Pikabot (v: 1.8.32-beta) network decryptor

pikabot-network-decrypt.py

# Hexdump viewer
def hexdump(data: bytes, length: int = 16) -> None:
    def is_printable(b):
        return 0x20 <= b < 0x7f

    def to_printable(b):
        if is_printable(b):
            return f'\033[34m{chr(b)}\033[0m'
        else:
            return f'\033[31m.\033[0m'

    def to_hex_printable(b):
        if is_printable(b):
            return f'\033[34m{b:02x}\033[0m'
        else:
            return f'{b:02x}'

    header = "| Offset   | Hex View                                        | ASCII            |"
    separator = "|----------+-------------------------------------------------+------------------|"
    print(header)
    print(separator)

    for offset in range(0, len(data), length):
        chunk = data[offset:offset+length]
        hex_view = ' '.join(to_hex_printable(byte) for byte in chunk)
        ascii_view = ''.join(to_printable(byte) for byte in chunk)

        # Adjust formatting for lines shorter than the specified length
        if len(chunk) < length:
            hex_view += '   ' * (length - len(chunk))

        print(f"| {offset:08x} | {hex_view:<47} | {ascii_view:<16} |")

# From OAlabs notes
def rc4(data, key):
    S = list(range(256))
    j = 0
    out = b''
    # KSA Phase
    for i in range(256):
        j = (j + S[i] + key[i % len(key)]) % 256
        S[i], S[j] = S[j], S[i]
    # PRGA Phase
    i = j = 0
    for char in data:
        i = (i + 1) % 256
        j = (j + S[i]) % 256
        S[i], S[j] = S[j], S[i] # swap
        out += bytes([char ^ S[(S[i] + S[j]) % 256]])
    return out


def decrypt_request(http_data: bytes) -> bytes:
    """Decrypt Pikabot network request, it takes
    the http body (POST request) as first parameter
    and return the decrypted blob"""

    configuration: bytes = http_data[:0x10] 
    rc4_key: bytes = http_data[0x10: 0x30]
    blob: bytes = http_data[0x30:]
    shift_value = configuration[-1]
    
    blob_shifted = blob[-shift_value:] + blob[:-shift_value]

    plaintext = rc4(blob_shifted, rc4_key)

    hexdump(plaintext)

    return plaintext



if __name__ == "__main__":
    import sys
    import binascii
    for line in sys.stdin.readlines():
        try:
            decrypt_request(binascii.unhexlify(line.strip()))
        except Exception as er:
            pass