $success); my ($url,$content)=@_; my $ua = LWP::UserAgent->new; $request = HTTP::Request->new(GET => "$url"); if ($content) { $request->method("POST"); $request->content($content); } $success=0; while (!$success) { $ua->agent('Mozilla/5.0'); $ua->timeout(2); # $ua->conn_cache($cache); $response = $ua->request($request); $success=$response->is_success; } return $response->content; }